SPLK-1001 Basic Searching and Transforming Commands Practice Question
A security analyst needs to find the number of failed login attempts per user in the last hour. The events contain a field 'result' with value 'failure'. Which search is correct?
⚠ Common exam trap
Splunk often tests the distinction between `stats`, `chart`, and `timechart` by presenting a scenario where a simple aggregation is needed, and candidates mistakenly choose `chart` or `timechart` because they think any visualization command is required, when in fact `stats` is the correct non-visual aggregation command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=security source=login result=failure | stats count by user
The `stats count by user` command correctly groups events by the `user` field and counts the number of events per user, which directly answers the question of failed login attempts per user. The search first filters events with `index=security`, `source=login`, and `result=failure`, then uses `stats` to aggregate the count per user. This is the most efficient and precise way to produce a table of user-to-failure-count mappings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=security source=login result=failure | top user
Why it's wrong here
top shows only top users, not all users.
- ✗
index=security source=login result=failure | timechart count by user
Why it's wrong here
timechart adds a time axis, not needed.
- ✗
index=security source=login result=failure | chart count by user
Why it's wrong here
chart works but less standard for simple aggregation.
- ✓
index=security source=login result=failure | stats count by user
Why this is correct
Correctly groups by user and counts events.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.