Basic Searching and Transforming Commands practice questions
Practise Splunk Core Certified User SPLK-1002 Basic Searching and Transforming Commands practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?
A security analyst uses Splunk to ingest firewall logs from multiple locations. The index is 'firewall' and the sourcetype is 'fw_log'. Each event contains fields: src_ip, dest_ip, action, bytes, and time. The analyst needs to find how many unique source IPs have been logged in the last hour to report potential scanning activity. The search should be efficient and accurate, returning only the total count of distinct source IPs. Which search accomplishes this?
This search is inefficient for counting unique values, as the `dedup` command processes all events and retains the first occurrence of each `src_ip` before `stats count` tallies these remaining events. This mechanism uses more resources than directly calculating the distinct count. However, `dedup` is the correct choice when the analyst needs to retrieve the *full event* for the first instance of each unique `src_ip`, perhaps to examine other associated fields like `dest_ip` or `action` from that initial log.
Trap 2: index=firewall sourcetype=fw_log earliest=-1h | top src_ip | stats…
top returns the most common values and count, then stats count would count the number of IPs in the top list, not all distinct IPs.
Why wrong: This search is inefficient for counting unique values, as the `dedup` command processes all events and retains the first occurrence of each `src_ip` before `stats count` tallies these remaining events. This mechanism uses more resources than directly calculating the distinct count. However, `dedup` is the correct choice when the analyst needs to retrieve the *full event* for the first instance of each unique `src_ip`, perhaps to examine other associated fields like `dest_ip` or `action` from that initial log.
B
index=firewall sourcetype=fw_log earliest=-1h | top src_ip | stats count as UniqueIPs
Why wrong: top returns the most common values and count, then stats count would count the number of IPs in the top list, not all distinct IPs.
An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?
Trap 1: | eval count=1 | stats sum(count) by status | where count > 100
Incorrect: `eval count=1` then `stats sum(count) by status` works but is unnecessarily complex and less efficient; the standard pattern is to use `stats count`.
Trap 2: | where count > 100 | stats count by status
Incorrect: `where count > 100` before stats: no field 'count' exists yet, so the filter does not work as intended.
Correct: `stats count by status` creates a count per status, then `where count > 100` filters correctly.
B
| eval count=1 | stats sum(count) by status | where count > 100
Why wrong: Incorrect: `eval count=1` then `stats sum(count) by status` works but is unnecessarily complex and less efficient; the standard pattern is to use `stats count`.
C
| stats count as cnt by status | where cnt > 100
Correct: Same as A but renames count to 'cnt' – also a valid approach.
D
| where count > 100 | stats count by status
Why wrong: Incorrect: `where count > 100` before stats: no field 'count' exists yet, so the filter does not work as intended.
A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?
A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:
The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?
Trap 1: Use 'eventstats count by clientip, sessionid' and then filter where…
eventstats does not reduce events, still processes all.
Trap 2: Use the 'transaction' command to group events by clientip and…
Transaction is more resource-intensive than stats.
Trap 3: Add a 'where' command after stats to filter out internal IPs and…
Internal IPs are not filtered early, still processes all data.
Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?
Exhibit
Refer to the exhibit.
Search:
`index=web sourcetype=access_combined | top limit=5 uri_path`
Result table:
uri_path count percent
/ 4523 23.45
/login 2341 12.14
/products 1890 9.80
/about 1234 6.40
/contact 987 5.12
Trap 1: `index=web sourcetype=access_combined | top limit=3 uri_path |…
This works but is less efficient than using `showperc=f`.
Trap 2: `index=web sourcetype=access_combined | top uri_path | head 3`
`head` would work but still shows percent column. More importantly, `top` without limit shows all results, which is inefficient.
Trap 3: `index=web sourcetype=access_combined | top limit=3 uri_path`
This shows top 3 but still includes the percent column.
A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?
Trap 1: Use the `transaction` command to group related events before…
`transaction` is resource-intensive and would increase search time.
Trap 2: Replace `stats count by host` with `top limit=5 host` to limit…
This reduces output but not the initial data scanned; the main bottleneck is the broad search.
Trap 3: Add a `summarize` command before `stats` to pre-aggregate data.
`summarize` is not a Splunk command; the correct approach is to filter earlier.
What does the SPLK-1001 exam test about Basic Searching and Transforming Commands?
Basic Searching and Transforming Commands questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Basic Searching and Transforming Commands questions in a focused session?
Yes — the session launcher on this page draws every question from the Basic Searching and Transforming Commands domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SPLK-1001 topics?
Use the topic links above to move to related areas, or go back to the SPLK-1001 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the SPLK-1001 exam covers. They are not copied from any real exam or dump site.