Splunk SPLK-1001 - Core Certified User - Search SPL Fields Lookups Reports Dashboards Alerts

By Drew Nguyen · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,935
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.7 (15)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

An analyst notices that a Splunk search is returning too many results and taking a long time to complete. The search is: `index=* | search "error" | stats count by host`. What are the best practices to optimize this search?

Answer choices

  • A. Add `| head 10000` after the first pipe to limit events before stats

  • B. Be more specific with the index name, use field-value pairs instead of keyword search, and move the `search` filter before `stats`

  • C. Replace `stats count by host` with `top host` for faster processing

  • D. Schedule the search as a saved report to run during off-peak hours

Question 2

A Splunk user wants to calculate the average response time grouped by web application endpoint for the last hour. The response time is in a field called `response_ms`. Which SPL command is most appropriate?

Answer choices

  • A. `index=web | timechart avg(response_ms) by endpoint`

  • B. `index=web | stats avg(response_ms) as avg_response by endpoint | sort -avg_response`

  • C. `index=web | eval avg_response=avg(response_ms) | table endpoint, avg_response`

  • D. `index=web | chart response_ms by endpoint`

Question 3

A Splunk administrator wants to understand the difference between "Fast Mode," "Smart Mode," and "Verbose Mode" for searches. When should Verbose Mode be used?

Answer choices

  • A. Fast Mode for production dashboards; Smart Mode for general searching; Verbose Mode when field discovery and event list exploration are needed

  • B. Verbose Mode should always be used for maximum result accuracy

  • C. Fast Mode is for real-time searches; Verbose Mode is for scheduled reports

  • D. Smart Mode and Verbose Mode are identical; only the display format changes

Question 4

An analyst uses the following SPL search and wants to understand the result: `index=sales | stats sum(revenue) as total_revenue, count as num_transactions by product_category | eval avg_transaction=round(total_revenue/num_transactions,2)`. What does this search produce?

Answer choices

  • A. A time-series chart showing revenue per category over time

  • B. A table showing each product category with total revenue, number of transactions, and calculated average transaction value

  • C. Individual sales events filtered by product category

  • D. A lookup that enriches future sales data with category averages

Question 5

A Splunk search is: `index=web | eval size_kb=round(bytes/1024,1) | where size_kb > 100 | stats avg(size_kb) as avg_kb, max(size_kb) as max_kb by url`. What is the logical flow of this search?

Answer choices

  • A. Filter by size, group by URL, then calculate the KB conversion and statistics

  • B. Retrieve web events, convert bytes to KB (rounded to 1 decimal), keep only events with KB > 100, then calculate average and max KB per URL

  • C. Group by URL first, then calculate statistics, then filter by size

  • D. Convert bytes, then create a lookup table of URL statistics, then filter by size