A support team wants to group all events related to a single customer support ticket, but only if the events occur within 30 minutes of each other. The events have a common field 'ticket_id'. Which search should they use?

index=support | bucket ticket_id span=30m

index=support | transaction maxspan=30m

index=support | transaction ticket_id maxspan=30m

index=support | stats count by ticket_id

A manager wants to see a count of errors per hour for the last 24 hours. The events have a field 'error_code'. Which search should be used to group the events into hourly buckets?

index=main | bucket _time span=1h | stats count by _time

index=main | timechart count by error_code

index=main | bucket error_code span=1h | stats count by error_code

index=main | transaction maxspan=1h

A DevOps team wants to group all events for a single build number into a single event, but only if the events occur within 30 minutes of each other. The events have a field 'build_id'. Which search should they use?

index=build | transaction maxspan=30m

index=build | stats count by build_id

index=build | bucket build_id span=30m

index=build | transaction build_id maxspan=30m

A fraud analyst wants to group all events for a single credit card number into a single event, but only if the events occur within 5 minutes of each other. The events have a field 'card_number'. Which search should they use?

index=fraud | transaction card_number maxspan=5m

index=fraud | stats count by card_number

index=fraud | bucket card_number span=5m

index=fraud | transaction maxspan=5m

A security analyst wants to group all authentication events for each user into a single event that shows the start and end times of their login session. The events have a common field 'user' and occur over a period of hours. Which search should the analyst use?

index=auth | transaction maxspan=1h

index=auth | stats values(user) by _time

SplunkCore Certified Power User

Domain 3Objective 3

Group Events Using Fields and Time SPLK-1002 Practice Questions (Page 2)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

3concepts

15%of the exam

Questions 6–10

6application · medium
A support team wants to group all events related to a single customer support ticket, but only if the events occur within 30 minutes of each other. The events have a common field 'ticket_id'. Which search should they use?
Select an answer first
7application · medium
A manager wants to see a count of errors per hour for the last 24 hours. The events have a field 'error_code'. Which search should be used to group the events into hourly buckets?
Select an answer first
8application · medium
A DevOps team wants to group all events for a single build number into a single event, but only if the events occur within 30 minutes of each other. The events have a field 'build_id'. Which search should they use?
Select an answer first
9application · medium
A fraud analyst wants to group all events for a single credit card number into a single event, but only if the events occur within 5 minutes of each other. The events have a field 'card_number'. Which search should they use?
Select an answer first
10application · medium
A security analyst wants to group all authentication events for each user into a single event that shows the start and end times of their login session. The events have a common field 'user' and occur over a period of hours. Which search should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.