SPLK-1002 Practice Test 10 — 10 Questions

Question 1

A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.. 'Alert suppression' with the setting 'Suppress if results are the same as the previous search' directly addresses the requirement to avoid alert fatigue when the number of failed logins is unchanged. Option A, 'Alert throttling', limits the frequency of alerts based on a time interval or field values, not comparison of result sets. Option C's throttle field is typically for throttling per field value, not condition-based suppression. Option D's severity and delay do not suppress based on result comparison.

Answer

Enable 'Alert throttling' based on the 'src' field.

Answer

Set the 'Throttle' field to suppress alerts for a specified time window.

Answer

Configure 'Alert severity' to low and set a delay.

Question 2

Match each Splunk search command to its primary function.

Accepted Answer

eval: Evaluate expressions and assign to new fields. These are common Splunk search commands used for data manipulation and enrichment.

Answer

eval: Extract fields using regular expressions

Answer

stats: Enrich events with data from external sources

Question 3

A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?

Accepted Answer

user=admin OR user=root. Using unquoted field comparisons with the OR operator performs an exact match for simple values like 'admin' and 'root'. In Splunk, when field values do not contain spaces or special characters, unquoted values are treated as exact match tokens. Therefore, `user=admin OR user=root` will retrieve events where the user field is exactly 'admin' or 'root'. Option A is also valid but less concise. Option B uses wildcards, matching any occurrence, not exact. Option C uses the IN operator, which is another exact match method, but option D is equally correct and often considered more straightforward for this simple case.

Answer

user="admin" OR user="root"

Answer

user=*admin* OR user=*root*

Answer

user IN ("admin", "root")

Question 4

A user needs to identify the top 3 error types by count, but only for the current month, and exclude results with fewer than 100 occurrences. Which TWO steps are necessary? (Select two.)

Accepted Answer

Use the where command to filter count>=100. The `where` command in Splunk is used to filter results based on a condition, and here it is needed to exclude error types with fewer than 100 occurrences after counting. Option D is correct because the `top` command with `limit=3` returns the top 3 values of a field by count, which directly satisfies the requirement to identify the top 3 error types.

Answer

Use the time range picker to set 'Current Month'

Answer

Use the search command with earliest and latest

Answer

Use the time command with relative time modifiers

Question 5

A user has created a dashboard panel using a 'chart' command with 'datacount by host'. The chart shows counts per host, but the hosts appear in alphabetical order. The user wants to sort the chart by count descending, so that the host with the most events appears first. The search is: index=main sourcetype=access | chart count by host. The dashboard is built using Simple XML. Which approach should be used to achieve the desired sorting?

Accepted Answer

Add '| sort -count' after the chart command in the search.. Adding '| sort -count' after the chart command sorts the results by count in descending order, making the host with the most events appear first. Option A is incorrect because the 'top' command produces a different table format (with count and percent fields) and is not appropriate if the desired output is a chart. Option B is incorrect because 'eventstats' adds a statistical field to events but does not replace the chart command or sort the results; it would require additional steps. Option D is incorrect because the Simple XML chart properties panel does not include a sorting option for chart data; sorting must be performed within the search itself.

Answer

Use the 'top' command instead of 'chart' to automatically sort by count.

Answer

Use 'eventstats' to compute counts and then sort by count.

Answer

Use the chart properties panel in the dashboard editor to set sorting by count descending.

Question 6

Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?

Accepted Answer

The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.. The `maxspan` parameter in the transaction command sets an upper limit on the total duration of the transaction from the first to the last event, regardless of the `maxpause` setting. With `maxspan=30m` (1800 seconds), a transaction can have a total duration up to 1800 seconds, even if individual gaps between events exceed `maxpause=5m` (300 seconds). The `maxpause` only limits the idle time between consecutive events, not the overall span, so transactions with gaps larger than 300 seconds but within the 1800-second span are still valid.

Answer

The transaction command is including events that are more than 5 minutes apart because the maxpause is ignored when maxspan is set.

Answer

The eventcount field is inflated, causing duration to be calculated incorrectly.

Answer

The duration field represents milliseconds, so 600 seconds is actually 0.6 seconds.

Question 7

Which TWO are valid methods to join data from a CSV file in a Splunk search?

Accepted Answer

`| lookup myfile.csv`. The `| lookup` command can reference a CSV file defined as a lookup table in Splunk, allowing field-based enrichment of search results. This is a standard method for joining data from a CSV file within a search, provided the lookup is properly configured in transforms.conf and props.conf.

Answer

`| append myfile.csv`

Answer

`| join myfile.csv`

Answer

`| csvlookup myfile.csv`

Question 8

A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?

Accepted Answer

index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip). It uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.

Answer

index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8

Question 9

Refer to the exhibit. This search returns an error. What is the most likely cause?

Accepted Answer

The timechart command requires a _time field which is not present after stats. The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Answer

The eval command cannot be used before timechart

Answer

The status_group field is not available after timechart because it was created in eval

Answer

The stats command aggregates data, so timechart cannot use the aggregated count field

Question 10

Which TWO of the following are true about the `transaction` command? (Choose 2)

Accepted Answer

It groups events that share common field values and occur within a specified time window.. The `transaction` command groups events that share common field values (specified by the `by` clause when used) and that occur within a specified time window, typically set by `maxspan` or using the default span. Option E is correct because the `maxpause` option defines the maximum allowed time gap between consecutive events in the same transaction; if the gap exceeds `maxpause`, a new transaction is started. Option C is incorrect because the `by` clause is not mandatory; without it, the command groups all events into a single transaction, which can be useful in certain scenarios. Options A and B are incorrect as originally stated.

Answer

Transactions can be started based on a specific field value using the `startswith` option.

Answer

It outputs one event per input event, adding duration and eventcount fields.

Answer

The `by` clause is mandatory to define how to group events.