How do you group results by multiple fields in a stats command?

List the fields after 'by' separated by commas: by field1, field2

Use a plus sign: by field1+field2

Use multiple 'by' clauses: by field1 by field2

What happens when you use the count function on a field that has null values in some events?

It returns an error because of null values

It counts all events, including those with null values

It counts only the events where the field has a non-null value

Which stats command correctly renames the result of the sum function to 'total_bytes'?

stats sum(bytes) by total_bytes

stats sum(bytes) as total_bytes

A Splunk search returns events with fields user, action, and _time. An analyst needs a table with one row per user, showing the total number of events and the earliest event time for each user. Which statement correctly describes the appropriate command?

Use the top command with the user field, because top automatically calculates counts and earliest times for each value.

Use the stats command with count and earliest(_time), grouped by user, because stats returns a table with one row per group and columns for each aggregated value.

Use the timechart command with the count function, because timechart automatically groups by time and user.

Use the chart command with the count and earliest functions, grouping by user, because chart always produces a tabular output with fields as columns.

How do you combine multiple stats functions in a single stats command?

Use a semicolon: stats count; avg(bytes)

Use the pipe character: stats count | avg(bytes)

Separate them with commas: stats count, avg(bytes)

Write two separate stats commands

SplunkCore Certified User

Domain 5Objective 3

The Stats Command SPLK-1001 Practice Questions (Page 1)

Part of the Using Basic Transforming Commands domain, which accounts for 15% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

9concepts

15%of the exam

Questions 1–5

1foundation · easy
How do you group results by multiple fields in a stats command?
Select an answer first
2foundation · easy
What happens when you use the count function on a field that has null values in some events?
Select an answer first
3foundation · easy
Which stats command correctly renames the result of the sum function to 'total_bytes'?
Select an answer first
4foundation · medium
A Splunk search returns events with fields user, action, and _time. An analyst needs a table with one row per user, showing the total number of events and the earliest event time for each user. Which statement correctly describes the appropriate command?
Select an answer first
5foundation · easy
How do you combine multiple stats functions in a single stats command?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.