An analyst is searching for events from the last 24 hours. Which approach is the most efficient way to limit the search to this time range?

Add 'earliest=-24h' to the search string

Use the time range picker to select 'Last 24 hours'

Add 'sourcetype=*' to the search string

A Splunk user is working with events that contain a field called 'status_code'. The user wants to see the distribution of status codes in the results. Which search should be used to count the number of events for each status code?

index=main | stats count by status_code

A Splunk user is analyzing web access logs and wants to see the top 5 most frequent URLs accessed. The user has a field called 'url' in the events. Which search should be used to accomplish this?

index=web | stats count by url | head 5

A Splunk user is working with events that contain a field called 'src_ip'. The user wants to display only the 'src_ip' and 'dest_ip' fields in the results, but also wants to remove any events where 'src_ip' is the same as 'dest_ip'. Which search accomplishes this?

index=main | table src_ip dest_ip | where src_ip != dest_ip

index=main | dedup src_ip dest_ip | table src_ip dest_ip

index=main | where src_ip != dest_ip | table src_ip dest_ip

index=main | search src_ip != dest_ip | fields src_ip dest_ip

SplunkCore Certified User

Domain 4Objective 1

Review Basic Search Commands and General Search Practices SPLK-1001 Practice Questions (Page 1)

Part of the Search Language Fundamentals domain, which accounts for 15% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 7 practice questions to prepare you well beyond it. (estimate)

7questions here

2free pages

2concepts

15%of the exam

Questions 1–5

1foundation · easy
An analyst is searching for events from the last 24 hours. Which approach is the most efficient way to limit the search to this time range?
Select an answer first
2foundation · easy
A user wants to find events that contain the word 'error' but NOT the word 'timeout'. Which search string correctly uses Boolean operators to achieve this?
Select an answer first
3application · medium
A Splunk user is working with events that contain a field called 'status_code'. The user wants to see the distribution of status codes in the results. Which search should be used to count the number of events for each status code?
Select an answer first
4application · medium
A Splunk user is analyzing web access logs and wants to see the top 5 most frequent URLs accessed. The user has a field called 'url' in the events. Which search should be used to accomplish this?
Select an answer first
5application · medium
A Splunk user is working with events that contain a field called 'src_ip'. The user wants to display only the 'src_ip' and 'dest_ip' fields in the results, but also wants to remove any events where 'src_ip' is the same as 'dest_ip'. Which search accomplishes this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.