SPLK-1002 Practice Test 10 — 10 Questions

Question 1

Order the steps to create a data model in Splunk in the correct order.

Accepted Answer

Step 1: Create a new data model. Step 2: Add a root event type. Step 3: Define constraints for the event type. Step 4: Add fields to the event type.. Data models are created by defining hierarchical objects with constraints and fields.

Answer

Step 1: Add a root event type. Step 2: Create a new data model. Step 3: Define constraints. Step 4: Add fields.

Answer

Step 1: Create a new data model. Step 2: Define constraints. Step 3: Add a root event type. Step 4: Add fields.

Answer

Step 1: Create a new data model. Step 2: Add a root event type. Step 3: Add fields. Step 4: Define constraints.

Question 2

Which TWO options can be used with the `transaction` command to define the beginning and end of a transaction?

Accepted Answer

endswith. The `transaction` command in Splunk groups events into transactions, and its `startswith` and `endswith` arguments explicitly define the beginning and end of each transaction: `startswith` specifies the search term or field value that marks the first event, while `endswith` specifies the term or value that marks the final event, so options D and C are correct. These two options work together to bound a transaction by matching events, which is exactly what the question asks for. The other options do not define transaction boundaries: `maxpause` (B) sets the maximum time between events for them to remain in the same transaction, `maxspan` (E) limits the total duration of a transaction, and `closed_txn` (A) is not a valid `transaction` command argument.

Answer

closed_txn

Answer

maxpause

Answer

maxspan

Question 3

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

Accepted Answer

Multiple transactions, each with fewer events, avg duration less than 10s. The search uses `transaction` with `maxspan=10s`. The random timestamps are spread over up to 100 seconds, so events that are more than 10 seconds apart cannot be in the same transaction. Thus, the events will be split into multiple transactions, each containing a subset of the events. The average duration of these transactions will be well under 10 seconds, making option C correct. Option A is incorrect because not all 5 events can fit into one 10-second window. Option B is incorrect for the same reason. Option D is incorrect because transactions are still created for events that do fall within a 10-second window.

Answer

One transaction with 5 events, avg duration ~50s

Answer

One transaction with 5 events, avg duration ~10s

Answer

No transactions created because events are out of order

Question 4

Which THREE of the following are required steps to properly schedule a saved search for summary indexing that runs a macro?

Accepted Answer

The summary index must be created before the search runs.. Option A is correct because summary indexing writes results into a pre-existing summary index, so the target index must be created (via Settings > Indexes or indexes.conf) before the scheduled search executes. Option B is correct because a saved search only runs automatically when a schedule (cron expression or interval) is configured on it; without a schedule, no summary indexing occurs. Option E is correct because the macro invoked by the search must be visible in the search's execution context — i.e., it must be a global macro or defined in the app whose context the saved search runs under — otherwise the search fails to resolve the macro. Option C is wrong because Splunk does not auto-create a summary index; the index must exist beforehand. Option D is wrong because the macro need not be in the same app as the saved search; it only needs to be accessible from the search's context, which can be achieved via a global macro or proper app context.

Answer

The summary index is automatically created when the search runs.

Answer

The macro must be defined in the same app as the saved search.

Question 5

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

Accepted Answer

where mvindex(action,0)="login" AND mvindex(action,-1)="logout". The [CORRECT] answer uses mvindex(), which is the Splunk multivalue function designed to retrieve a specific element from a multivalue field by its position. In Splunk's transaction command, the action field becomes a multivalue field where events are ordered chronologically, so mvindex(action, 0) returns the first event's action and mvindex(action, -1) returns the last event's action (negative indices count from the end). This correctly filters transactions where the first event is 'login' and the last is 'logout'.

Answer

where action[0]="login" AND action[-1]="logout"

Answer

where first(action)="login" AND last(action)="logout"

Answer

where action="login" AND action="logout"

Question 6

Which TWO of the following statements about the 'stats' command are true?

Accepted Answer

It can be used with a BY clause to group results.. The 'stats' command in Splunk supports a BY clause that allows you to group results by one or more fields, similar to a SQL GROUP BY. This enables you to compute aggregate statistics (e.g., count, sum, avg) for each distinct value of the specified field(s), which is a core feature for summarizing event data.

Answer

The count() function must always include a field argument.

Answer

It creates one event per input event by default.

Answer

It can be used to modify individual field values in raw events.

Question 7

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

Accepted Answer

keepevicted=true. The transaction command in Splunk discards partial (evicted) transactions by default, meaning any transaction that exceeds maxspan, maxpause, or maxevents is dropped from the results. Setting keepevicted=true preserves these evicted transactions in the output so they can still be analyzed. Since the question states the partial transactions are relevant and should not be discarded, keepevicted=true is the correct addition.

Answer

keepopen=true

Answer

closed=true

Answer

partial=true

Question 8

Refer to the exhibit. What is the purpose of this configuration?

Accepted Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.. The configuration shown is a saved transaction definition in Splunk's transactiontypes.conf (or defined via Settings > Transaction types). It specifies fields (clientip, userid) and time parameters (maxspan, maxpause, etc.) that will be applied when the transaction type is invoked by name in a search using `transaction mytransaction`. This allows reusable, consistent grouping logic without retyping parameters each time.

Answer

It creates a search-time field extraction for clientip and userid.

Answer

It configures the transaction command to run automatically on all data.

Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.

Question 9

What type of visualization is produced by the pie command?

Accepted Answer

A pie chart.. The pie command in Splunk transforms search results into a format suitable for a pie chart visualization. It calculates the sum of a specified field for each distinct value of another field and outputs the data in a structure that the pie chart renderer expects. By default, it produces a pie chart when the results are visualized.

Answer

A bar chart.

Answer

A scatter chart.

Answer

A line chart.

Question 10

The following search is executed:
index=web
| rex "GET (?<url>.*)"
| eval category=case(url="/api/v1/data","API", url="/login","Login",1=1,"Other")
| stats count by category

But it returns unexpected results: the count for 'API' is much lower than expected. What is the most likely cause?

Accepted Answer

The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'.. The regex 'GET (?<url>.*)' is greedy and captures everything after 'GET ' to the end of the line, including the HTTP version (e.g., 'HTTP/1.1'). So url becomes '/api/v1/data HTTP/1.1' instead of '/api/v1/data', and the case() comparison url="/api/v1/data" fails, dumping those events into 'Other' and undercounting API.

Answer

The stats command should use 'count by category' but category is not a field until after eval.

Answer

The case function has a default condition '1==1' that overrides all other conditions.