SPLK-1003 Practice Test 10 — 10 Questions

Question 1

Refer to the exhibit. An analyst executes the following search: `| filter_status(status_code=500)`. What will be the result?

Accepted Answer

The macro will fail because named arguments are not supported; Splunk macro arguments are positional.. Option D is correct because Splunk macros do not support named arguments; they use positional arguments defined by $arg1$, $arg2$, etc. In the search `| filter_status(status_code=500)`, the argument is passed as a named key-value pair, but the macro definition expects a positional argument. This mismatch causes the macro to fail, as Splunk cannot resolve the named argument to the positional placeholder.

Answer

The macro will run successfully, but it will use the literal string "status_code=500" as the argument value.

Answer

The macro will fail because the argument definition uses $arg1$ but the macro was called with "status_code=500".

Answer

The macro will run successfully, returning count of events with status=500.

Question 2

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

Accepted Answer

Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.. Option C is correct because using stats with values and filtering with where is less resource-intensive than transaction. Transaction holds all events in memory until the transaction closes, which is especially problematic with many events. Stats operates as a streaming command and uses less memory. Option A is incorrect because increasing maxpause would allow more events per transaction, making performance worse. Option B is incorrect because append does not correlate events by source IP; it simply combines results. Option D is incorrect because the default maxevents is already 1000, and increasing it would not help if the transaction is timing out due to memory or time limits.

Answer

Use the append command to combine the two event types after separate searches.

Answer

Add maxevents=1000 to the transaction command to limit event count.

Answer

Increase maxpause to 10 minutes to allow more events per transaction.

Question 3

A search uses the transaction command with maxevents=1000 and maxspan=1h. The search is slow and memory-intensive. Which modification can reduce resource usage while still grouping related events?

Accepted Answer

Reduce maxevents to 100.. Reducing maxevents to 100 limits the number of events that the transaction command groups into a single transaction, which directly reduces memory consumption and processing overhead. This modification still allows related events to be grouped together, but with a smaller batch size, making the search less resource-intensive while preserving the core grouping logic.

Answer

Use eventstats with a time window.

Answer

Use tstats instead of transaction.

Answer

Increase maxspan to 2h.

Question 4

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

Accepted Answer

Add a time range to the main search.. The exhibit shows a transaction command that groups events by a session field, but without a time range, the search must scan all indexed data, which is extremely slow. Adding a time range (e.g., earliest=-1h) limits the data scanned, drastically improving performance while still allowing the transaction to complete within the default maxpause of 5s.

Answer

Change maxpause to 30s.

Answer

Remove the eval command.

Answer

Replace transaction with stats and use values() for fields.

Question 5

A security analyst wants to find IP addresses that have attempted to access a specific URL more than 5 times in the last hour and also have a user agent string containing "curl". They need to use a subsearch to pre-filter IPs. Which search is correct?

Accepted Answer

index=web sourcetype=access [search useragent=*curl* | stats count by src_ip | where count>5 | fields src_ip] | stats count by src_ip | where count>5. Option B is correct because it uses a subsearch to first find IPs that have accessed the URL more than 5 times with a user agent containing 'curl', then passes those IPs to the outer search to filter the original data. The subsearch returns a list of src_ip values, which the outer search uses as a filter, ensuring only IPs meeting both conditions are counted again. This matches the requirement to pre-filter IPs using a subsearch.

Answer

[search index=web sourcetype=access useragent=*curl* | stats count by src_ip | where count>5] | fields src_ip

Answer

index=web sourcetype=access | search useragent=*curl* | stats count by src_ip | where count>5

Answer

index=web sourcetype=access ( useragent=*curl* ) | stats count by src_ip | where count>5

Question 6

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Accepted Answer

The field `uri_path` does not exist or contains data that does not match the pattern.. The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.

Answer

The stats command cannot be used after rex.

Answer

The search time range is too short to include any events.

Answer

The regex pattern is incorrectly written.

Question 7

An analyst wants to remove events that contain the string 'debug' from a log. Which command should be used?

Accepted Answer

| search NOT debug. Option D is correct because the `| search NOT debug` command filters out all events containing the string 'debug' from the result set. In Splunk, the `NOT` operator before a search term excludes events that match that term, effectively removing them from the output. This is the standard way to exclude a specific string from search results.

Answer

| where NOT match(_raw,"debug")

Answer

| search debug | reverse

Answer

| search "debug" NOT

Question 8

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

Accepted Answer

eval domain=mvindex(split(email,"@"),1). Option A is correct because `split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Answer

eval domain=mvindex(split(email,"@"),0)

Answer

eval domain=replace(email,".*@(.*)","\1")

Answer

eval domain=substr(email, indexof(email,"@")+1)

Question 9

Which TWO of the following are valid aggregation functions in the `stats` command? (Choose 2)

Accepted Answer

earliest. The `stats` command in Splunk supports `earliest()` as an aggregation function that returns the earliest value of a field for each group. Option C is correct because `earliest()` is a valid stats function that retrieves the first occurrence of a field value within the search results, based on the order of events.

Answer

median

Answer

sum

Answer

distinct_count

Answer

last

Question 10

An administrator notices that a search using the timechart command returns data for every 15-minute bucket even when no events exist, creating many null values. How can this behavior be suppressed?

Accepted Answer

Use timechart cont=false. Option D is correct: cont=false suppresses continuous time bins, showing only buckets with data. Option A (limit=0) affects number of series, not gaps. Option B (usenull=f) is not a valid timechart option. Option C (partial=false) controls partial buckets at edges.

Answer

Use timechart limit=0

Answer

Use timechart usenull=f

Answer

Use timechart partial=false

SPLK-1003 Practice Test 10 — 10 Questions

Exhibit

SPLK-1003 Practice Test 10 — 10 Questions

Exhibit