A security analyst is testing a new alert that needs to trigger when the count of failed logins exceeds 10 in a 5-minute window. The analyst wants to simulate 15 minutes of data to test the alert's time-based logic. Which SPL command should be used to generate a series of events with timestamps?

`| makeresults count=15 | eval _time = _time - (15 * 60)`

`| makeresults count=15 | eval _time = _time + (relative_time(now(), "-15m") - _time)`

`| makeresults count=15 | eval _time = _time + (seq * 60)`

`| makeresults count=15 | streamstats count as seq | eval _time = _time - (seq * 60)`

SplunkCertified Cybersecurity Defense Analyst

Domain 5Objective 1

Explain Common SPL Terms and How They Can Be Used in Security Analysis, Including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS. SPLK-5001 Practice Questions (Page 4)

Part of the SPL and Efficient Searching domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

8concepts

20%of the exam

Questions 16–19

16foundation · easy
A security analyst needs to extract the source IP address from a log message that is not already a field. Which Splunk command is specifically designed to extract fields from event data using regular expressions?
Select an answer first
17foundation · easy
A security analyst needs to identify the first and last login events for each user in a given day. Which Splunk commands are specifically designed to find the earliest and latest events in a search?
Select an answer first
18application · medium
A security analyst is testing a new alert that needs to trigger when the count of failed logins exceeds 10 in a 5-minute window. The analyst wants to simulate 15 minutes of data to test the alert's time-based logic. Which SPL command should be used to generate a series of events with timestamps?
Select an answer first
19foundation · easy
A security analyst wants to test a search against a known dataset by generating a single event with specific fields. Which Splunk command is specifically designed to generate a single event or a set of events for testing or creating data?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Explain Common SPL Terms and How They Can Be Used in Security Analysis, Including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS. SPLK-5001 Practice Questions (Page 4)

Questions 16–19

A security analyst needs to extract the source IP address from a log message that is not already a field. Which Splunk command is specifically designed to extract fields from event data using regular expressions?

A security analyst needs to identify the first and last login events for each user in a given day. Which Splunk commands are specifically designed to find the earliest and latest events in a search?

A security analyst is testing a new alert that needs to trigger when the count of failed logins exceeds 10 in a 5-minute window. The analyst wants to simulate 15 minutes of data to test the alert's time-based logic. Which SPL command should be used to generate a series of events with timestamps?

A security analyst wants to test a search against a known dataset by generating a single event with specific fields. Which Splunk command is specifically designed to generate a single event or a set of events for testing or creating data?

Keep studying — SPL and Efficient Searching