Advanced Searching and Statistics →easyMultiple ChoiceObjective-mapped

SPLK-1002 Advanced Searching and Statistics Practice Question

To count events by host for the last hour, which search is most efficient?

⚠ Common exam trap

Splunk often tests the misconception that you can filter time after aggregation (as in Option B) or that limiting results with `head` is equivalent to time-based filtering, when in fact time filters must be applied at search time via `earliest`/`latest` for efficiency and correctness.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

index=* earliest=-1h | stats count by host

It uses `index=*` to search all indexes and `earliest=-1h` to restrict the search to the last hour at the index level, which is the most efficient way to filter time. The `stats count by host` then aggregates counts per host without needing to process events outside the time range. This approach leverages Splunk's time-based index pruning, minimizing data scanned.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
index=* earliest=-1h | stats count by host
Why this is correct
Applies time range early, minimizing data scanned.
✗
index=* | stats count by host | where _time > relative_time(now(), "-1h")
Why it's wrong here
Stats processes all events before filtering by time.
✗
search index=* | head 1000 | stats count by host
Why it's wrong here
Only uses first 1000 events, not representative of the last hour.
✗
sourcetype=access_combined | timechart count by host
Why it's wrong here
Timechart creates a time series, which is unnecessary and uses more resources.

Go deeper

SPLK-1002 Advanced Searching and Statistics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question