Log and Data Tasks

Splunk sells search over machine data, turning raw logs into counts and tables. A few of its coding rounds ask you to do that yourself, with no search language to lean on. The three tasks here look easy, and most mistakes come from the input format.

Ask how the data arrives before you code. Input too big for memory has to be read one line at a time, and the rule for what counts has to be strict.

When the data is split across machines with no shared memory, you need a plan for who sends what to whom, and an empty share still has to report in.

A file with quoted fields needs a real parser, because splitting on the separator shifts every later column. Also ask which tool they expect, since a shell pipeline is sometimes the answer they wanted.

SplunkPremium lesson · Coding round

The 3 Splunk problems are below.

1. 1A Premium questionCoding · Medium
2. 2A Premium questionCoding · Medium
3. 3A Premium questionCoding · Easy

Each with hints, the follow-up and a tested solution.

Get the Splunk questions

$49 a year · all 100 companies · cancel anytime

From 20,000+ candidate reports, forum threads behind logins and write-ups in Chinese.

Read a free Splunk lesson firstAlready a member? Sign in