SPLK-1002 Practice Test 11 — 15 Questions

Question 1

Which command creates a time-based chart showing a count of events over time?

Accepted Answer

| timechart count. `timechart count` is the correct command for a time-based chart of event count. The `timechart` command automatically buckets by `_time`, so `by _time` is unnecessary and invalid as a timechart split-by field. `chart count over _time` is not a timechart command, and `timecount` is not a valid Splunk command.

Answer

| timecount

Answer

| timechart count by _time

Answer

| chart count over _time

Question 2

An administrator wants to correlate events from the same session but the events span up to 30 minutes apart. The transaction command is being considered. Which transaction option is most appropriate to ensure sessions are correctly grouped without artificially high memory usage?

Accepted Answer

| transaction sessionid maxspan=30m maxpause=5m. The `maxspan=30m` ensures events spanning up to 30 minutes are grouped into the same transaction, while `maxpause=5m` prevents the transaction from remaining open indefinitely by closing it after 5 minutes of inactivity. This combination correctly groups sessions without keeping the transaction open for the full 30 minutes, which would artificially increase memory usage by holding events in the buffer.

Answer

| transaction sessionid maxspan=30m

Answer

| transaction sessionid maxevents=100

Answer

| transaction sessionid maxspan=30m keepevicted=true

Question 3

Arrange the steps to configure role-based access control in Splunk.

Accepted Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role or edit an existing one. Step 3: Enter a role name. Step 4: Assign desired capabilities (e.g., search, index). Step 5: Set index restrictions and other resource access. Step 6: Click 'Save'.. The correct sequence for configuring role-based access control in Splunk involves first creating or editing a role under Settings > Access Controls > Roles, then assigning capabilities (such as search and index management), followed by setting resource restrictions like index access, and finally saving. This ensures the role is fully defined before being assigned to users. Common mistakes include mixing up the order of capabilities and index restrictions, or mistakenly starting with user assignment.

Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role. Step 3: Enter a role name. Step 4: Set index restrictions first. Step 5: Then assign capabilities. Step 6: Click 'Save'.

Answer

Step 1: Navigate to Settings > Access Controls > Users. Step 2: Assign a role to an existing user. Step 3: Go to Roles and edit the role's capabilities. Step 4: Set index restrictions. Step 5: Save the role.

Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role. Step 3: Enter a role name. Step 4: Assign capabilities. Step 5: Click 'Save'. Step 6: Later, return to edit the role to add index restrictions.

Question 4

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

Accepted Answer

Multiple transactions, each with fewer events, avg duration less than 10s. The search uses `transaction` with `maxspan=10s`. The random timestamps are spread over up to 100 seconds, so events that are more than 10 seconds apart cannot be in the same transaction. Thus, the events will be split into multiple transactions, each containing a subset of the events. The average duration of these transactions will be well under 10 seconds, making option C correct. Option A is incorrect because not all 5 events can fit into one 10-second window. Option B is incorrect for the same reason. Option D is incorrect because transactions are still created for events that do fall within a 10-second window.

Answer

One transaction with 5 events, avg duration ~50s

Answer

One transaction with 5 events, avg duration ~10s

Answer

No transactions created because events are out of order

Question 5

A security analyst needs to monitor failed login attempts across multiple Windows domain controllers. The environment has a custom sourcetype 'WinEventLog:Security' and the data is indexed under 'windows_security'. The analyst wants to create a saved search that runs every 10 minutes, searches for EventCode 4625 (failed logon), and triggers an alert if more than 10 failures occur from the same source IP within the last 10 minutes. The saved search should use the Common Information Model (CIM) to ensure compatibility with other security apps. Which of the following saved search definitions best meets these requirements?

Accepted Answer

`| from datamodel:Authentication.All_Authentication where Authentication.EventCode=4625 | search Authentication.app=windows | timechart span=10m count by Authentication.src | where count > 10`. It uses the `from datamodel` command to query the CIM Authentication data model, specifically the `All_Authentication` dataset filtered for EventCode 4625 and Windows (`Authentication.app=windows`). The `timechart span=10m count by Authentication.src` then counts failures per source IP in 10-minute buckets, and the `where count > 10` triggers the alert only when the threshold is exceeded. This approach ensures CIM compatibility, uses the correct data model object, and respects the 10-minute sliding window required by the use case.

Answer

`index=windows_security sourcetype=WinEventLog:Security EventCode=4625 | stats count by src_ip | where count > 10`

Answer

`| from datamodel:Authentication.Failed_Authentication | where EventCode=4625 | stats count by src_ip | where count > 10`

Answer

`index=windows_security EventCode=4625 | transaction src_ip maxspan=10m | where eventcount > 10`

Question 6

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

Accepted Answer

Add a time range to the main search.. The exhibit shows a transaction command that groups events by a session field, but without a time range, the search must scan all indexed data, which is extremely slow. Adding a time range (e.g., earliest=-1h) limits the data scanned, drastically improving performance while still allowing the transaction to complete within the default maxpause of 5s.

Answer

Change maxpause to 30s.

Answer

Remove the eval command.

Answer

Replace transaction with stats and use values() for fields.

Question 7

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Accepted Answer

The field `uri_path` does not exist or contains data that does not match the pattern.. The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.

Answer

The stats command cannot be used after rex.

Answer

The search time range is too short to include any events.

Answer

The regex pattern is incorrectly written.

Question 8

Which TWO of the following commands can be used to find the most frequent value of a field within each group?

Accepted Answer

stats mode(field) by group. `stats mode(field) by group` directly computes the most frequent value (mode) of the specified field for each group defined by the `by` clause. The `mode()` function is specifically designed to return the value that appears most often, making it the simplest and most accurate command for this task.

Answer

stats list(field) by group | eval top = mvindex('list', 0)

Answer

streamstats mode(field) by group

Answer

stats values(field) by group

Question 9

A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?

Accepted Answer

They are split into separate transactions because the gap exceeds maxpause.. The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.

Answer

They are merged because maxpause is 5s but maxspan is 30s, so the 10s gap is within maxspan.

Answer

They are considered part of the same transaction as long as total span ≤ 30s.

Answer

They are split only if the total span exceeds maxspan.

Question 10

An analyst runs `sourcetype=access_combined | transaction clientip` and notices many single-event transactions. Which option would help close transactions more accurately?

Accepted Answer

Add `endswith="status=200"`. Adding `endswith` helps define when a transaction should close, reducing false single-event transactions (e.g., 200 status often indicates end). Option B (maxpause) might help but not as targeted. Option C (closedelay) is not valid. Option D (null) is not helpful.

Answer

Increase maxpause to 1 hour

Answer

Do nothing; single events are fine

Answer

Set closedelay=10

Question 11

Refer to the exhibit. An admin configures acceleration for the Network_Traffic data model as shown. A user runs a search using the data model over the last 60 days. Why might the search be slower for data older than 7 days?

Accepted Answer

The earliest_time is set to -7d@d, so the acceleration index only covers the last 7 days. The `earliest_time` parameter in the acceleration configuration is set to -7d@d, meaning the acceleration summary is built only for data from the last 7 days. Searches querying older data must scan raw events, which is slower. Option A is incorrect because summary_range controls how long to keep accelerated data, not the time range covered. Option B misstates the summary_range: it is set to 30d, not that data within 30 days is accelerated. Option D is incorrect; the datamodel command is not required to use acceleration; acceleration is transparently applied when using the data model.

Answer

The data model is not compatible with acceleration

Answer

The summary_range is set to 30d, so only data within 30 days is accelerated

Answer

The search must use the `| datamodel` command to benefit from acceleration

Question 12

When creating a saved search that runs every hour and sends an email alert when the count of errors exceeds 10, which action must be configured in addition to the search logic?

Accepted Answer

Add an email alert action in the saved search settings.. Saved searches that trigger alerts require at least one alert action (e.g., email) to be defined in the saved search settings. Option B is incorrect because the `| alert` command is not used in search strings for saved search alerts. Option C is incorrect because a lookup table is not required for alerting. Option D is incorrect because summary indexing is unrelated to sending email alerts.

Answer

Include '| alert' command in the search string.

Answer

Create a lookup table to store error counts.

Answer

Enable summary indexing for the search.

Question 13

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

Accepted Answer

Time-based lookup. Time-based lookups use event time to match against time ranges in the lookup table.

Answer

CSV lookup

Answer

KV Store lookup

Answer

External lookup

Question 14

A user wants to see the top 5 most common HTTP methods (field "method") from web access logs, along with their percentage of total. Which search is best?

Accepted Answer

index=web | top method limit=5 showperc=t. `top` with `limit=5` returns the five most common values of the `method` field, and `showperc=t` automatically calculates and displays each value's percentage of the total events. This directly meets the requirement to see the top 5 HTTP methods and their percentages without needing additional commands.

Answer

index=web | top method countfield=percent

Answer

index=web | eventstats count | top method

Answer

index=web | stats count by method | sort - count | head 5

Question 15

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

Accepted Answer

Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.. Using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of the transaction command. Option B (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window. Option C (increase maxspan to 24h) would still break on multiple purchases and increase memory usage. Option D (group by user_id) loses session distinction and may merge separate sessions.

Answer

Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.

Answer

Increase maxspan to 24h to capture all potential purchases.

Answer

Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.