SPLK-1003 Practice Test 4 — 10 Questions

Question 1

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

Accepted Answer

The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.. The `search stage="*"` command filters out all transactions because `stage` is a multivalue field created by the `transaction` command. In Splunk, a multivalue field cannot be matched with a simple wildcard search like `stage="*"`; this search only returns events where `stage` is a single literal asterisk. To search for any value in a multivalue field, you must use `mvcount(stage)>0` or `search stage=*` (without quotes).

Answer

The transaction should group by user instead of src.

Answer

The case statement does not set stage for events that don't match either pattern.

Answer

The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.

Question 2

A Splunk administrator is troubleshooting a search that uses the `transaction` command. The search is taking too long to complete and returning incomplete results. Which TWO changes are most likely to improve performance and accuracy of transaction searches? (Choose TWO.)

Accepted Answer

Use `fields` before `transaction` to include only necessary fields.. Option C is correct because using the `fields` command before `transaction` reduces the amount of data Splunk must process by retaining only the fields necessary for correlation and output. This minimizes memory and CPU overhead, directly improving search performance and reducing the risk of incomplete results due to resource limits.

Answer

Remove the `maxspan` parameter to allow transactions of any duration.

Answer

Use `mvcombine` to combine multivalued fields before the transaction.

Answer

Increase the `maxevents` value to allow more events per transaction.

Question 3

A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search:

`index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200`

This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?

Accepted Answer

The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.. Option D is correct because the `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.

Answer

The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.

Answer

The search lacks a `fields` command to include `user_id`, so the transaction fails.

Answer

The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.

Question 4

Match each Splunk component to its function.

Question 5

Match each Splunk knowledge object to its purpose.

Question 6

Match each Splunk search operator to its behavior.

Question 7

Match each Splunk index time field to its meaning.

Question 8

Match each Splunk search mode to its behavior.

Question 9

Match each Splunk report type to its description.

Question 10

Match each Splunk license violation type to its consequence.

SPLK-1003 Practice Test 4 — 10 Questions

Exhibit

SPLK-1003 Practice Test 4 — 10 Questions

Exhibit