SPLK-1001 Basic Searching and Transforming Commands Practice Question
A security analyst needs to find the number of failed login attempts per user. Which command group should be used?
⚠ Common exam trap
Splunk often tests the distinction between `stats`, `chart`, and `top` commands, and the trap here is that candidates may confuse `top` (which shows top values) with `stats count by user` (which provides a complete per-user count), or they may incorrectly use `chart` with improper syntax, thinking it is interchangeable with `stats` for simple aggregations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
stats count by user
The `stats count by user` command is correct because it groups events by the `user` field and calculates the count of events (failed login attempts) for each user, producing a table with two columns: `user` and `count`. This directly answers the requirement to find the number of failed login attempts per user using a transforming command that aggregates data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
top failed_login user
Why it's wrong here
top shows the most common values, not count per user.
- ✓
stats count by user
Why this is correct
stats count by user correctly groups events by user and returns a count for each user.
- ✗
chart count by user
Why it's wrong here
chart is similar but typically used for time-based or multi-series; stats is more direct for a simple count.
- ✗
sort - count
Why it's wrong here
sort only reorders results, it does not aggregate counts.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.