SPLK-1002 Practice Test 1 — 10 Questions

Question 1

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Accepted Answer

... | map search="search index=other $field$". The `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Answer

... | join type=inner [search index=other]

Answer

[return index=main | stats count]

Question 2

A user runs a search that returns 1,000,000 results but only sees 5,000 in the Statistics tab. What is the most likely cause?

Accepted Answer

The stats command is being used without a by clause. The stats command without a 'by' clause aggregates all events into a single row (or by whatever field specified). If no 'by' clause, it returns one row per aggregation, so a small number of rows. Option A is wrong because the search command truncates at 50,000 results by default. Option C is wrong because time range narrowness would reduce raw events, but here stats shows few rows. Option D is wrong because sampling is not a default behavior.

Answer

The results are being sampled

Answer

The time range is too narrow

Answer

The search command truncates results

Question 3

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Accepted Answer

Time-based lookup. Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Answer

File lookup

Answer

CSV lookup

Answer

External lookup

Question 4

What is the purpose of an automatic lookup?

Accepted Answer

To automatically apply a lookup to events based on a source type or index at search time.. An automatic lookup is configured in transforms.conf or props.conf to automatically apply a lookup table to events based on sourcetype or index at search time. This enriches events with additional fields without requiring the lookup command in the search. Option A is incorrect because automatic lookups do not validate field names; validation must be done separately. Option B describes the outputlookup command, which writes to a lookup file. Option C is incorrect because automatic lookups do not create tables from search results; that is done by the inputlookup or outputlookup commands. Option D correctly describes the purpose of an automatic lookup.

Answer

To automatically validate lookup field names.

Answer

To automatically update a lookup file when the CSV changes.

Answer

To automatically create a lookup table from search results.

Question 5

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. The error 'Could not find lookup table' indicates that Splunk cannot find a lookup definition named 'geo_lookup' in transforms.conf. This is the most likely cause because the lookup definition (stanza) is missing or misconfigured. If the file geo.csv were missing but the definition existed, the error would mention 'file not found'. Permission errors produce a different message, and a misspelled field would not cause this error. Therefore, option A is correct.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 6

In a dashboard panel, a table shows event counts by source. The user wants to click on a sourcetype to drill down to a new search showing all events from that source. Which token-based drilldown approach is correct?

Accepted Answer

Set a drilldown action to 'search' with a search string containing $row.sourcetype$.. Using $row.sourcetype$ in a drilldown search string passes the clicked value dynamically. Option A is wrong because custom JavaScript is unnecessary and not the recommended token-based approach. Option B is wrong because 'form' action submits form inputs, not simply a token with the clicked value. Option C is wrong because a static link URL cannot dynamically pass the clicked sourcetype.

Answer

Use a custom JavaScript to navigate.

Answer

Set a drilldown action to 'form' and submit the token.

Answer

Set a drilldown action to 'link' with a URL that includes the sourcetype.

Question 7

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

Accepted Answer

Use a subsearch with the IN operator instead. Replacing a `map` command with a subsearch using the `IN` operator allows Splunk to retrieve all matching field values in a single search pass, rather than executing a separate search for each value. The `map` command runs one search per input row, which can cause significant overhead and slow performance, especially with large result sets. Using `IN` in a subsearch collects the values first and then applies them as a filter in the outer search, reducing the number of search operations to one.

Answer

Use the sort command

Answer

Use the transaction command

Answer

Use the foreach command to loop over fields

Question 8

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 9

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Accepted Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`. It uses the `stats` command to compute the average duration and count per user in a single pass, then filters with `where` to enforce both conditions: average duration > 100 and event count > 5. This is the standard pattern for per-user aggregation followed by post-aggregation filtering in Splunk.

Answer

`... | where avg(duration)>100 | stats count by user | where count>5`

Answer

`... | top user limit=0 | where avg(duration)>100`

Answer

`... | eventstats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`

Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | having avg_dur>100 and cnt>5`

Question 10

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields