SPLK-1003 Practice Test 12 — 15 Questions

Question 1

A Splunk admin notices that a search using the transaction command takes too long. To debug, they want to see how events are grouped into transactions before the transaction command runs. Which command can be added to the search pipeline before transaction to inspect the grouping?

Accepted Answer

streamstats. Option B is correct because streamstats can be used to compute a transaction ID based on a time window or field change, allowing you to see how events would be grouped. Options A, C, and D do not help inspect grouping.

Answer

map

Answer

fields

Answer

transaction

Question 2

Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?

Accepted Answer

overall_avg is not available in the where clause because it is created in eventstats. Option B is correct: eventstats adds overall_avg to each event, but stats by user only outputs user and user_avg, dropping overall_avg, so where compares a non-existent field to user_avg. Option A is wrong because eventstats before stats is correct conceptually. Option C is wrong because where works fine with fields present. Option D is wrong as subquery is not needed.

Answer

eventstats should be after stats

Answer

The where clause should use the 'search' command

Answer

The search requires a subquery to compute overall_avg

Question 3

Which THREE of the following are valid ways to count the number of events per minute for a given sourcetype?

Accepted Answer

index=main sourcetype=web | eval minute = strftime(_time, "%Y-%m-%d %H:%M") | stats count by minute. Options A, B, and D are correct. A uses bucket to group by minute then stats count. B uses timechart with span=1m. D creates a minute-level string and groups by it. C uses date_minute which only captures the minute portion, not the full timestamp. E uses streamstats for a running count, not a per-minute count.

Answer

index=main sourcetype=web | stats count by date_minute

Answer

index=main sourcetype=web | streamstats count window=1m | where count>0

Question 4

A user runs a search on web access logs: `index=web | eventstats sum(bytes) as total_bytes by host`. The search returns the correct total bytes per host, but now the user needs to calculate the average bytes per host for each event. Which command should be added to the base search to achieve this?

Accepted Answer

Add `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats.. eventstats can compute the average directly with `avg(bytes)`. Option A requires manually calculating average with count, which is more complex. Option C uses streamstats, which computes a running average, not overall. Option D uses stats and join, which is slower and may not work well.

Answer

Replace eventstats with `| streamstats avg(bytes) as avg_bytes by host`.

Answer

Add `| eval avg_bytes = total_bytes / count` after the eventstats.

Answer

Use `| stats avg(bytes) by host` then `| join host [search index=web]`.

Question 5

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. Option B is correct because it filters out outliers before computing the average per user. Option A filters after stats, so the average still includes outliers. Option C filters after stats as well, but tries to nullify the average, which is incorrect. Option D uses eventstats to compute overall average, then filters, then computes per-user average; this still includes outliers in the per-user average because the filter does not retroactively change the eventstats calculation.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 6

An analyst needs to add a field called 'Region' to events based on a lookup table that maps 'StoreID' to 'Region'. The lookup table is defined in transforms.conf as a CSV lookup. Which command should be used in the search to perform this enrichment?

Accepted Answer

lookup. The lookup command enriches events with fields from a lookup table. inputlookp reads a lookup as results, outputlookp writes events to a lookup, others are irrelevant.

Answer

inputlookp

Answer

outputlookp

Answer

table

Question 7

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

Accepted Answer

Time-based lookup. Time-based lookups use event time to match against time ranges in the lookup table.

Answer

CSV lookup

Answer

KV Store lookup

Answer

External lookup

Question 8

A dashboard developer wants to display the count of errors over the last 24 hours with a line chart. Which search command should be the final command before the visualization?

Accepted Answer

timechart. timechart automatically creates a time-based chart suitable for line chart visualization without additional formatting.

Answer

chart

Answer

trendline

Answer

stats

Question 9

A search includes a lookup that is used for every event. The lookup file has 500,000 rows. The search is running slowly. Which change could improve performance?

Accepted Answer

Use the lookup command with output fields limited to needed fields. Limiting output fields reduces data transfer and can improve lookup performance. KV Store may help but requires extra setup.

Answer

Use the stats command instead of lookup

Answer

Convert the lookup to a KV Store lookup

Answer

Use the inputlookp command with append=t

Answer

Increase the max_match in the lookup definition

Question 10

A lookup table maps combinations of 'source_ip' and 'dest_port' to a 'policy' field. The lookup is defined in transforms.conf with a max_match of 1. Which lookup command syntax will correctly perform the lookup?

Accepted Answer

lookup policy_lookup source_ip dest_port OUTPUT policy. The lookup command takes a space-separated list of event fields to match against lookup fields in order.

Answer

lookup policy_lookup source_ip dest_port

Answer

lookup policy_lookup (source_ip, dest_port) OUTPUT policy

Answer

lookup policy_lookup source_ip, dest_port OUTPUT policy

Question 11

A lookup is not returning any results even though the search events contain the matching field. The lookup definition in transforms.conf includes 'default_match = false'. What is the most likely issue?

Accepted Answer

The lookup is case-sensitive and the event fields have different case. Lookups are case-sensitive by default; if event fields have different case than lookup fields, no match occurs. default_match=false causes no default value on mismatch.

Answer

The lookup has a time restriction that excludes the events

Answer

The lookup field names do not match the event field names

Answer

The lookup command is missing the 'OUTPUT' clause

Answer

The lookup file is empty

Question 12

During peak hours, a search that uses a KV Store lookup frequently times out. The search runs on daily data but the KV Store collection has millions of records. Which approach is most effective to reduce lookup time while maintaining data freshness?

Accepted Answer

Pre-compute the lookup results using a scheduled search and write to a CSV, then use the CSV lookup. Pre-computing lookup results into a smaller CSV that is refreshed frequently can improve performance while keeping data up-to-date.

Answer

Increase the KV Store collection's replication factor

Answer

Reduce the fields stored in the KV Store collection

Answer

Use the 'lookup' command with the 'local=t' option

Question 13

Which three considerations are important when creating a visualization for a dashboard that will be displayed on a large monitor? (Choose 3)

Accepted Answer

Ensure the chart type is appropriate for the data. High contrast improves readability, appropriate chart type is fundamental, and drill-down actions provide interactive details. Small fonts and minimizing data points are detrimental.

Answer

Use small font sizes to fit more information

Answer

Minimize the number of data points

Question 14

An analyst runs a search with the command 'lookup region_lookup region_code OUTPUT region_name'. The events have a region_code field with values like 'us-east' and 'eu-west'. The lookup file contains 'US-EAST' and 'EU-WEST'. The lookup returns no results. What is the most likely cause?

Accepted Answer

The case_sensitive_match is set to true. The lookup is case-sensitive ('Case_sensitive_match = true'), and the event fields have lowercase values while the lookup file has uppercase, causing no match.

Answer

The lookup file format is incorrect

Answer

The default_match setting prevents missing matches

Answer

The match_type is WILDCARD but no wildcards used

Answer

The max_match setting limits results

Question 15

The search returns a timechart with multiple series but the series colors are all the same. What is the most likely reason?

Accepted Answer

The number of distinct description values exceeds the default color palette. If the number of distinct description values exceeds the default color palette (typically 10), colors will repeat. This is a common issue with many series.

Answer

The 'timechart' command cannot handle multiple series from a lookup

Answer

The lookup should be performed before the eval

Answer

The 'eval' command is misspelled (status=code instead of status_code?)

Answer

The lookup is not working correctly