An analyst is investigating a data breach. The analyst has a search that returns events with a `user` field and a `file_name` field. The analyst wants to see a list of all files accessed by each user, with the files listed in a single cell per user. Which search should the analyst use?

`index=main | stats values(file_name) as files_accessed by user`

`index=main | stats list(file_name) as files_accessed by user`

`index=main | stats dc(file_name) as file_count by user`

`index=main | stats count by user, file_name`

A Splunk user is analyzing server logs. Each event has a `server_name` and a `cpu_usage` field. The user wants to see the maximum CPU usage recorded for each server. Which search should the user run?

`index=server | stats avg(cpu_usage) as avg_cpu by server_name`

`index=server | stats max(cpu_usage) as max_cpu by server_name`

`index=server | stats count by server_name`

`index=server | stats min(cpu_usage) as min_cpu by server_name`

SplunkCore Certified Power User

Domain 3Objective 2

Group Events Using Fields SPLK-1002 Practice Questions (Page 1)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 4 practice questions to prepare you well beyond it. (estimate)

4questions here

1free page

1concept

15%of the exam

Questions 1–4

1foundation · easy
In a Splunk search, which clause is used with the stats command to specify the field(s) by which events should be grouped?
Select an answer first
2foundation · easy
Which Splunk search command is used to group events by one or more fields so that related events are organized together for analysis?
Select an answer first
3application · medium
An analyst is investigating a data breach. The analyst has a search that returns events with a `user` field and a `file_name` field. The analyst wants to see a list of all files accessed by each user, with the files listed in a single cell per user. Which search should the analyst use?
Select an answer first
4application · medium
A Splunk user is analyzing server logs. Each event has a `server_name` and a `cpu_usage` field. The user wants to see the maximum CPU usage recorded for each server. Which search should the user run?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

Group Events Using Fields SPLK-1002 Practice Questions (Page 1)

Questions 1–4

In a Splunk search, which clause is used with the stats command to specify the field(s) by which events should be grouped?

Which Splunk search command is used to group events by one or more fields so that related events are organized together for analysis?

An analyst is investigating a data breach. The analyst has a search that returns events with a `user` field and a `file_name` field. The analyst wants to see a list of all files accessed by each user, with the files listed in a single cell per user. Which search should the analyst use?

A Splunk user is analyzing server logs. Each event has a `server_name` and a `cpu_usage` field. The user wants to see the maximum CPU usage recorded for each server. Which search should the user run?

Keep studying — Correlating Events