SPLK-1002 Advanced Searching and Statistics Practice Question
Which TWO of the following are valid ways to calculate the median of a numeric field?
⚠ Common exam trap
Splunk often tests the distinction between `eval` and `stats` functions, and candidates mistakenly use `eval` with aggregation functions like `percentile` or confuse the syntax for percentile commands (e.g., `perc`, `p50`) with the correct `perc50` or `percentile` syntax.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
stats p50(field)
Options B, D, and E are all valid ways to calculate the median. Option B uses `eventstats median(field)` which adds the median as a new field to each event. Option D uses `stats p50(field)` which is a valid alias for `perc50` and computes the 50th percentile (median). Option E uses `stats median(field)` directly. Options A and C are invalid because `eval` cannot use `percentile` directly and `perc` is not a valid function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
eval median = percentile(field, 50)
Why it's wrong here
percentile is not an eval function; it is a stats function.
- ✗
eventstats median(field)
Why it's wrong here
eventstats median adds the median value to each event.
- ✗
stats perc(field, 50)
Why it's wrong here
perc requires a number suffix, e.g., perc50, not a parameter.
- ✓
stats p50(field)
Why this is correct
Correct. `stats p50(field)` is a valid alias for `stats perc50(field)` and calculates the 50th percentile, which is the median.
- ✓
stats median(field)
Why this is correct
stats median returns a single row with the median.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.