SPLK-1002 Practice Test 11 — 15 Questions

Question 1

A team uses a lookup to enrich web logs with customer region. The lookup is file-based and updated daily. Some events are not being enriched even though the lookup file has matching keys. What could be the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The lookup file has leading or trailing spaces in key fields.. File-based lookups in Splunk match on exact string equality between the lookup key field and the event field. If the CSV contains values like 'North America ' (with a trailing space) or ' North America', the match against the event value 'North America' silently fails, so those events are not enriched. This is the classic cause of partial enrichment when the lookup file visibly contains the key.

Answer

The lookup file exceeds the maximum size.

Answer

The lookup file is not sorted.

Answer

The lookup definition uses the wrong timestamp format.

Question 2

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

Accepted Answer

Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately. The `transaction` command is resource-intensive and can cause timeouts and missing data when `maxevents` is exceeded. Increasing `maxevents` (A) would worsen performance. Removing `maxpause` and increasing `maxspan` (B) does not address the `maxevents` limit and may keep transactions open longer. Reducing `maxevents` (C) would exacerbate missing orders. Replacing `transaction` with `stats ... list() by order_id` groups fields without holding open transactions, avoiding the `maxevents` constraint and reducing resource usage, thus addressing both missing orders and performance issues.

Answer

Increase maxevents to 200 and increase search timeout

Answer

Remove maxpause and set maxspan to 60m

Answer

Reduce maxevents to 10 to limit resource usage

Question 3

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

Accepted Answer

Time-based lookup. A time-based lookup in transforms.conf uses the 'time_field', 'time_format', and 'max_offset_secs' settings to match an event's timestamp against the valid_from and valid_to fields in the lookup table, returning the row whose time range contains the event time. This is exactly the mechanism needed for a price table that changes over time, because a standard CSV lookup would only match on key fields and ignore the temporal validity window.

Answer

CSV lookup

Answer

KV Store lookup

Answer

External lookup

Question 4

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 5

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

Accepted Answer

maxevents. The maxevents parameter in the transaction command limits the maximum number of events that can be included in a single transaction. Setting it to a lower value prevents transactions from growing too large and consuming excessive memory.

Answer

maxspan

Answer

maxpause

Answer

mvcount

Question 6

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Accepted Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`. It uses the `stats` command to compute the average duration and count per user in a single pass, then filters with `where` to enforce both conditions: average duration > 100 and event count > 5. This is the standard pattern for per-user aggregation followed by post-aggregation filtering in Splunk.

Answer

`... | where avg(duration)>100 | stats count by user | where count>5`

Answer

`... | top user limit=0 | where avg(duration)>100`

Answer

`... | eventstats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`

Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | having avg_dur>100 and cnt>5`

Question 7

A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?

Accepted Answer

The search is not scheduled or set to 'Auto' for the panel.. The single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.

Answer

The 'Token delay' is too high.

Answer

The time range picker is set to 'All time'.

Answer

The dashboard's 'Auto-refresh' interval is not set.

Question 8

Which SPL command can be used to create a new field based on a conditional evaluation, such as setting a status field to 'critical' if a numeric threshold is exceeded?

Accepted Answer

| eval status=if(value>100,"critical","normal"). The `eval` command in SPL is used to create new fields or modify existing ones by evaluating expressions. The `if()` function within `eval` allows conditional logic, making `| eval status=if(value>100,"critical","normal")` the correct syntax to create a new field 'status' that is set to 'critical' when the numeric field 'value' exceeds 100, and 'normal' otherwise.

Answer

| makemv

Answer

| rex field=_raw

Answer

| convert status=if(value>100,"critical","normal")

Question 9

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

Accepted Answer

Remove endswith and add maxspan=30m. To include incomplete sessions without an 'session_end' event, remove the `endswith` clause and add a `maxspan` time limit. This ensures that transactions are automatically closed after the specified time (30 minutes) if no end event is encountered. The `startswith` clause remains to initiate transactions only on 'session_start' events. Option B correctly implements this: `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m`. This way, sessions that timeout are still captured as transactions.

Answer

Add `maxspan=30m` and keep endswith

Answer

Change startswith to `action=session_start OR action=session_end`

Answer

Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith

Question 10

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. The error indicates that Splunk cannot find the lookup definition named [geo_lookup], which is defined in transforms.conf. A lookup definition must exist in transforms.conf (referencing the CSV in lookups/) before it can be used in a search; if the stanza is missing or misnamed, Splunk throws an error about the lookup definition not being found. The file itself may exist, but without the transforms.conf stanza the definition is unavailable.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 11

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Accepted Answer

Filter events before the transaction command.. Option A is correct because filtering events with a search or where clause before the transaction command means fewer events enter the transaction state, directly lowering the memory the command must hold. Option B is correct because maxspan and maxpause bound how far apart and how long events can be grouped; smaller values cause transactions to close sooner, so fewer events are retained in memory at once. Option C is correct because using fields (or table) to keep only the needed fields before transaction reduces the per-event payload stored in memory, cutting overall memory usage. Option D is not correct because keepevicted=true retains evicted (incomplete) transactions, which increases rather than reduces memory consumption. Option E is not correct because increasing maxopentxn allows more concurrently open transactions, which raises memory usage instead of lowering it.

Answer

Use keepevicted=true.

Answer

Increase maxopentxn.

Question 12

Which THREE statements about the `transaction` command are true?

Accepted Answer

It can correlate events from different sourcetypes. Option A is correct because the transaction command groups events into transactions based on fields or time constraints regardless of sourcetype, so events from different sourcetypes can be correlated into the same transaction. Option C is correct because transaction sorts the events within each transaction by the _time field, presenting them in chronological order. Option D is correct because transaction operates on search results that can span multiple indexes, allowing correlation of events across indexes as long as they share the grouping criteria. Option B is incorrect because maxevents limits the maximum number of events in a transaction, not the number of unique field values. Option E is incorrect because transaction does not automatically produce summary indexing output; summary indexing requires separate mechanisms such as the collect command or scheduled searches.

Answer

The maxevents option limits the number of unique field values per transaction

Answer

Transaction always produces summary indexing output

Question 13

A search is producing results that include both internal and external traffic. The analyst wants to approximate the number of distinct destination IPs for internal traffic only, where internal IPs fall within the 10.0.0.0/8 range. Which approach is most efficient?

Accepted Answer

Use | where cidrmatch("10.0.0.0/8", src_ip) | stats dc(dest_ip). It uses `where cidrmatch("10.0.0.0/8", src_ip)` to efficiently filter events to only those with source IPs in the 10.0.0.0/8 range before passing them to `stats dc(dest_ip)`. This approach leverages Splunk's built-in CIDR matching function, which performs a bitwise comparison on the IP address, and applies the filter early in the pipeline, reducing the dataset for the distinct count operation. It is the most efficient as it avoids unnecessary evaluations or string operations on non-matching events.

Answer

Use | search src_ip=10.* | stats dc(dest_ip)

Answer

Use | rex field=src_ip to extract first octet and then filter

Answer

Use | eval internal=if(cidrmatch("10.0.0.0/8", src_ip),1,0) | stats dc(dest_ip) by internal

Question 14

An analyst observes that a lookup command with a large lookup file is causing the search to timeout. The lookup is used to extract additional fields based on a field value. What is the most effective immediate solution?

Accepted Answer

Reduce the lookup file size by removing unused columns or rows.. The most effective immediate fix for a lookup-induced search timeout is to reduce the lookup file's size by removing unused columns and rows, which directly decreases the memory and CPU the lookup consumes during the search. Splunk loads the lookup into memory (or streams it) and matches each event against it, so a smaller file means faster matching and lower resource usage. This addresses the root cause rather than masking the symptom.

Answer

Change the match_type to WILDCARD to be more flexible.

Answer

Use the inputlookup command to load the entire table.

Answer

Increase the search timeout in limits.conf.

Question 15

Which TWO of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Upload a CSV file through the Splunk Web interface. Splunk Web provides a direct interface to upload a CSV file and define it as a lookup table, automatically creating the lookup definition and file. Option D is correct because the `outputlookup` command in a search writes search results to a CSV file in the lookups directory, effectively creating a lookup table from dynamic data.

Answer

Use the eval command to create a lookup definition

Answer

Use the stats command to aggregate data into a lookup

Answer

Use the inputlookup command in a search