SPLK-1002 Advanced Searching and Statistics Practice Question
Which THREE of the following are valid uses of the stats command? (Select three.)
⚠ Common exam trap
Splunk often tests the distinction between `stats` and `timechart`; the trap here is that candidates see 'time-based chart' and incorrectly assume `stats` can produce it, but `timechart` is the only command that automatically bins events into time buckets and supports multiple series via the `by` clause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Calculating the average of a field across all events.
The `stats` command in Splunk is used to perform statistical aggregations on search results. Option A is correct because `stats avg(field)` calculates the arithmetic mean of a specified field across all events in the result set. Option B is correct because `stats earliest(_time) by category` returns the minimum timestamp for each distinct value of the category field, which is a standard use of the `earliest()` function. Option C is correct because `stats count by category` groups events by the categorical field and returns the number of events in each group, a fundamental aggregation pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Calculating the average of a field across all events.
Why this is correct
Stats avg() computes average
- ✓
Finding the earliest timestamp for each category.
Why this is correct
Stats earliest() by field
- ✓
Grouping events by a categorical field and counting them.
Why this is correct
Stats count by field
- ✗
Creating a time-based chart with multiple series.
Why it's wrong here
Timechart is for time-series charts
- ✗
Enriching events with fields from an external lookup.
Why it's wrong here
Lookup or inputlookup is used for enrichment
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.