SPLK-1001 Basic Searching and Transforming Commands Practice Question
A user needs to create a report showing the average response time per endpoint for the last hour. Which command would produce this result?
⚠ Common exam trap
Splunk often tests the distinction between `stats` and `chart` commands, where candidates mistakenly use `chart` with `over` instead of `by`, or confuse `eval` with aggregation functions, leading them to choose incorrect options like A or B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
stats avg(response_time) by endpoint
The `stats` command with `avg(response_time) by endpoint` calculates the average response time for each unique endpoint, which directly meets the requirement of showing average response time per endpoint for the last hour. The `stats` command is the standard way to compute aggregate statistics like average over grouped fields in Splunk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chart avg(response_time) over endpoint
Why it's wrong here
chart requires a time axis or split by; it's not suitable for non-time-based aggregation.
- ✗
eval avg(response_time)
Why it's wrong here
eval creates a new field for each event, it does not aggregate.
- ✗
top endpoint
Why it's wrong here
top only counts occurrences, not averages.
- ✓
stats avg(response_time) by endpoint
Why this is correct
stats computes the average of response_time for each endpoint.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.