How Do You Query a Summary Index Populated by a Report Named 'Linux Logins'?

A report named "Linux logins" populates a summary index with the search string sourcetype=linux secure | sitop src ip user. Which of the following correctly searches against the summary index for this data?

  1. index=summary sourcetype="linux_secure" | top src_ip user
  2. index=summary search name="Linux logins" | top src ip user
  3. index=summary search_name="Linux logins" | stats count by src_ip user Source Reference Answer
  4. index=summary sourcetype="linux secure" | stats count by src_ip user

Community Votes

C
50%
B
50%

50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your understanding of summary index fields: the report name is stored in search_name, and aggregated results require stats count, not top.

Learn the correct Splunk query for searching a summary index populated by a report, including the role of search_name and stats count. Community consensus is C, but many exam takers mistakenly choose B.

Choosing B (index=summary search name=...) is the most common error because testers overlook the underscore in search_name and assume top can replace stats count.

Community Discussion (4 comments)

adamsca 👍 1 Selected: B
B is the correct answer. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sitop
Derag 👍 2
Please ignore my previous comment, It is B. It also states it needs to be filtered by the top IP user.
Derag 👍 1
It is C. I have verified it by myself.
Eddie_exam 👍 1 Selected: C
Correct answer is C. The name of the report should be the value for the field search_name. See Splunk Fundamentals 3 slide 220.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

When a report populates a summary index, the report's name is automatically stored in the search_name field. The correct query therefore filters with search_name="Linux logins". Since the original search used sitop to pre-aggregate values, querying the summary index requires you to summarize the aggregated rows again with stats count by src_ip user. Option C does exactly this, making it the only option that uses the proper field name and the right aggregation command.

Why the Other Options Are Wrong

Option A uses sourcetype="linux_secure", but the summary index events do not keep the original sourcetype; they are stored under a summary sourcetype. Option B looks similar to C but references search name with a space, which Splunk interprets as two separate tokens rather than the field search_name; it also uses top instead of stats count. Option D uses an invalid sourcetype "linux secure" and is too vague to retrieve the specific report’s summary data. Only C combines the correct search_name filter with the required stats count aggregation.

Community Comment Notes

The vote split is 50/50 between B and C. A commenter initially said B, then retracted and corrected to B again; another linked to the sitop docs to argue for B. However, the commenters who verified with Splunk Fundamentals 3 confirm C is correct, noting "the name of the report should be the value for the field search_name." The B choice is a classic trap because the underscore in search_name is easy to miss, and top appears to match the original sitop command but does not provide the same summary-index retrieval behavior as stats count.

Official Reference

Exam Strategy

Always check the exact spelling of field names in Splunk queries—search_name has an underscore. When searching summary indexes, remember that the original report name is stored in search_name and use stats count (or stats sum) to aggregate the pre-computed values.

Related Analysis

Which of the following is not a common default time field?

S-Grade

Which of the following are potential string results returned

A-Grade

What default Splunk role can use the Log Event alert action?

S-Grade

Practice All SPLK-1004 Questions

Access 130 questions with complete answers and detailed explanations.

View Full SPLK-1004 Practice Test →

← Back to SPLK-1004 Study Guide