A network admin wants to see the number of packets per 5-minute interval for the last 30 minutes. The events have a field 'protocol'. Which search should they use?

index=network | bucket _time span=5m | stats count by _time

index=network | timechart count by protocol

index=network | bucket protocol span=5m | stats count by protocol

index=network | transaction maxspan=5m

SplunkCore Certified Power User

Domain 3Objective 3

Group Events Using Fields and Time SPLK-1002 Practice Questions (Page 4)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

3concepts

15%of the exam

Questions 16–17

16foundation · easy
Which command would you use to group events into 5-minute time buckets?
Select an answer first
17application · medium
A network admin wants to see the number of packets per 5-minute interval for the last 30 minutes. The events have a field 'protocol'. Which search should they use?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

Group Events Using Fields and Time SPLK-1002 Practice Questions (Page 4)

Questions 16–17

Which command would you use to group events into 5-minute time buckets?

A network admin wants to see the number of packets per 5-minute interval for the last 30 minutes. The events have a field 'protocol'. Which search should they use?

Keep studying — Correlating Events