Knowledge + Practice

CCNA Basic Searching Questions

69 questions · Basic Searching topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

A medium-sized company uses Splunk to monitor its e-commerce platform. The platform generates around 10 million events per day from web servers, application logs, and databases. The security team wants to identify the top 10 IP addresses that trigger the most 403 Forbidden errors in the last 24 hours. However, when they run the search: index=ecom sourcetype=web status=403 | top src_ip, the search takes over 5 minutes to complete and sometimes times out. The team needs a faster approach that still accurately identifies the top IPs. The team's Splunk environment uses indexers and a search head. The data is not accelerated. What should the team do to improve search performance?

A.Replace 'top' with 'rare' to reduce the amount of data processed

B.Use 'stats count by src_ip | sort - count | head 10' instead of top

C.Add 'fields src_ip' before top to remove other fields

D.Create a report acceleration summary for the search or implement summary indexing

AnswerD

Acceleration pre-computes results, so on-demand searches are fast.

Why this answer

Option D is correct because report acceleration or summary indexing pre-computes and stores the results of the search, allowing subsequent runs to retrieve the aggregated data almost instantly. Given the environment has indexers and a search head but no acceleration, enabling report acceleration on the search creates a summary that updates periodically, bypassing the need to scan all raw events each time. This directly addresses the timeout issue by reducing the per-search data volume to the pre-built summary.

Exam trap

The trap here is that candidates often think minor command changes (like using 'stats' instead of 'top' or adding 'fields') will significantly improve performance, when in reality the bottleneck is the full scan of 10 million events, which only data aggregation techniques like summary indexing or report acceleration can solve.

How to eliminate wrong answers

Option A is wrong because 'rare' finds the least common values, not the top IPs, and would still process the same volume of data, so it does not improve performance. Option B is wrong because while 'stats count by src_ip | sort - count | head 10' is functionally equivalent to 'top', it still requires scanning all events in the time range and does not reduce the data processing load; the performance gain is negligible. Option C is wrong because 'fields src_ip' only removes other fields from the results after the events are already retrieved and processed, so it does not reduce the amount of data scanned or the search time.

Practice this question →

2

MCQeasy

Refer to the exhibit. An analyst wants to see the top 10 most visited URI paths, but the result also includes a 'percent' column. To remove the percent column, which command should be added?

A.| table uri_path count

B.| eval percent=null()

C.| rename percent as ""

D.| fields - percent

AnswerD

Directly removes the percent field.

Why this answer

The `fields` command with a minus sign removes specified fields from the results. Since the question asks to remove the 'percent' column, `| fields - percent` is the correct and most direct way to drop that field while keeping all other fields intact.

Exam trap

The trap here is that candidates often confuse removing a field with hiding it or setting it to null, leading them to choose `eval percent=null()` or `rename percent as ""` instead of using the explicit `fields -` syntax for field removal.

How to eliminate wrong answers

Option A is wrong because `| table uri_path count` would create a table with only those two columns, but it would also discard any other fields (like the URI path and count data) and does not explicitly remove the percent column. Option B is wrong because `| eval percent=null()` sets the percent field to null but does not remove the field from the output; the column would still appear with empty values. Option C is wrong because `| rename percent as ""` attempts to rename the field to an empty string, which is invalid in Splunk and would either cause an error or leave the field with an empty name, not remove it.

Practice this question →

3

MCQmedium

A search returns many duplicate events due to data source redundancy. Which command can remove duplicate events based on a specific field?

A.uniq event_id

B.fields event_id

C.sort event_id

D.dedup event_id

AnswerD

dedup removes duplicates based on the unique values of the event_id field.

Why this answer

The `dedup` command removes duplicate events based on the values of one or more specified fields. In this case, `dedup event_id` will keep only the first occurrence of each unique `event_id` value, discarding subsequent duplicates. This is the correct command for removing duplicate events based on a specific field.

Exam trap

The trap here is that candidates may confuse the Unix `uniq` command (which removes consecutive duplicates) with Splunk's `dedup`, or mistakenly think `sort` or `fields` can eliminate duplicates, when only `dedup` performs field-based deduplication in Splunk.

How to eliminate wrong answers

Option A is wrong because `uniq` is not a valid Splunk command; the correct command for removing consecutive duplicates in a stream is `uniq` in Unix, but Splunk uses `dedup` for field-based deduplication. Option B is wrong because `fields event_id` only retains the `event_id` field in the results, removing all other fields, but does not remove duplicate events. Option C is wrong because `sort event_id` orders events by the `event_id` field but does not remove duplicates; it may even bring duplicates together but leaves them all in the results.

Practice this question →

4

MCQhard

Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?

A.`index=web sourcetype=access_combined | top limit=3 uri_path | fields - percent`

B.`index=web sourcetype=access_combined | top uri_path | head 3`

C.`index=web sourcetype=access_combined | top limit=3 showperc=f uri_path`

D.`index=web sourcetype=access_combined | top limit=3 uri_path`

AnswerC

Correct. `limit=3` limits to top 3, `showperc=f` hides the percent column.

Why this answer

Option C is correct because the `top` command's `showperc=f` argument suppresses the percentage column, and `limit=3` restricts the output to the top 3 URI paths. This directly meets the requirement of showing only the top 3 URI paths with their counts, without the percentage column.

Exam trap

Splunk often tests the specific arguments of the `top` command, and the trap here is that candidates may think `fields - percent` is the correct way to remove the percentage column, but the `showperc=f` argument is the proper and more efficient method.

How to eliminate wrong answers

Option A is wrong because the `fields - percent` command removes the percent field after the `top` command runs, but the `top` command by default includes a percent column; using `fields -` is less efficient and not the intended method. Option B is wrong because `head 3` after `top uri_path` will return the first 3 results from the default top 10, but it does not guarantee the top 3 by count and still includes the percent column. Option D is wrong because `top limit=3 uri_path` limits to 3 results but does not suppress the percent column, leaving it visible.

Practice this question →

5

MCQhard

A large financial institution uses Splunk to consolidate logs from thousands of ATMs. Each ATM sends a heartbeat event every 5 minutes containing fields: atm_id, timestamp, status (OK or ERROR), and firmware_version. The operations team wants to find the number of ATMs that have reported at least one ERROR status in the last hour. The initial search is: index=atm sourcetype=heartbeat status=ERROR | dedup atm_id | stats count. However, this search returns a count that is too high because some ATMs report multiple errors within the hour. The team needs an accurate count of ATMs that had any error, regardless of how many error events each ATM generated. The search must be efficient due to the high volume of events. Which approach should be used?

A.index=atm sourcetype=heartbeat status=ERROR | stats count(atm_id) as error_events | eval error_events

B.index=atm sourcetype=heartbeat status=ERROR | stats dc(atm_id) as errored_atms

C.index=atm sourcetype=heartbeat status=ERROR | stats count by atm_id | where count >=1 | dedup atm_id | stats count

D.index=atm sourcetype=heartbeat status=ERROR | stats values(atm_id)

AnswerB

Distinct count of atm_id gives the number of ATMs with any error.

Why this answer

Option B is correct because `stats dc(atm_id)` computes the distinct count of `atm_id` values, directly giving the number of unique ATMs that had at least one ERROR event in the last hour. This is efficient as it processes all matching events in a single pass without needing intermediate deduplication or subsearches, which is critical for high-volume ATM log data.

Exam trap

The trap here is that candidates may think `dedup atm_id` followed by `stats count` is necessary to get unique ATMs, but they overlook that `stats dc(atm_id)` achieves the same result more efficiently and is the standard Splunk command for distinct counts.

How to eliminate wrong answers

Option A is wrong because `stats count(atm_id)` counts all error events (including duplicates), not unique ATMs, and the `eval` is incomplete. Option C is wrong because it first counts events per ATM, then filters with `where count >=1` (redundant since all have at least one), then `dedup atm_id` (unnecessary and wasteful), and finally `stats count` — this is inefficient and overcomplicates the task. Option D is wrong because `stats values(atm_id)` returns a multivalue list of all ATM IDs that had errors, not a count, so it does not answer the question.

Practice this question →

6

Multi-Selectmedium

Which two components are required to create a time-based chart of average CPU usage per host over the last 4 hours? (Choose two.)

Select 2 answers

A.timechart avg(cpu) by host

B.A time range modifier like earliest=-4h

C.stats avg(cpu) by host

D.the top command

E.the fields command

AnswersA, B

Required to create time-based chart.

Why this answer

Option A is correct because `timechart` is the Splunk command specifically designed to create time-based charts, and `avg(cpu) by host` computes the average CPU usage aggregated per host over time. This command automatically splits the results into time buckets and generates a chart with time on the x-axis and the average CPU per host as series.

Exam trap

Splunk often tests the distinction between `timechart` and `stats`; the trap here is that candidates may think `stats` with a time range modifier is sufficient, but `stats` alone cannot produce a time-based chart without an explicit `bin` command and additional formatting.

Practice this question →

7

Multi-Selecthard

Which THREE of the following are valid uses of the stats command?

Select 3 answers

A.stats eval(x=1) by category

B.stats avg(response_time) as avg_time

C.stats sum(bytes) by source

D.stats count by host

E.stats table user

AnswersB, C, D

Valid stats function avg with alias.

Why this answer

Option B is correct because the `stats` command supports aggregation functions like `avg()` to compute the average of a field, and the `as` clause renames the resulting field. This is a standard and valid use of `stats` for statistical summarization.

Exam trap

Splunk often tests the distinction between `stats` and other transforming commands like `eval` or `table`, trapping candidates who confuse the syntax or assume all commands can be nested within `stats`.

Practice this question →

8

MCQeasy

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

A.| sort -user

B.| uniq user

C.| dedup user

D.| fields user

AnswerC

Removes duplicates on user field.

Why this answer

The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Exam trap

Splunk often tests the misconception that `uniq` can deduplicate across all events based on a field, but `uniq` only removes consecutive duplicates and requires the `-field` syntax, making `dedup` the correct choice for non-consecutive deduplication.

How to eliminate wrong answers

Option A is wrong because `| sort -user` sorts events in descending order by the 'user' field but does not remove duplicates. Option B is wrong because `| uniq user` is invalid syntax; `uniq` requires a field name with a hyphen (e.g., `| uniq user`) but it removes consecutive duplicates only, not all duplicates across the result set, and it does not accept a field argument in that form. Option D is wrong because `| fields user` retains only the 'user' field and removes all other fields, but it does not remove duplicate events.

Practice this question →

9

MCQeasy

A user wants to see the top 5 most common values of the 'action' field in the web access logs. Which command should be used?

A.rare

B.fields

C.sort

D.top

AnswerD

top returns most common values.

Why this answer

The `top` command is designed to find the most frequent values of a field. By default, it returns the top 10 results, but you can specify `limit=5` to get the top 5 most common values of the 'action' field in web access logs.

Exam trap

Splunk often tests the distinction between `top` and `sort`; candidates mistakenly think `sort` can rank by frequency, but `sort` only reorders existing results without performing any count or aggregation.

How to eliminate wrong answers

Option A is wrong because `rare` finds the least common values, not the most common. Option B is wrong because `fields` is used to keep or remove fields from search results, not to count or rank field values. Option C is wrong because `sort` orders results by a field value but does not aggregate or count occurrences to identify the most common values.

Practice this question →

10

MCQeasy

An analyst wants to find all events where the field 'status' is not 200. Which search is correct?

A.status != 200

B.NOT status=200

C.status!=200

D.status -neq 200

AnswerC

Correct syntax for not equal.

Why this answer

Option C is correct because in SPL (Search Processing Language), the `!=` operator is used directly after the field name without a space to denote 'not equal to'. The syntax `status!=200` correctly filters events where the status field does not equal 200, and it is the standard way to express inequality in field-value comparisons.

Exam trap

The trap here is that candidates often confuse the syntax of inequality operators in SPL with other query languages or assume that spaces around operators are allowed, leading them to choose Option A or D, or they may overthink and select Option B as a valid alternative despite the question asking for the correct search among the given options.

How to eliminate wrong answers

Option A is wrong because `status != 200` uses a space between the field name and the `!=` operator, which SPL interprets as a comparison between the literal string 'status' and the value '200', not as a field-value inequality. Option B is wrong because `NOT status=200` is logically correct but uses the `NOT` keyword with a space before the field, which is valid syntax for excluding events where status equals 200; however, the question asks for the correct search among the given options, and `NOT status=200` is not the standard or most direct way to express inequality in SPL, and it can be ambiguous in complex searches. Option D is wrong because `-neq` is not a valid SPL operator; the correct operator for 'not equal to' is `!=`.

Practice this question →

11

Multi-Selecteasy

Which TWO of the following commands will return exactly one result row when there is at least one event?

Select 2 answers

A.sort - count

B.chart count by user

C.eventstats count by user

D.top limit=1 user

E.stats count

AnswersD, E

Returns the top user, one row.

Why this answer

Option D is correct because `top limit=1 user` returns the single most frequent value of the `user` field, producing exactly one result row (the top user) when at least one event exists. Option E is correct because `stats count` without a `by` clause aggregates all events into a single row showing the total event count, always returning exactly one row as long as there is at least one event.

Exam trap

Splunk often tests the distinction between transforming commands that reduce results to one row per group (like `stats count by user`) and those that produce a single global row (like `stats count`), leading candidates to mistakenly choose `chart count by user` or `eventstats count by user` when the question explicitly requires exactly one result row.

Practice this question →

12

Multi-Selectmedium

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Select 4 answers

.The `top` command returns the most common values of a field based on count.

.The `rare` command returns the least common values of a field based on count.

.Both `top` and `rare` can include a `by` clause to group results by another field.

.The `top` command automatically removes events with null or empty values for the specified field from the count.

.The `rare` command can only be used on fields that have been extracted using regex.

.Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Why this answer

The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. By default, `top` and `rare` exclude events where the specified field is null or empty from the count, which is a key behavior to understand for accurate analysis.

Exam trap

Splunk often tests the misconception that `top` and `rare` require explicit `limit` arguments to function, when in fact they have default limits of 10, and the trap also includes the false idea that `rare` is restricted to regex-extracted fields, which is not true.

Practice this question →

13

MCQhard

A search `index=main | top limit=10 user | fields - percent` is running slowly on a large dataset. Which change would likely improve performance the most?

A.Add a rex command before top

B.Use stats count by user instead of top

C.Remove the fields command

D.Add a time range early in the search

AnswerB

stats count is more efficient than top for counting.

Why this answer

The `top` command is a transforming command that internally performs a `sort` and `limit` after counting events. On large datasets, `top` can be slower than `stats count by user` because `top` includes additional overhead for calculating percentages and sorting all results before limiting. Using `stats count by user` followed by `sort 10 -count` achieves the same result with less processing overhead, as `stats` is more efficient for simple aggregation.

Exam trap

Splunk often tests the misconception that `top` is the only or best way to get top values, when in reality `stats count by user` with `sort` and `head` is more performant for large datasets, and candidates may overlook that `top` includes hidden overhead for percentage calculation.

How to eliminate wrong answers

Option A is wrong because adding a `rex` command before `top` would extract new fields via regex, increasing processing time and potentially slowing the search further, not improving performance. Option C is wrong because removing the `fields` command would keep the `percent` field in the results, but the `fields` command only affects output, not the underlying data processing; the performance bottleneck is the `top` command itself, not the field removal. Option D is wrong because adding a time range early in the search is already a best practice for limiting data volume, but the question states the search is running slowly on a large dataset, implying a time range is likely already applied; the core issue is the inefficiency of `top` compared to `stats`.

Practice this question →

14

MCQhard

Refer to the exhibit. The search runs but the user field is not modified. What is the most likely cause?

A.The eval command does not modify existing fields.

B.The function name is misspelled (should be lower).

C.The search must be run over a time range.

D.The field must be referenced as 'user'.

AnswerB

The correct function is 'lower', not 'lowercase'.

Why this answer

The `lower()` function in Splunk's `eval` command is case-sensitive and must be written in lowercase. The exhibit shows `Lower(user)` with a capital 'L', which Splunk does not recognize as a valid function, so the `eval` command fails silently and the `user` field remains unmodified.

Exam trap

Splunk often tests the case sensitivity of Splunk functions, knowing that candidates may assume functions are case-insensitive like many programming languages, leading them to overlook the capital 'L' in `Lower()`.

How to eliminate wrong answers

Option A is wrong because the `eval` command can modify existing fields by overwriting them with a new value; the issue here is not a limitation of `eval` but a syntax error. Option C is wrong because the search runs without a time range requirement for modifying a field with `eval`; time ranges affect data retrieval, not the execution of `eval` on existing results. Option D is wrong because referencing the field as `user` is correct syntax; the problem is the function name, not the field reference.

Practice this question →

15

Drag & Dropmedium

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Practice this question →

16

Matchingmedium

Match each Splunk license type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Full-featured license for production use

Limited to 500 MB/day, no authentication or distributed search

Free license for forwarders only

Full features for a limited time period

Why these pairings

License types determine available features.

Practice this question →

17

MCQmedium

A user runs a search that returns thousands of results. They need to see only the first 100 events after sorting by time descending. Which command should they use?

A.reverse

B.tail 100

C.head 100

D.sort - _time | head 100

AnswerD

Sorts by time descending, then takes first 100, which are the 100 most recent.

Why this answer

The user needs the first 100 events after sorting by time descending. The `sort - _time` command sorts events in descending order by timestamp, and piping the result to `head 100` returns the first 100 events from that sorted list, which are the most recent 100 events. This is the correct approach because `head` returns events from the top of the result set, and sorting ensures the top events are the newest.

Exam trap

Splunk often tests the distinction between `head` and `tail` in combination with sorting, where candidates mistakenly think `tail` returns the most recent events because it 'ends' the list, but in descending time order, the most recent events are at the top, so `head` is correct.

How to eliminate wrong answers

Option A is wrong because `reverse` simply reverses the order of the current result set; it does not sort by time and would not guarantee the most recent 100 events unless the events were already sorted in ascending time order. Option B is wrong because `tail 100` returns the last 100 events from the result set; if the events are not sorted, this would not give the most recent 100 events, and even if sorted descending, `tail` would return the oldest events. Option C is wrong because `head 100` alone returns the first 100 events from the current result set, but without sorting by time descending, those events are not guaranteed to be the most recent; they are just the first 100 events in whatever order they appear.

Practice this question →

18

Multi-Selecteasy

Which two of the following search commands are transforming commands? (Choose two.)

Select 2 answers

A.search

B.eval

C.fields

D.chart

E.stats

AnswersD, E

chart is a transforming command.

Why this answer

Transforming commands return a statistics table. chart and stats are transforming; eval, search, and fields are non-transforming.

Practice this question →

19

MCQeasy

A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?

A.index=web status=404 | top src_ip

B.index=web status=404 | sort src_ip

C.index=web | top src_ip

D.index=web status=404 | rare src_ip

AnswerA

top returns the most frequent values of src_ip.

Why this answer

Option A is correct because it first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.

Exam trap

The trap here is that candidates may confuse `top` with `sort` or `rare`, or forget to filter by `status=404`, leading them to choose options that either sort alphabetically, show least common values, or ignore the error condition entirely.

How to eliminate wrong answers

Option B is wrong because `sort src_ip` sorts the results alphabetically by source IP, not by frequency, so it does not show the top 10 IPs generating errors. Option C is wrong because it omits the `status=404` filter, returning top source IPs across all status codes, not just 404 errors. Option D is wrong because `rare` returns the least common values, not the most common (top) source IPs.

Practice this question →

20

MCQhard

An analyst wants to find events where the field 'user' is not present. Which search correctly identifies such events?

A.user=null

B.-user

C.NOT isnotnull(user)

D.user=""

AnswerC

isnotnull returns true if the field exists; NOT isnotnull finds events without the field.

Why this answer

Option C is correct because the `NOT isnotnull(user)` search uses the `isnotnull()` function to check if the `user` field exists and is not null, then negates it with `NOT` to return only events where the `user` field is absent or null. In Splunk, fields that are not present in an event are considered null, so this combination accurately identifies events lacking the field.

Exam trap

Splunk often tests the misconception that `user=""` or `user=null` can detect missing fields, when in fact they only match fields with empty or literal null values, not absent fields.

How to eliminate wrong answers

Option A is wrong because `user=null` does not match events where the `user` field is missing; it searches for events where the `user` field exists and has the literal string value 'null', which is not the same as a missing field. Option B is wrong because `-user` is an invalid syntax in Splunk; the negation operator `-` is used before a search term (e.g., `-error`) to exclude events containing that term, but it cannot be applied to a field name alone to test for field absence. Option D is wrong because `user=""` matches events where the `user` field exists but has an empty string value, not events where the field is entirely absent.

Practice this question →

21

MCQmedium

A user needs to create a report showing the average response time per endpoint for the last hour. Which command would produce this result?

A.chart avg(response_time) over endpoint

B.eval avg(response_time)

C.top endpoint

D.stats avg(response_time) by endpoint

AnswerD

stats computes the average of response_time for each endpoint.

Why this answer

Option D is correct because the `stats` command with `avg(response_time) by endpoint` calculates the average response time for each unique endpoint, which directly meets the requirement of showing average response time per endpoint for the last hour. The `stats` command is the standard way to compute aggregate statistics like average over grouped fields in Splunk.

Exam trap

Splunk often tests the distinction between `stats` and `chart` commands, where candidates mistakenly use `chart` with `over` instead of `by`, or confuse `eval` with aggregation functions, leading them to choose incorrect options like A or B.

How to eliminate wrong answers

Option A is wrong because `chart avg(response_time) over endpoint` uses incorrect syntax; the `chart` command requires `by` instead of `over` to group results, and this would cause a parsing error. Option B is wrong because `eval avg(response_time)` does not compute an aggregate average; `eval` is used for per-event calculations and field assignments, not for statistical aggregation across events. Option C is wrong because `top endpoint` only shows the most frequent endpoints based on count, not the average response time per endpoint.

Practice this question →

22

MCQmedium

An analyst runs the search `index=web | stats count by status | sort - count` and wants to show only status codes with count greater than 100. Which command should be added before the sort?

A.eval count>100

B.search count>100

C.where count>100

D.filter count>100

AnswerC

where filters the stats results.

Why this answer

Option C is correct because the `where` command is used to filter results based on a condition after statistical aggregation. In this search, `stats count by status` creates a field called `count`, and `where count>100` filters the results to show only status codes with a count greater than 100. The `where` command operates on the results of the `stats` command, making it the appropriate choice for post-aggregation filtering.

Exam trap

Splunk often tests the distinction between `search` (pre-aggregation filtering) and `where` (post-aggregation filtering), and candidates mistakenly use `search` to filter computed fields like `count` from `stats`, not realizing that `search` operates on raw events before transformation.

How to eliminate wrong answers

Option A is wrong because `eval count>100` would create a new field named `count` with a boolean value (true/false) rather than filtering the results, and it would overwrite the existing `count` field from the `stats` command. Option B is wrong because `search count>100` would attempt to filter events before the `stats` command, but `count` is not a field in the raw events; it is a computed field created by `stats`, so the search would return no results or an error. Option D is wrong because `filter` is not a valid Splunk command; Splunk uses `where` for conditional filtering, not `filter`.

Practice this question →

23

Drag & Dropmedium

Drag and drop the steps to create a Splunk dashboard with a single panel into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Dashboards are built by saving search results as panels and organizing them.

Practice this question →

24

MCQhard

Refer to the exhibit. The search returns zero results. What is a likely cause?

A.The 'spath' command should use 'output=response.status' to create the field

B.The 'raw_data' field may not contain valid JSON

C.The search should be 'sourcetype=json_logs' first

D.The 'stats' command cannot use 'response.status' because it's not a field

AnswerB

If raw_data is not JSON, spath produces no fields.

Why this answer

The 'spath' command extracts fields from JSON, but if 'raw_data' is not a valid JSON string, extraction fails. Also, 'search' after 'spath' should work, but if 'response.status' is not extracted, no results. The most common issue is that the field 'raw_data' might not exist or the JSON path is incorrect.

Practice this question →

25

MCQmedium

A search returns 1,000 events. The analyst wants to see the first 10 events sorted by the '_time' field in descending order. Which search is correct?

A.| sort by _time | head 10

B.| sort -_time | head 10

C.| sort +_time | head 10

D.| sort _time | head 10

AnswerB

Sorts descending, gives newest 10.

Why this answer

Option B is correct because the `sort` command with a hyphen prefix (`-`) sorts in descending order. By default, `sort` sorts in ascending order, so `sort -_time` sorts events by the `_time` field from newest to oldest, and `head 10` returns the first 10 events, which are the 10 most recent.

Exam trap

Splunk often tests the specific syntax of the `sort` command, where candidates mistakenly think `sort by` is valid (like SQL) or that a plus sign (`+`) indicates descending order, when in fact only a hyphen (`-`) works for descending and no prefix means ascending.

How to eliminate wrong answers

Option A is wrong because `sort by _time` is invalid syntax; the correct syntax is `sort _time` (without 'by'), and it defaults to ascending order, which would return the oldest events first. Option C is wrong because `sort +_time` uses a plus sign, which is not a valid prefix in Splunk; the correct prefix for descending order is a hyphen (`-`), and the plus sign is ignored or causes an error. Option D is wrong because `sort _time` sorts in ascending order by default, returning the oldest events first instead of the newest.

Practice this question →

26

Multi-Selectmedium

Which TWO commands can be used to filter events based on a field value? (Choose two.)

Select 2 answers

A.eval

B.search

C.stats

D.where

E.table

AnswersB, D

The search command can filter events.

Why this answer

The `search` command is the primary way to filter events in Splunk, and it can be used to filter based on field values using syntax like `field=value`. The `where` command evaluates Boolean expressions and is specifically designed to filter results based on field values, supporting comparisons, wildcards, and functions. Both commands directly filter events by evaluating field values.

Exam trap

Splunk often tests the distinction between commands that transform data (like `eval` and `stats`) versus commands that filter events (like `search` and `where`), and the trap here is that candidates mistakenly think `eval` filters because it can conditionally assign values, but it never removes events from the result set.

Practice this question →

27

MCQmedium

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

A.fields

B.convert

C.eval

D.rex

AnswerC

eval can create a new field with conditional logic.

Why this answer

Option C is correct because the `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Exam trap

The trap here is that candidates often confuse `rex` with `eval` because both can manipulate fields, but `rex` only extracts existing patterns into new fields, whereas `eval` can create fields based on conditional logic or calculations.

How to eliminate wrong answers

Option A is wrong because the `fields` command only includes or excludes existing fields from search results; it cannot create new fields or evaluate data. Option B is wrong because the `convert` command changes the data type or format of an existing field (e.g., string to number), but it cannot create a new field or perform conditional categorization. Option D is wrong because the `rex` command extracts fields using regular expressions but does not create a new field based on a conditional test; it would require a separate `eval` to assign the category.

Practice this question →

28

MCQeasy

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

A.Use the `transaction` command to group related events before counting.

B.Replace `stats count by host` with `top limit=5 host` to limit output.

C.Add a `summarize` command before `stats` to pre-aggregate data.

D.Rewrite the search as `index=main error | stats count by host`.

AnswerD

Placing `error` directly after the index keyword filters at index time, reducing data volume.

Why this answer

Option D is correct because the original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Exam trap

Splunk often tests the misconception that piping to `search` is equivalent to including the term in the initial search string, but in Splunk, the former forces a full index scan while the latter leverages index-level optimizations.

How to eliminate wrong answers

Option A is wrong because the `transaction` command is designed to group related events into transactions based on common fields or time windows, which adds significant processing overhead and is not a performance optimization—it would make the search slower, not faster. Option B is wrong because while `top limit=5 host` limits the output to the top 5 hosts, it does not reduce the amount of data scanned from the index; the search still retrieves all events over the week, and the `top` command only reduces the final result set, not the initial data volume. Option C is wrong because Splunk does not have a `summarize` command; this is a fictitious command that likely confuses candidates with concepts from other tools like SQL or Azure Data Explorer, and it would not execute in Splunk.

Practice this question →

29

MCQhard

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is: index=web sourcetype=access_combined | stats count by clientip, sessionid, productid | sort - count The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

A.Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

B.Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

C.Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

D.Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.

AnswerD

Filters early, uses efficient stats, then filters and sorts on reduced data.

Why this answer

Option D is correct because it filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Exam trap

The trap here is that candidates often choose Option C because they think filtering after `stats` is acceptable, but they miss that early filtering in the base search is critical for performance, and they also overlook the requirement to exclude sessions with 5 or fewer product views.

How to eliminate wrong answers

Option A is wrong because `eventstats` computes statistics without reducing the number of events, so it still processes all 10 billion events and does not filter out internal IPs, leading to high resource usage. Option B is wrong because the `transaction` command is resource-intensive and designed for grouping events based on time or session boundaries, but here the session is already identified by `clientip` and `sessionid` fields; using `transaction` would be slower and less efficient than `stats`. Option C is wrong because adding `where` after `stats` to filter internal IPs means the `stats` command still processes all events including internal IPs, wasting resources; also, it does not filter for sessions with more than 5 product views.

Practice this question →

30

MCQhard

Refer to the exhibit. An analyst runs this search and expects to see a table of status codes with their counts, filtered to those with count greater than 100. The search returns zero results even though there are many events. What is the most likely reason?

A.The sourcetype should be 'access_combined' instead.

B.The stats command should use 'values(status_code)' instead.

C.The rex command is incorrectly extracting the status_code field.

D.The where command should be placed before the stats command.

AnswerC

If the pattern doesn't match, status_code is not extracted, leading to zero results when grouped.

Why this answer

The rex command is incorrectly extracting the status_code field because the regular expression pattern does not match the actual format of the status codes in the events. If the pattern is wrong or the field is not captured correctly, the stats command will not find any values for status_code, resulting in zero results even though events exist. The where command then filters on a field that doesn't exist or is null, returning no rows.

Exam trap

Splunk often tests the misconception that a stats or where command is misordered, when the actual issue is a failed field extraction due to an incorrect regex pattern in rex.

How to eliminate wrong answers

Option A is wrong because changing the sourcetype to 'access_combined' would not fix the extraction issue; the rex command's regex pattern is the root cause, not the sourcetype. Option B is wrong because 'values(status_code)' would return a multivalue list of status codes per group, not counts, and would not solve the extraction failure. Option D is wrong because the where command must come after stats to filter on the computed count field; placing it before stats would filter on raw events, not aggregated results, and would not address the missing status_code field.

Practice this question →

31

MCQeasy

A security analyst needs to find the number of failed login attempts per user. Which command group should be used?

A.top failed_login user

B.stats count by user

C.chart count by user

D.sort - count

AnswerB

stats count by user correctly groups events by user and returns a count for each user.

Why this answer

The `stats count by user` command is correct because it groups events by the `user` field and calculates the count of events (failed login attempts) for each user, producing a table with two columns: `user` and `count`. This directly answers the requirement to find the number of failed login attempts per user using a transforming command that aggregates data.

Exam trap

Splunk often tests the distinction between `stats`, `chart`, and `top` commands, and the trap here is that candidates may confuse `top` (which shows top values) with `stats count by user` (which provides a complete per-user count), or they may incorrectly use `chart` with improper syntax, thinking it is interchangeable with `stats` for simple aggregations.

How to eliminate wrong answers

Option A is wrong because `top` is a command that displays the most common values of a field, but it does not produce a per-user count of failed login attempts; it only shows the top values by frequency, not a breakdown for each user. Option C is wrong because `chart count by user` is syntactically incorrect; the correct syntax for the `chart` command is `chart count by user` (without the word 'by' after count), but even if corrected, `chart` is typically used for time-based or series data and is less straightforward for a simple count per user compared to `stats`. Option D is wrong because `sort - count` is not a complete command; it only sorts results by the `count` field in descending order but does not perform any aggregation or grouping to produce the counts per user.

Practice this question →

32

Multi-Selecthard

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Select 3 answers

A.Use the `eval` command to set a field and then `where` before the transforming command.

B.Use the `fields` command to remove unwanted fields.

C.Use the `where` command after the transforming command.

D.Use a search term in the initial search string.

E.Use the `search` command before the transforming command.

AnswersA, D, E

eval and where together filter before.

Why this answer

Option A is correct because the `eval` command can create or modify fields, and the `where` command can then filter events based on those computed fields. Placing `where` before a transforming command (like `stats` or `timechart`) filters events before aggregation, which is essential for accurate results. This is a common pattern for conditional filtering in Splunk.

Exam trap

Splunk often tests the distinction between filtering events (removing entire events) versus filtering fields (removing parts of events), and the trap here is that candidates may confuse the `fields` command (which only removes fields) with event filtering, or incorrectly think that filtering after a transforming command is equivalent to filtering before.

Practice this question →

33

MCQmedium

How many events will be output by this search?

A.15

B.3

C.5

D.1

AnswerB

stats count by user produces one event per distinct user.

Why this answer

The search uses the `dedup` command with a field name, which removes duplicate events based on that field. With 15 total events but only 3 unique values in the specified field, `dedup` keeps the first occurrence of each unique value, outputting exactly 3 events.

Exam trap

Splunk often tests the misconception that `dedup` counts all events or that it operates on the total event count rather than the number of unique field values, leading candidates to pick the total event count (15) instead of the correct unique count (3).

How to eliminate wrong answers

Option A is wrong because 15 is the total number of events before deduplication, not the output after dedup removes duplicates. Option C is wrong because 5 would be the result if dedup were applied on a different field with 5 unique values, but the actual unique count is 3. Option D is wrong because 1 would only be correct if all events had the same value in the dedup field, which is not the case here.

Practice this question →

34

MCQeasy

Refer to the exhibit. A user runs this search. The results show only Error and Warning, but no Info. What is the most likely reason?

A.The eval command has a syntax error.

B.The stats command omitted the info severity because it has zero count.

C.The sort command filters out Info.

D.The case statement does not evaluate to a string for Info.

AnswerB

Stats by default only shows values present in data; zero-count categories are omitted.

Why this answer

The stats command with count() only returns results for field values that have at least one event. Since no events had severity=Info after the eval, Info has a count of zero and is omitted from the output. This is the expected behavior of stats — it does not include zero-count buckets unless explicitly requested with the `usenull=f` or similar options.

Exam trap

Splunk often tests the misconception that stats returns all possible values of a field, when in fact it only returns values that appear in the events, omitting zero-count buckets.

How to eliminate wrong answers

Option A is wrong because the eval command with case() is syntactically correct — it assigns 'Error', 'Warning', and 'Info' based on the conditions, and there is no syntax error. Option C is wrong because the sort command only reorders results; it does not filter out any rows, so it cannot remove Info from the output. Option D is wrong because the case statement does evaluate to a string for Info — when severity is not 'error' or 'warn', the case() returns 'Info' as a string, so the eval works correctly.

Practice this question →

35

MCQmedium

Refer to the exhibit. A user gets an error: 'Error in 'where' command: The field 'count' is not a numeric type.' What is the issue?

A.The syntax should be 'where count > "100"'

B.The 'count' field is a string type

C.The 'timechart' command creates multiple 'count' fields for each host, so 'count' is not a single numeric field

D.The 'where' command should be placed before 'timechart'

AnswerC

Correct: timechart by host creates separate count series for each host, and where can't handle that.

Why this answer

The 'timechart' command creates a 'count' field, but the 'where' command expects a numeric value. However, 'count' is numeric; the error often occurs if the field is renamed or if there is a typo. In this case, 'count' should work, but if the data has multiple hosts, 'timechart' might produce multiple series with names like 'count: host1'.

The 'where' command cannot operate on multivalued fields or non-numeric data.

Practice this question →

36

MCQmedium

Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?

A.Use the `fillnull` command to add missing values.

B.Use the `search` command to filter threat_score>90.

C.Add a third condition: if(threat_score > 60 AND threat_score <=90, "medium", ...) inside the existing eval.

D.Change the eval to a case statement with multiple conditions.

AnswerD

case can handle multiple conditions cleanly.

Why this answer

Using a case statement allows multiple conditions clearly. A nested if would work but is less readable. fillnull adds missing values, but the issue is categorization not missing data. search would filter, not categorize.

Practice this question →

37

Multi-Selectmedium

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Select 3 answers

.It can be used to create new fields based on existing field values and functions

.It can be used to rename fields in the search results

.It supports conditional logic using the `if` function

.It modifies the original raw data stored in the index

.It can combine string values using the `+` operator

.It can be used to calculate mathematical expressions like `eval x = y + 1`

Why this answer

The `eval` command in Splunk creates new fields by evaluating expressions based on existing field values and functions, making it a powerful tool for data transformation. It supports conditional logic via the `if` function, allowing dynamic field creation based on conditions. Additionally, `eval` can concatenate string values using the `+` operator, which is a common way to combine text fields.

Exam trap

Splunk often tests the distinction between commands that modify search results in memory versus those that alter indexed data, leading candidates to incorrectly believe `eval` changes raw data.

Practice this question →

38

MCQhard

A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?

A.| rename duration as duration_sec

B.| convert duration_sec = duration/1000

C.| eval duration_sec = duration / 1000

D.| fields duration_sec = duration/1000

AnswerC

eval creates new field with arithmetic.

Why this answer

Option C is correct because the `eval` command in Splunk is specifically designed to create new fields by evaluating expressions, including arithmetic operations. Using `| eval duration_sec = duration / 1000` creates a new field `duration_sec` that contains the value of `duration` divided by 1000, converting milliseconds to seconds.

Exam trap

Splunk often tests the distinction between `eval` (for calculations and new field creation) and `convert` (for data type conversion), leading candidates to mistakenly choose `convert` for arithmetic operations.

How to eliminate wrong answers

Option A is wrong because `rename` only changes the name of an existing field, it does not perform any arithmetic or create a new field with a calculated value. Option B is wrong because `convert` is used for data type conversions (e.g., string to number, epoch time formatting), not for arithmetic operations; it does not support the syntax `duration_sec = duration/1000`. Option D is wrong because `fields` is used to keep or remove fields from search results, not to create new fields or perform calculations.

Practice this question →

39

MCQmedium

A network operations team uses Splunk to monitor netflow data stored in index='net' and sourcetype='netflow'. The events contain fields: src_ip, dest_ip, bytes, and protocols. The team needs to identify the top 5 source IPs by total bytes transferred (based on the bytes field). For each of those top source IPs, they also want to list the destination IPs and the number of times they communicated. The data volume is large, so performance is important. Which SPL approach returns the desired results efficiently?

A.index=net sourcetype=netflow | eventstats sum(bytes) as total_bytes by src_ip | stats count by src_ip, dest_ip

B.index=net sourcetype=netflow | stats sum(bytes) as total_bytes, count by src_ip, dest_ip | sort -total_bytes | head 5

C.index=net sourcetype=netflow [ search index=net sourcetype=netflow | stats sum(bytes) as total_bytes by src_ip | sort -total_bytes | head 5 | fields src_ip ] | stats count by src_ip, dest_ip

D.index=net sourcetype=netflow | top limit=5 src_ip by bytes | fields src_ip | search index=net sourcetype=netflow | stats count by src_ip, dest_ip

AnswerC

The subsearch calculates top IPs by total bytes; the outer search then counts destinations for those IPs.

Why this answer

Option C is correct because it uses a subsearch to first identify the top 5 source IPs by total bytes, then passes those IPs to the outer search to efficiently compute the count of communications per destination IP. This approach minimizes the data processed in the outer search by filtering only the relevant source IPs, which is critical for performance on large netflow datasets.

Exam trap

The trap here is that candidates often choose option B, mistakenly thinking that sorting by total_bytes after a stats command that groups by both src_ip and dest_ip will correctly identify the top source IPs, but it actually ranks pairs, not individual source IPs.

How to eliminate wrong answers

Option A is wrong because eventstats adds the total_bytes field to every event but does not filter to the top 5 source IPs, and the subsequent stats count by src_ip, dest_ip ignores the total_bytes field entirely, failing to identify the top source IPs. Option B is wrong because it groups by src_ip and dest_ip before sorting, so the sort and head 5 operate on the combined src_ip-dest_ip pairs rather than on the total bytes per source IP, which does not yield the top 5 source IPs by total bytes. Option D is wrong because the top command with limit=5 src_ip by bytes is syntactically invalid (top does not support a by clause for bytes), and the subsequent search index=net sourcetype=netflow is a separate search that does not use the results from the top command, leading to incorrect or no filtering.

Practice this question →

40

Multi-Selectmedium

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Select 3 answers

.Counting the number of events by a specific field using `count(field)`

.Calculating the average value of a numeric field using `avg(field)`

.Removing duplicate events based on a field using `dedup` inside the stats command

.Finding the earliest timestamp of events grouped by a field using `earliest(field)`

.Sorting results in descending order directly within the stats command

.Joining two separate searches into a single stats output

Why this answer

The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Exam trap

The trap here is that candidates confuse `dedup` as a stats function or think sorting can be embedded in `stats`, when in fact `stats` only supports statistical and time-based aggregations, not deduplication or ordering.

Practice this question →

41

MCQhard

What is the purpose of this search?

A.To list the first 5 status codes in alphabetical order.

B.To filter events with status codes that appear less than 5 times.

C.To display the 5 most common HTTP status codes in the web index.

D.To show the 5 most recent events sorted by status code.

AnswerC

Counts by status, sorts descending, top 5.

Why this answer

The search uses `top` to find the most common values in the `status` field, limited to 5 results. The `top` command counts occurrences and sorts by count descending, so it returns the 5 most frequent HTTP status codes from the web index. Option C correctly describes this behavior.

Exam trap

The trap here is that candidates confuse `top` with `head` or `sort` commands, assuming it returns the first few events or sorts alphabetically, rather than understanding it performs frequency-based aggregation.

How to eliminate wrong answers

Option A is wrong because `top` does not sort alphabetically; it sorts by frequency count descending. Option B is wrong because `top` shows the most common values, not those appearing fewer than 5 times; that would require a `where count < 5` after a `stats count` command. Option D is wrong because `top` does not sort by time or show recent events; it aggregates counts over the entire search timeframe and orders by frequency.

Practice this question →

42

Multi-Selectmedium

Which TWO of the following commands can be used to create a new field from existing fields?

Select 2 answers

A.rex

B.eval

C.table

D.convert

E.fields

AnswersA, B

Can extract and create new fields via regular expressions.

Why this answer

The `rex` command is correct because it uses regular expressions to extract new fields from existing field values. For example, `rex field=message "(?<newField>pattern)"` creates a new field named `newField` by matching a portion of the `message` field. This allows you to derive structured data from unstructured or semi-structured fields.

Exam trap

Splunk often tests the distinction between commands that *extract* or *compute* new fields (`rex`, `eval`) versus commands that only *filter* or *transform* existing fields (`table`, `fields`, `convert`), leading candidates to mistakenly select `convert` or `fields` because they assume any command that modifies output can create fields.

Practice this question →

43

MCQeasy

A security analyst needs to identify the top 5 source IP addresses generating the most web traffic. Which command should be used?

A.| stats count by src_ip | sort - count

B.| top limit=5 src_ip

C.| sort - count | head 5

D.| table src_ip | head 5

AnswerB

The top command with limit=5 returns the top 5 values.

Why this answer

Option B is correct because the `top` command is specifically designed to return the most common values of a field, and `limit=5` restricts the output to the top 5 source IP addresses by count. This command automatically sorts the results in descending order, making it the most efficient and direct way to identify the top 5 source IPs generating web traffic.

Exam trap

The trap here is that candidates often confuse `top` with `stats count` followed by `sort` and `head`, not realizing that `top` already includes sorting and limiting, and that `sort - count` alone without a preceding stats command will fail.

How to eliminate wrong answers

Option A is wrong because `| stats count by src_ip | sort - count` does produce a count per source IP and sorts it, but it does not limit the output to the top 5; it would return all source IPs sorted, which is not what the question asks. Option C is wrong because `| sort - count | head 5` is missing the initial `stats` or `top` command to generate the count; `sort - count` would fail because there is no `count` field to sort on unless preceded by a stats command. Option D is wrong because `| table src_ip | head 5` simply displays the first 5 source IPs from the raw events, not the top 5 by traffic volume; it does not perform any aggregation or counting.

Practice this question →

44

Multi-Selectmedium

Which TWO commands can be used to create a chart that shows the count of events over time?

Select 2 answers

A.top

B.eval

C.timechart

D.stats

E.chart

AnswersC, E

timechart is specifically designed for time-series charting.

Why this answer

The `timechart` command is specifically designed to create a time-based chart where the x-axis represents time and the y-axis represents a statistical aggregation, such as count. By default, `timechart count` splits events into time buckets and counts the number of events in each bucket, making it ideal for showing event counts over time. The `chart` command can also produce a time-based chart when used with the `_time` field as the x-axis, but it requires explicit specification of the time field and does not automatically bucket by time like `timechart` does.

Exam trap

Splunk often tests the distinction between `chart` and `timechart`, where candidates mistakenly think `chart` alone cannot produce a time-based chart, but `chart` can when explicitly using `_time` as the x-axis, though `timechart` is the more appropriate and automatic choice for time-based counts.

Practice this question →

45

MCQhard

An analyst runs a search that returns 10,000 events. They want to see the distribution of the 'status' field across the 'method' field. Which command should be used?

A.top method by status

B.stats count by status, method

C.pivot status method

D.chart count over status by method

AnswerB

Produces a table of counts for each pair.

Why this answer

Option B is correct because the `stats count by status, method` command groups events by both the 'status' and 'method' fields, then counts the number of events in each combination, producing a table that shows the distribution of status values across method values. This directly answers the requirement to see how the 'status' field is distributed across the 'method' field.

Exam trap

Splunk often tests the subtle difference between `stats` and `chart` commands, and the trap here is that candidates may confuse the valid syntax of `chart` (which requires `by` or `over` but not both in the same clause) with the simpler `stats` syntax, leading them to choose option D despite its invalid syntax.

How to eliminate wrong answers

Option A is wrong because `top method by status` returns the most common values of 'method' for each value of 'status', but it does not show the full distribution of all status values across all method values; it only shows the top method per status, which is a different analytical goal. Option C is wrong because `pivot` is a command used in the Splunk Pivot interface for building data models, not a search command that can be run directly in the search bar; it requires a data model and is not a valid transforming command for this ad-hoc search. Option D is wrong because `chart count over status by method` has incorrect syntax; the correct syntax for the `chart` command is `chart count by status, method` or `chart count over method by status`, but `over status by method` is invalid and would cause a parsing error.

Practice this question →

46

MCQeasy

A security analyst needs to find the number of failed login attempts per user in the last hour. The events contain a field 'result' with value 'failure'. Which search is correct?

A.index=security source=login result=failure | top user

B.index=security source=login result=failure | timechart count by user

C.index=security source=login result=failure | chart count by user

D.index=security source=login result=failure | stats count by user

AnswerD

Correctly groups by user and counts events.

Why this answer

The `stats count by user` command correctly groups events by the `user` field and counts the number of events per user, which directly answers the question of failed login attempts per user. The search first filters events with `index=security`, `source=login`, and `result=failure`, then uses `stats` to aggregate the count per user. This is the most efficient and precise way to produce a table of user-to-failure-count mappings.

Exam trap

Splunk often tests the distinction between `stats`, `chart`, and `timechart` by presenting a scenario where a simple aggregation is needed, and candidates mistakenly choose `chart` or `timechart` because they think any visualization command is required, when in fact `stats` is the correct non-visual aggregation command.

How to eliminate wrong answers

Option A is wrong because `top user` returns the most frequent users sorted by count, but it does not guarantee a count for every user and is designed for ranking, not for a simple per-user count. Option B is wrong because `timechart count by user` creates a time-based chart, which is unnecessary and adds complexity when the requirement is only for the last hour (the time filter is already applied in the search). Option C is wrong because `chart count by user` produces a statistical chart with default splitting, but it is less straightforward than `stats` and may introduce unwanted formatting or limit the output; `stats` is the canonical command for simple group-by counts.

Practice this question →

47

MCQeasy

A security analyst uses Splunk to ingest firewall logs from multiple locations. The index is 'firewall' and the sourcetype is 'fw_log'. Each event contains fields: src_ip, dest_ip, action, bytes, and time. The analyst needs to find how many unique source IPs have been logged in the last hour to report potential scanning activity. The search should be efficient and accurate, returning only the total count of distinct source IPs. Which search accomplishes this?

A.index=firewall sourcetype=fw_log earliest=-1h | dedup src_ip | stats count as UniqueIPs

B.index=firewall sourcetype=fw_log earliest=-1h | top src_ip | stats count as UniqueIPs

C.index=firewall sourcetype=fw_log | timechart dc(src_ip) span=1h

D.index=firewall sourcetype=fw_log earliest=-1h | stats dc(src_ip) as UniqueIPs

AnswerD

This correctly filters the last hour and computes the distinct count of src_ip.

Why this answer

Option D is correct because it uses the `stats dc(src_ip)` command, which directly calculates the distinct count of source IPs in a single, efficient pass over the data. The `earliest=-1h` time filter restricts the search to the last hour, and the `as UniqueIPs` alias provides the exact output requested: a single number representing the total count of unique source IPs.

Exam trap

The trap here is that candidates often confuse `dedup` with `distinct count` or think `top` can be adapted to count unique values, but only `stats dc()` directly and efficiently returns the exact count of distinct field values without additional post-processing.

How to eliminate wrong answers

Option A is wrong because `dedup src_ip` removes duplicate events based on src_ip but then `stats count` counts the remaining events, not the distinct IPs; this is inefficient and can be inaccurate if multiple events share the same src_ip but have different other fields. Option B is wrong because `top src_ip` returns a table of the most common src_ip values with their counts, not a single count of unique IPs; it also requires additional processing to extract the total distinct count. Option C is wrong because `timechart dc(src_ip) span=1h` produces a time-based chart with a count per hour, not a single total count for the last hour; it also lacks the `earliest=-1h` time filter, so it would include all historical data.

Practice this question →

48

MCQhard

A search uses `eval memory_MB = memory_bytes / 1024 / 1024`. The field memory_bytes contains values like '2,048,000'. The eval results memory_MB is often null. What is the most likely cause?

A.The eval command has a syntax error.

B.The field is actually a string with commas.

C.The field needs to be converted first.

D.The division operator does not work on string fields.

AnswerB

Commas cause the string to be non-numeric, leading to null results in division.

Why this answer

Option B is correct because the `memory_bytes` field contains values like '2,048,000', which include commas. In Splunk, fields with commas are treated as strings, not numeric values. When `eval` attempts arithmetic division on a string field, it returns null because the operation cannot be performed on non-numeric data.

The commas must be removed (e.g., using `replace` or `tonumber`) before the field can be used in calculations.

Exam trap

Splunk often tests the misconception that Splunk automatically handles commas in numeric fields, leading candidates to overlook the need to explicitly remove non-numeric characters before arithmetic operations.

How to eliminate wrong answers

Option A is wrong because the `eval` command syntax is correct: `eval memory_MB = memory_bytes / 1024 / 1024` is valid Splunk syntax. Option C is wrong because the field does not need to be 'converted first' in a generic sense—the specific issue is that the commas make it a string, not that the field type is inherently incompatible. Option D is wrong because the division operator does work on string fields that contain numeric values without commas (Splunk auto-converts them), but it fails when the string contains non-numeric characters like commas.

Practice this question →

49

Multi-Selecthard

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Select 3 answers

A.Grouping events by a field: eval by host

B.Concatenating two strings: eval fullname = firstname + " " + lastname

C.Sorting events by a field: eval sort by _time

D.Calculating a ratio: eval ratio = count / total

E.Creating a conditional field: eval status = if(error > 0, "Error", "OK")

AnswersB, D, E

String concatenation is valid.

Why this answer

Option B is correct because the 'eval' command can concatenate strings using the plus (+) operator, as shown in the example 'eval fullname = firstname + " " + lastname'. This creates a new field 'fullname' by combining the values of 'firstname', a space, and 'lastname'.

Exam trap

Splunk often tests the distinction between 'eval' for per-event calculations and commands like 'stats' or 'sort' for cross-event operations, leading candidates to mistakenly think 'eval' can group or sort events.

Practice this question →

50

Multi-Selecthard

Which TWO factors should be considered when deciding to use the rare command instead of top?

Select 2 answers

A.The dataset has high cardinality in the field of interest

B.Rare is faster than top

C.Top is always preferred for security analysis

D.The analysis goal is to identify infrequent values

E.The user wants to view results sorted alphabetically

AnswersA, D

Rare can help in high cardinality fields to find unusual occurrences.

Why this answer

Option A is correct because the `rare` command is specifically designed to return the least common values of a field, making it ideal for high-cardinality fields where the `top` command would produce a long, less useful list of many low-frequency values. When a field has high cardinality (many unique values), `rare` helps surface the infrequent events that might be missed by `top`, which focuses on the most frequent values. This aligns with the use case of identifying outliers or anomalies in datasets with many distinct field values.

Exam trap

The trap here is that candidates may assume `rare` is faster or always better for security, but the question specifically tests the understanding that `rare` is chosen based on analysis goals (finding infrequent values) and field cardinality, not performance or blanket preferences.

Practice this question →

51

MCQhard

An analyst executes the following search: index=main sourcetype=access | stats dc(user) by host. What does dc(user) do?

A.Count of hosts

B.Distinct count of users per host

C.Count of all users

D.Sum of user IDs

AnswerB

dc(user) by host returns the number of unique users for each host.

Why this answer

The `dc(user)` function in SPL stands for 'distinct count' of the `user` field. When used after `stats ... by host`, it calculates the number of unique users associated with each host. This is why option B is correct: it returns the distinct count of users per host.

Exam trap

The trap here is that candidates confuse `dc()` with `count()` or `sum()`, thinking it returns a total count of events or a sum of values, rather than understanding it performs a distinct count of field values per group.

How to eliminate wrong answers

Option A is wrong because `dc(user)` counts unique users, not hosts; the `by host` clause groups results by host, but the aggregation is on the user field. Option C is wrong because `dc(user)` does not count all users across the entire result set; it counts distinct users per group (per host), not a global total. Option D is wrong because `dc(user)` performs a distinct count, not a sum; summing user IDs would be meaningless and is not what the `dc()` function does.

Practice this question →

52

Multi-Selectmedium

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Select 2 answers

A.The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.

B.The `stats` command displays a list of individual events with their fields.

C.The `stats` command is used to create new fields using the `eval` function.

D.The `stats` command can only be used with numeric fields.

E.The `stats` command can be used with a `by` clause to group results, but the `by` fields must be present in the search results.

AnswersA, E

Correct. `stats` is designed for aggregate calculations.

Why this answer

Option A is correct because the `stats` command in Splunk is specifically designed to compute summary statistics like count, sum, avg, and distinct count over a set of events. It transforms raw event data into aggregated results, making it a core transforming command for reporting and analysis.

Exam trap

The trap here is that candidates often confuse the `stats` command with `eval` or `table`, thinking `stats` can create fields or display raw events, when in fact it only produces aggregated results and requires fields to exist for grouping.

Practice this question →

53

MCQhard

A Splunk administrator is troubleshooting a slow search on firewall logs. The index is 'firewall', sourcetype is 'cisco:asa', and there is about 500 GB of data per day. The search is: index=firewall sourcetype=cisco:asa action=block | stats count by src_ip | where count > 1000. This search takes over 5 minutes to return results. The administrator needs the same results faster. The index has a data model named 'firewall_dm' that is accelerated with a summary range of 7 days. Which change to the search will improve performance the most while still returning the same results?

A.Add | stats count by src_ip, _time to the search

B.Change to | tstats count from datamodel=firewall_dm where action=block by src_ip | where count > 1000

C.Add | fields src_ip before the stats command

D.| search action=block instead of placing action=block in the base search

AnswerB

tstats uses the accelerated data model, drastically reducing the amount of data scanned.

Why this answer

Option B is correct because it uses `tstats` against an accelerated data model, which pre-aggregates data in the summary range (7 days). This avoids scanning raw 500 GB/day of firewall logs, drastically reducing I/O and CPU. The `where` clause in `tstats` filters on the `action` field directly from the accelerated index, returning the same results much faster.

Exam trap

The trap here is that candidates think `fields` or moving the filter to `| search` reduces data volume, but only `tstats` with an accelerated data model avoids scanning raw events entirely.

How to eliminate wrong answers

Option A is wrong because adding `_time` to the `stats` command increases cardinality (more groups), making the search slower, not faster. Option C is wrong because `fields` only reduces output fields, not the volume of data scanned; the bottleneck is raw data retrieval, not field projection. Option D is wrong because moving `action=block` to a `| search` command after the base search still requires scanning all raw events for `index=firewall sourcetype=cisco:asa`, offering no performance gain over the original filter.

Practice this question →

54

MCQmedium

An analyst runs: index=app sourcetype=log ERROR | stats count by host | where count > 5. What is the function of the where command in this search?

A.Remove duplicate hosts

B.Filter events that contain ERROR before counting

C.Rename the count field

D.Filter the output of stats to show only hosts with count > 5

AnswerD

where post-processes the stats results to keep only rows meeting the condition.

Why this answer

The `where` command filters the results of the `stats` calculation, keeping only rows where the `count` field exceeds 5. This is a post-processing filter applied after aggregation, not a pre-filter on raw events. The `where` command operates on the output of `stats`, not on the original events.

Exam trap

The trap here is that candidates often confuse `where` with a search-time filter (like `ERROR` in the base search) or think it removes duplicates, but Splunk tests the understanding that `where` applies after aggregation, not before.

How to eliminate wrong answers

Option A is wrong because `where` does not remove duplicate hosts; it filters aggregated results based on a condition, and deduplication is not its function. Option B is wrong because the `ERROR` filter is already applied in the initial search string (`index=app sourcetype=log ERROR`), not by the `where` command; `where` operates on the post-stats output. Option C is wrong because `where` does not rename fields; renaming is done with the `eval` command or by using `as` in `stats`.

Practice this question →

55

MCQhard

A large enterprise uses Splunk to monitor 500+ servers. A search returns results slowly due to high data volume. Which best practice can improve performance when using the top command?

A.Use the fields command to remove unnecessary fields

B.Use rare instead of top to reduce output

C.Add a limit to top, e.g., top limit=20

D.Apply the sort command before top

AnswerC

Limiting results reduces memory and CPU overhead for top.

Why this answer

Option C is correct because adding a limit to the top command (e.g., top limit=20) restricts the number of results returned, reducing the computational load and memory usage. In high-volume environments, this directly improves search performance by limiting the aggregation work Splunk must perform across all 500+ servers.

Exam trap

Splunk often tests the misconception that removing fields or using rare will improve performance, when in fact only limiting the output of the top command directly reduces the aggregation workload.

How to eliminate wrong answers

Option A is wrong because the fields command removes unnecessary fields from results but does not reduce the number of events processed by the top command, so it has minimal impact on the performance bottleneck caused by high data volume. Option B is wrong because rare performs the same aggregation work as top (just in reverse order), so it does not improve performance and may even be slower due to sorting fewer common values. Option D is wrong because applying the sort command before top forces Splunk to sort all events first, which is extremely expensive on large datasets and will degrade performance further.

Practice this question →

56

MCQmedium

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

A.index=web | timechart avg(duration) by url_path

B.index=web | chart avg(duration) by url_path

C.index=web | eval avg_duration=avg(duration) | stats by url_path

D.index=web | stats avg(duration) by url_path

AnswerD

stats correctly computes average per group.

Why this answer

Option D is correct because the `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Exam trap

The trap here is that candidates often confuse `stats` with `chart` or `timechart`, or incorrectly try to use `eval` for aggregation, not realizing that `eval` operates on individual events and cannot compute summary statistics across groups.

How to eliminate wrong answers

Option A is wrong because `timechart` creates a time-based chart with a series for each `url_path`, which is unnecessary and may produce many data points over time rather than a single average per URL path. Option B is wrong because `chart avg(duration) by url_path` would produce a table with one row per `url_path` but is less efficient and not the standard way to compute grouped averages; `stats` is the idiomatic command for this task. Option C is wrong because `eval` cannot perform aggregation functions like `avg()` — `eval` works on a per-event basis, not across groups, and the syntax `eval avg_duration=avg(duration) | stats by url_path` is invalid and would cause a parsing error.

Practice this question →

57

MCQmedium

Refer to the exhibit. The search returns only events where src_zone is 'external'. What is the problem?

A.The 'src_ip' field is not extracted

B.The default condition should be 'true()' instead of '1=1'

C.The 'case' function cannot compare IP addresses to CIDR ranges

D.The 'search' command should be before 'eval'

AnswerC

Correct: case uses exact string comparison, not subnet matching.

Why this answer

The 'case' function evaluates conditions in order. The second condition '1=1' is always true, so any IP not matching '10.0.0.0/8' gets 'external'. However, the 'case' function does not support CIDR matching; it treats '10.0.0.0/8' as a literal string.

So no IP matches the first condition, and all get 'external'.

Practice this question →

58

Multi-Selectmedium

Which THREE of the following are transforming commands in Splunk?

Select 3 answers

A.search

B.stats

C.timechart

D.chart

E.eval

AnswersB, C, D

stats is a transforming command that computes statistics.

Why this answer

The `stats`, `timechart`, and `chart` commands are all transforming commands in Splunk because they convert raw event data into statistical results, typically producing a table or time-based chart. Unlike non-transforming commands (e.g., `search` or `eval`), these commands change the data structure from events to a summary, which is required for visualizations and further statistical processing.

Exam trap

Splunk often tests the distinction between transforming and non-transforming commands, and the trap here is that candidates mistakenly think `eval` is transforming because it can create new fields, but it does not aggregate or change the event structure into a statistical table.

Practice this question →

59

MCQhard

Refer to the exhibit. The search returns no results. What is the most likely reason?

A.The sourcetype is incorrect

B.The 'regex' command cannot extract fields; use 'rex' instead

C.The regex pattern is invalid

D.The 'top' command requires a field to be extracted first

AnswerB

Correct: regex filters events, rex extracts fields.

Why this answer

The regex uses named capture groups, but Splunk's 'regex' command does not support creating fields with named capture groups. The 'rex' command should be used instead to extract fields.

Practice this question →

60

MCQhard

A search includes the command '| stats dc(user) by host'. What does this command return?

A.The number of unique hosts per user

B.The count of events per host

C.The sum of user values per host

D.The number of distinct users per host

AnswerD

dc(user) counts distinct users.

Why this answer

The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Exam trap

The trap here is confusing `dc(user)` with `count(user)` or `sum(user)`, leading candidates to think it returns event counts or sums instead of distinct counts.

How to eliminate wrong answers

Option A is wrong because `dc(user) by host` counts distinct users per host, not distinct hosts per user. Option B is wrong because `dc(user)` does not count events; it counts distinct values of the `user` field. Option C is wrong because `dc(user)` performs a distinct count, not a sum of user values, and summing string values is not a valid operation in this context.

Practice this question →

61

MCQeasy

A user needs to see the trend of login failures over the past 7 days, broken down by hour. Which command should be used?

A.stats count by _time

B.eval count

C.timechart count by _time

D.chart count over _time

AnswerC

timechart automatically groups events into time buckets and displays the count over time.

Why this answer

C is correct because `timechart count by _time` automatically creates a time-based chart with login failures aggregated per hour over the past 7 days. The `timechart` command splits the time range into equal-span buckets (default 1 hour for a 7-day window) and counts events in each bucket, displaying the trend over time. The `by _time` clause is redundant but not harmful; the command inherently uses `_time` as the x-axis.

Exam trap

Splunk often tests the distinction between `timechart` (which automatically buckets and charts time-based data) and `stats` (which requires manual time-binning via `bin` or `timechart`-like syntax), leading candidates to choose `stats count by _time` thinking it will produce a trend chart.

How to eliminate wrong answers

Option A is wrong because `stats count by _time` would group events by exact `_time` timestamps (including milliseconds), producing a row per unique timestamp rather than hourly buckets, and it does not generate a time-based chart. Option B is wrong because `eval count` is not a transforming command; it creates or modifies a field but cannot aggregate or trend data over time. Option D is wrong because `chart count over _time` is invalid syntax; the `chart` command uses `by` or `over` incorrectly here—`over` is not a valid clause for `chart`, and even if corrected to `chart count by _time`, it would behave like `stats` without automatic time bucketing or charting.

Practice this question →

62

MCQeasy

A user wants to remove duplicate events based on the 'transaction_id' field, keeping only the first occurrence. Which command is appropriate?

A.fields - transaction_id

B.sort transaction_id | dedup transaction_id

C.dedup transaction_id

D.uniq transaction_id

AnswerC

Removes duplicates based on field.

Why this answer

The `dedup` command removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the user wants to keep the first occurrence of each unique `transaction_id`, `dedup transaction_id` is the correct and simplest approach.

Exam trap

The trap here is that candidates often confuse `dedup` with `uniq`, not realizing that `uniq` only removes consecutive duplicates and requires sorted input, while `dedup` works on any field and does not require prior sorting.

How to eliminate wrong answers

Option A is wrong because `fields - transaction_id` removes the `transaction_id` field from events, not duplicate events. Option B is wrong because `sort transaction_id | dedup transaction_id` sorts events by `transaction_id` before deduplication, which changes the order and may cause a different event to be kept as the 'first occurrence' if the original order is important. Option D is wrong because `uniq` removes consecutive duplicate lines, not duplicate events based on a field, and it requires sorted input to work correctly.

Practice this question →

63

Matchingmedium

Match each Splunk role to its typical permission scope.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Full system access including settings and users

Create and share knowledge objects and run searches

Run searches and create personal knowledge objects

Ability to delete events from indexes

Why these pairings

Roles define capabilities within Splunk.

Practice this question →

64

MCQhard

Refer to the exhibit. A user runs the search and gets no results. Which is the most likely cause?

A.The 'sort' command must come before 'where'

B.The 'status' field does not exist in the data

C.The 'stats' command cannot be used with 'where'

D.The 'index' parameter is misspelled

AnswerB

If the field is not extracted, 'where' returns no results.

Why this answer

The search uses the 'where' command before 'sort', but the 'where' command filters out all events if no status codes >= 400 exist. However, a more common issue is that the 'status' field may not be extracted correctly from the access_combined sourcetype, or the field name might be different (e.g., 'http_status'). The 'where' command requires an existing field.

Practice this question →

65

MCQmedium

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

A.| stats count by status | where count > 100

B.| eval count=1 | stats sum(count) by status | where count > 100

C.| stats count as cnt by status | where cnt > 100

D.| where count > 100 | stats count by status

AnswerC

Correct: stats counts by status, then filters on the count field.

Why this answer

Option C is correct because it first uses `stats count as cnt by status` to count events per status code, renaming the count field to `cnt`, then applies `where cnt > 100` to filter for status codes with more than 100 events. This is the standard Splunk pattern for aggregating data and then filtering on the aggregated result.

Exam trap

Splunk often tests the order of operations in the search pipeline, specifically that `where` cannot reference a field created by a later command, leading candidates to incorrectly place the filter before the aggregation.

How to eliminate wrong answers

Option A is wrong because `where count > 100` references a field named `count` that does not exist at that point; `stats count by status` creates a field named `count` only after the stats command, but the `where` clause is applied before stats in the pipeline order, causing an error or no results. Option B is wrong because it unnecessarily uses `eval count=1` and `stats sum(count) by status` instead of the simpler `stats count by status`; while it might produce the same result, it is inefficient and not the correct approach for counting events. Option D is wrong because `where count > 100` is applied before `stats count by status`, meaning it tries to filter on a field that does not exist yet; this will either fail or return no events, and the stats command then counts all remaining events without the intended filter.

Practice this question →

66

MCQhard

An analyst needs to find the count of events by source type for each day in the past week, but only for source types with more than 1000 events. Which search is correct?

A.index=* earliest=-7d | bucket _time span=1d | stats count by sourcetype _time | where count>1000

B.index=* earliest=-7d | stats count by sourcetype _time | where count>1000

C.index=* earliest=-7d | timechart count by sourcetype | search count>1000

D.index=* earliest=-7d | timechart count by sourcetype | where count>1000

AnswerA

Correctly buckets and filters after stats.

Why this answer

Option A is correct because it uses `bucket _time span=1d` to group events into daily time buckets, then `stats count by sourcetype _time` to count events per source type per day, and finally `where count>1000` to filter for source types exceeding 1000 events per day. The `bucket` command is essential to create discrete daily intervals; without it, `stats count by sourcetype _time` would treat each unique _time value as a separate bucket, which is not the intended daily aggregation.

Exam trap

Splunk often tests the distinction between `bucket` and raw _time grouping, and the misuse of `search` vs `where` for filtering aggregate results, leading candidates to pick options that omit bucket or use `search` incorrectly.

How to eliminate wrong answers

Option B is wrong because it omits the `bucket` command, so `stats count by sourcetype _time` groups by the raw _time field (with sub-second precision), resulting in many tiny buckets that do not represent daily counts, and the `where count>1000` filter would likely return no results or incorrect data. Option C is wrong because `timechart count by sourcetype` automatically creates time buckets (default span depends on time range) but then uses `search count>1000` which is invalid syntax — `search` expects a field-value pair or a keyword, not an aggregation comparison; it would either error or ignore the filter. Option D is wrong because `timechart count by sourcetype` outputs a table with time as rows and sourcetypes as columns, so `where count>1000` references a nonexistent field 'count' (the counts are in columns named after sourcetypes), causing the filter to fail or produce no results.

Practice this question →

67

MCQmedium

Refer to the exhibit. A user runs this search and gets 10 results as expected. However, they want to see the top 10 hosts for the past week. The search still returns results, but the counts are lower than expected. What is the most likely reason?

A.The time range is set to the past 24 hours by default.

B.The sort command is not needed.

C.The head command restricts results.

D.The stats command counts all time.

AnswerA

Default time range is Last 24 hours, not All time.

Why this answer

By default, Splunk searches are restricted to the last 24 hours (unless a different time range is explicitly selected). Even though the user expects results for the past week, the search is only looking at the most recent 24 hours of data. This causes the counts to be lower than expected because events from earlier in the week are not included.

Exam trap

Splunk often tests the default time range behavior, where candidates assume the search will automatically cover the entire dataset or the time range implied by the search logic, but Splunk restricts results to the last 24 hours unless the time picker is changed.

How to eliminate wrong answers

Option B is wrong because the sort command is not the issue; it is correctly used to order the results by count, and removing it would not fix the time range problem. Option C is wrong because the head command is correctly used to limit the output to the top 10 results; it does not affect the time range of the search. Option D is wrong because the stats command does not count all time; it only processes events within the currently selected time range, which defaults to the past 24 hours.

Practice this question →

68

MCQhard

Refer to the exhibit. What will be the output of this search?

A.All productId values sorted alphabetically

B.ProductId values with count=0

C.The top 10 productId values based on event count

D.The productId and its count for the 10 product IDs with the highest event counts

AnswerD

The search exactly produces that result.

Why this answer

The search uses the `top` command, which by default returns the 10 most frequent values of the specified field (`productId`) based on event count, along with their counts. Option D correctly describes this output: the `productId` and its count for the 10 product IDs with the highest event counts.

Exam trap

Splunk often tests the distinction between `top` returning only the field values versus returning both the field values and their counts, leading candidates to choose Option C when the correct answer is D.

How to eliminate wrong answers

Option A is wrong because the `top` command does not sort alphabetically; it sorts by count in descending order. Option B is wrong because `top` returns values with the highest counts, not count=0; values with zero count are not returned. Option C is wrong because while `top` does return the top 10 based on event count, it also includes the count for each value, not just the productId values alone.

Practice this question →

69

Multi-Selectmedium

A user wants to find events where the status code is 500 or 503 and the response time is greater than 2 seconds. Which TWO SPL commands will correctly limit the results to only these events?

Select 2 answers

A.status=500,503 AND response_time>2

B.search status=500 OR status=503 response_time>2

C.status=500 OR status=503 | where response_time>2

D.search (status=500 OR status=503) AND response_time>2

E.status IN (500,503) | where response_time>2

AnswersD, E

This correctly groups the OR conditions and applies the AND operator.

Why this answer

Option D is correct because it uses the `search` command with explicit parentheses to group the OR conditions, ensuring the logical AND with `response_time>2` applies to the entire set of status codes. This matches the requirement to find events where status is 500 or 503 AND response time exceeds 2 seconds.

Exam trap

Splunk often tests the misconception that commas can substitute for OR operators in SPL, or that omitting parentheses in a mixed AND/OR expression will still yield correct results due to assumed left-to-right evaluation.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Basic Searching questions.

Start 20-question session