SPLK-1001 Basic Searching and Transforming Commands Practice Question
A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?
⚠ Common exam trap
It's easy for candidates to confuse `top` with `sort` or `rare`, or forget to filter by `status=404`, leading them to choose options that either sort alphabetically, show least common values, or ignore the error condition entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=web status=404 | top src_ip
It first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
index=web status=404 | top src_ip
Why this is correct
top returns the most frequent values of src_ip.
- ✗
index=web status=404 | sort src_ip
Why it's wrong here
sort only orders alphabetically, not by count.
- ✗
index=web | top src_ip
Why it's wrong here
This returns top IPs overall, not filtered to 404 errors.
- ✗
index=web status=404 | rare src_ip
Why it's wrong here
rare returns the least common values, not the top.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.