SPLK-1002 Practice Test 1 — 10 Questions

Question 1

In the CIM, which field is commonly used to identify the user responsible for an authentication event?

Accepted Answer

user. In the CIM Authentication data model, the 'user' field represents the user who is the subject of the authentication event — the account being authenticated. This is the standard field for identifying the responsible user in login, logout, and failed authentication events. It is distinct from src_user, which represents the user who initiated the action on behalf of another user.

Answer

dest

Answer

src_user

Answer

src

Question 2

When creating a saved search that runs every hour and sends an email alert when the count of errors exceeds 10, which action must be configured in addition to the search logic?

Accepted Answer

Add an email alert action in the saved search settings.. Saved searches that trigger alerts require at least one alert action (e.g., email) to be defined in the saved search settings. Option B is incorrect because the `| alert` command is not used in search strings for saved search alerts. Option C is incorrect because a lookup table is not required for alerting. Option D is incorrect because summary indexing is unrelated to sending email alerts.

Answer

Include '| alert' command in the search string.

Answer

Create a lookup table to store error counts.

Answer

Enable summary indexing for the search.

Question 3

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

Accepted Answer

... | sort date | streamstats sum(sales) as running_total. It first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Answer

... | eval running_total = running_sum(sales)

Answer

... | eventstats sum(sales) as running_total

Answer

... | stats sum(sales) by date

Question 4

A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?

Accepted Answer

They are split into separate transactions because the gap exceeds maxpause.. The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.

Answer

They are merged because maxpause is 5s but maxspan is 30s, so the 10s gap is within maxspan.

Answer

They are considered part of the same transaction as long as total span ≤ 30s.

Answer

They are split only if the total span exceeds maxspan.

Question 5

Refer to the exhibit. What is the purpose of the eval command in this search?

Accepted Answer

It creates a new field 'status_category' based on the numeric status code, grouping into three categories.. The eval command creates a new field 'status_category' by evaluating a CASE expression that maps numeric HTTP status codes (e.g., 200, 404, 500) into three descriptive categories: 'OK', 'Client Error', and 'Server Error'. This is a common pattern for enriching raw data with human-readable labels without altering the original 'status' field. The correct answer is D because the search explicitly defines the new field based on the status code values.

Answer

It replaces the status field with the category.

Answer

It adds a temporary field that is not retained after stats.

Answer

It converts the status field to a string.

Question 6

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 7

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

Accepted Answer

0 10 8-14 * 5. The cron expression '0 10 8-14 * 5' fires at 10:00 AM on day-of-week 5 (Friday) but only when the day-of-month is between 8 and 14 — which is exactly the second Friday of the month. This is the standard way to express 'second Friday' in cron, since the second Friday always falls on days 8-14. The other fields (minute 0, hour 10, any month) complete the schedule.

Answer

0 10 * * 5

Answer

0 10 */2 * *

Answer

0 10 * * *

Question 8

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Accepted Answer

The original number of events is preserved.. Option A is correct because eventstats enriches each original event with the computed aggregate values rather than collapsing the result set, so the original number of events is preserved. Option C is correct because the aggregated fields produced by eventstats are added to each event and can therefore be referenced in later commands such as where, eval, or sort. Option E is correct because, since each event retains its own fields plus the aggregate values, you can inspect individual event details alongside the aggregate statistics. Option B is incorrect because eventstats generally consumes more memory than stats, since it must retain and enrich every event instead of reducing them to aggregate rows. Option D is incorrect because eventstats is not always faster than stats; it typically performs additional work to attach aggregates to each event, so performance depends on the search.

Answer

It uses less memory than stats.

Answer

It is always faster than stats.

Question 9

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.

Question 10

An analyst is using the transaction command to group events by a field that has high cardinality (millions of unique values). The search is taking too long and consuming too much memory. Which approach should be taken to improve performance?

Accepted Answer

Reduce the cardinality of the field by using a derived field with fewer values.. The transaction command groups events by a field, and high cardinality (millions of unique values) forces Splunk to maintain millions of separate transaction groups in memory, causing excessive memory use and slow performance. Reducing the cardinality of the grouping field — for example, by deriving a lower-cardinality field — directly reduces the number of transaction groups and the memory footprint.

Answer

Use the 'maxspan' option to narrow the time window.

Answer

Use the 'mvlist' option to reduce field storage.

Answer

Use the 'maxevents' option to limit number of events per transaction.