SPLK-1002 Advanced Searching and Statistics Practice Question
Which THREE of the following are valid ways to count the number of events per minute for a given sourcetype?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main sourcetype=web | eval minute = strftime(_time, "%Y-%m-%d %H:%M") | stats count by minute
Options C, D, and E correctly count events per minute. C uses eval to create a full timestamp string (year-month-day hour:minute) and then stats count by that string groups events by each minute. D uses bucket _time span=1m to create 1-minute time buckets, then stats count by _time gives per-minute event counts. E uses timechart count span=1m, which automatically bins events into 1-minute intervals and displays the count. Option A is incorrect because date_minute only extracts the minute portion (0-59), so it groups events from different hours and days together, not per-minute across the full timeline. Option B is incorrect because streamstats count window=1m calculates a running count over the last minute, not a per-minute event count.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=main sourcetype=web | stats count by date_minute
Why it's wrong here
date_minute is only the minute part (0-59), not unique per minute across hours/days.
- ✗
index=main sourcetype=web | streamstats count window=1m | where count>0
Why it's wrong here
streamstats calculates a running count, not a per-minute aggregate.
- ✓
index=main sourcetype=web | eval minute = strftime(_time, "%Y-%m-%d %H:%M") | stats count by minute
Why this is correct
Creates a unique minute string and groups by it.
- ✓
index=main sourcetype=web | bucket _time span=1m | stats count by _time
Why this is correct
Bucket groups events into 1-minute bins, then stats counts per bin.
- ✓
index=main sourcetype=web | timechart count span=1m
Why this is correct
Timechart automatically groups by time with a 1-minute span and counts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.