How Do You Query a Summary Index Populated by a Report Named 'Linux Logins'?

SPLK-1004 By islever Editorial Last updated

Short answer

C index=summary search_name="Linux logins" | stats count by src_ip user

Question

A report named "Linux logins" populates a summary index with the search string sourcetype=linux secure | sitop src ip user. Which of the following correctly searches against the summary index for this data?
  1. index=summary sourcetype="linux_secure" | top src_ip user
  2. index=summary search name="Linux logins" | top src ip user
  3. index=summary search_name="Linux logins" | stats count by src_ip user Correct Answer
  4. index=summary sourcetype="linux secure" | stats count by src_ip user

Key Takeaways

This question tests your understanding of summary index fields: the report name is stored in search_name, and aggregated results require stats count, not top.

Learn the correct Splunk query for searching a summary index populated by a report, including the role of search_name and stats count. Community consensus is C, but many exam takers mistakenly choose B.

Common mistake: Choosing B (index=summary search name=...) is the most common error because testers overlook the underscore in search_name and assume top can replace stats count.

Expert Analysis

Why the Answer Is Correct

When a report populates a summary index, the report's name is automatically stored in the search_name field. The correct query therefore filters with search_name="Linux logins". Since the original search used sitop to pre-aggregate values, querying the summary index requires you to summarize the aggregated rows again with stats count by src_ip user. Option C does exactly this, making it the only option that uses the proper field name and the right aggregation command.

Why the Other Options Are Wrong

Option A uses sourcetype="linux_secure", but the summary index events do not keep the original sourcetype; they are stored under a summary sourcetype. Option B looks similar to C but references search name with a space, which Splunk interprets as two separate tokens rather than the field search_name; it also uses top instead of stats count. Option D uses an invalid sourcetype "linux secure" and is too vague to retrieve the specific report’s summary data. Only C combines the correct search_name filter with the required stats count aggregation.

Community Comment Notes

The vote split is 50/50 between B and C. A commenter initially said B, then retracted and corrected to B again; another linked to the sitop docs to argue for B. However, the commenters who verified with Splunk Fundamentals 3 confirm C is correct, noting "the name of the report should be the value for the field search_name." The B choice is a classic trap because the underscore in search_name is easy to miss, and top appears to match the original sitop command but does not provide the same summary-index retrieval behavior as stats count.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always check the exact spelling of field names in Splunk queries—search_name has an underscore. When searching summary indexes, remember that the original report name is stored in search_name and use stats count (or stats sum) to aggregate the pre-computed values.

Community Votes

C
50%
B
50%

50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Derag 👍 2
    Please ignore my previous comment, It is B. It also states it needs to be filtered by the top IP user.
  2. Eddie_exam 👍 1 Answered C
    Correct answer is C. The name of the report should be the value for the field search_name. See Splunk Fundamentals 3 slide 220.
  3. adamsca 👍 1 Answered B
    B is the correct answer. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sitop
  4. Derag 👍 1
    It is C. I have verified it by myself.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Default Splunk Role Can Use the Log Event Alert Action?

S-grade

What Is the Best Choice for Summarizing Data to Improve Search Performance?

S-grade

Where do search debug messages appear for troubleshooting views?

S-grade

What Capability Does a Power User Need to Create a Log Event Alert Action?

S-grade

Practice All SPLK-1004 Questions

Access 130 questions with complete answers and detailed explanations.

View Full SPLK-1004 Practice Test →

← Back to SPLK-1004 Study Guide