SPLK-1002 Advanced Searching and Statistics Practice Question
Which command adds the overall average of a field to each event in the results?
⚠ Common exam trap
Splunk often tests the distinction between `eventstats` and `stats` — the trap here is that candidates confuse `stats` (which collapses events) with `eventstats` (which adds the aggregate to each event), leading them to incorrectly choose `stats` because they think it computes the average without realizing it removes the original events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eventstats avg(latency) as avg_latency
The `eventstats` command computes aggregate statistics (like `avg(latency)`) over the entire result set and adds the result as a new field to every event, preserving all original events. This matches the requirement to add the overall average to each event. In contrast, `stats` collapses events into a single summary row, `streamstats` computes a running average per event, and `timechart` produces a time-based chart, none of which add the overall average to every original event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
streamstats avg(latency) as avg_latency
Why it's wrong here
`streamstats` computes a running average, not the overall average.
- ✗
timechart avg(latency) as avg_latency
Why it's wrong here
`timechart` creates a time-based chart, not a field addition.
- ✗
stats avg(latency) as avg_latency
Why it's wrong here
`stats` outputs only the aggregated value, not the original events.
- ✓
eventstats avg(latency) as avg_latency
Why this is correct
`eventstats` adds the average as a new field to each event.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.