SPLK-1001 Basic Searching and Transforming Commands Practice Question
An analyst executes the following search: index=main sourcetype=access | stats dc(user) by host. What does dc(user) do?
⚠ Common exam trap
Many exam-takers confuse `dc()` with `count()` or `sum()`, thinking it returns a total count of events or a sum of values, rather than understanding it performs a distinct count of field values per group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Distinct count of users per host
The `dc(user)` function in SPL stands for 'distinct count' of the `user` field. When used after `stats ... by host`, it calculates the number of unique users associated with each host. This is why option B is correct: it returns the distinct count of users per host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Count of hosts
Why it's wrong here
dc is applied to user, not host.
- ✓
Distinct count of users per host
Why this is correct
dc(user) by host returns the number of unique users for each host.
- ✗
Count of all users
Why it's wrong here
dc counts unique users, not total.
- ✗
Sum of user IDs
Why it's wrong here
dc is a count, not a sum.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.