SPLK-1002 Practice Test 12 — 15 Questions

Question 1

Arrange the steps to create a new index in Splunk in the correct order.

Accepted Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Enter index name and configure settings. Step 4: Click Save.. Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Answer

Step 1: Click New Index. Step 2: Navigate to Settings > Indexes. Step 3: Enter index name and configure settings. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Enter index name and configure settings. Step 3: Click New Index. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Click Save. Step 4: Enter index name and configure settings.

Question 2

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Setting an appropriate time range in a saved search limits the volume of data that Splunk must scan, reducing resource consumption and improving search performance. Without a bounded time range, the search may scan all available data, which can lead to excessive CPU and memory usage, especially in large deployments.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 3

What is the MOST likely cause of this error?

Accepted Answer

The CSV file has a trailing space in the column header 'asset_type'.. The error is most likely caused by a trailing space in the CSV column header 'asset_type'. When `inputlookup` reads a CSV file, it treats column headers as literal strings; a trailing space makes the field name 'asset_type ' (with a space) instead of 'asset_type'. This mismatch causes the `where` command to fail because it references 'asset_type' without the space, leading to a field-not-found error.

Answer

The lookup is not configured to output all fields.

Answer

The lookup definition filename is incorrect.

Answer

The `where` command cannot be used after `inputlookup`.

Question 4

A team is using the transaction command to group web server access logs into user sessions. They notice some sessions are missing because the transaction command defaults to combining events with identical field values if they occur within a default time window. What is the default maxspan value for the transaction command?

Accepted Answer

-1 (no default limit). The default maxspan is -1 (unlimited). Options A, C, and D are common misconceptions but incorrect.

Answer

1 minute

Answer

30 seconds

Answer

5 minutes

Question 5

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Answer

External lookup

Answer

KV Store lookup

Answer

Geospatial lookup

Question 6

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

Accepted Answer

Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions. The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Answer

Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results

Answer

Keep the current search but increase maxspan to 30m

Answer

Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`

Question 7

Which TWO statements about the 'transaction' command are correct? (Choose two.)

Accepted Answer

It can use the 'by' clause to group events based on common field values.. The 'transaction' command can use a 'by' clause to group events that share common field values into a single transaction. This allows you to correlate events from different sources or sourcetypes as long as they have matching field values, enabling flexible event correlation.

Answer

It requires all events to be from the same source.

Answer

It sums numeric field values across events in the transaction.

Answer

The 'maxevents' option limits the total number of transactions output.

Question 8

A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?

Accepted Answer

Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.. Enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.

Answer

Enable 'Digest mode' with a time window of 5 minutes.

Answer

Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.

Answer

Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.

Question 9

An administrator notices that a search using the timechart command returns data for every 15-minute bucket even when no events exist, creating many null values. How can this behavior be suppressed?

Accepted Answer

Use timechart cont=false. Cont=false suppresses continuous time bins, showing only buckets with data. Option A (limit=0) affects number of series, not gaps. Option B (usenull=f) is not a valid timechart option. Option C (partial=false) controls partial buckets at edges.

Answer

Use timechart limit=0

Answer

Use timechart usenull=f

Answer

Use timechart partial=false

Question 10

A search uses the transaction command with maxevents=1000 and maxspan=1h. The search is slow and memory-intensive. Which modification can reduce resource usage while still grouping related events?

Accepted Answer

Reduce maxevents to 100.. Reducing maxevents to 100 limits the number of events that the transaction command groups into a single transaction, which directly reduces memory consumption and processing overhead. This modification still allows related events to be grouped together, but with a smaller batch size, making the search less resource-intensive while preserving the core grouping logic.

Answer

Use eventstats with a time window.

Answer

Use tstats instead of transaction.

Answer

Increase maxspan to 2h.

Question 11

An analyst is using the transaction command to group events by a field that has high cardinality (millions of unique values). The search is taking too long and consuming too much memory. Which approach should be taken to improve performance?

Accepted Answer

Reduce the cardinality of the field by using a derived field with fewer values.. High cardinality in the field used by `transaction` causes many open transactions, consuming excessive memory and time. Reducing cardinality (e.g., by using a derived field with fewer unique values) directly addresses this issue. Options B (`maxspan`) and D (`maxevents`) can help limit transactions but do not solve the root cause of high cardinality. Option C (`mvlist`) is not a valid option for the `transaction` command.

Answer

Use the 'maxspan' option to narrow the time window.

Answer

Use the 'mvlist' option to reduce field storage.

Answer

Use the 'maxevents' option to limit number of events per transaction.

Question 12

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

Accepted Answer

Use `sort _time | transaction request_id maxspan=10m`. Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Answer

Use `eventstats count by request_id` to correlate counts

Answer

Use `transaction request_id` and rely on Splunk to automatically reorder

Answer

Use `transaction request_id maxspan=1m` and ignore out-of-order events

Question 13

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Accepted Answer

It improves the ability to correlate events from different technologies.. The Common Information Model (CIM) provides a standardized set of field names and event tags across different data sources, enabling correlation of events from disparate technologies (e.g., firewalls, IDS, endpoints) using common fields like 'dest_ip', 'src_ip', 'user', and 'action'. This normalization allows Splunk to join or relate events that share the same CIM-compliant fields, making it possible to build coherent security or operational stories across heterogeneous data.

Answer

It improves search performance by pre-aggregating data.

Answer

It provides built-in security monitoring use cases.

Answer

It eliminates the need for custom field extractions.

Question 14

A search uses transaction to group login and logout events. What happens if a user has multiple logins before logging out?

Accepted Answer

The transaction will include the first login and all events until the first logout.. The transaction command with startswith/endswith groups events from the first occurrence of the start condition to the first occurrence of the end condition. If a user logs in multiple times before logging out, the transaction will include only the first login event and all subsequent events (including subsequent logins) until the first logout event. Subsequent login events are included in the same transaction but do not start new transactions. Therefore, the correct answer is B. Option A is incorrect because the search does not fail; it simply groups events as described. Option C is incorrect because only one transaction is created for that user, not multiple. Option D is incorrect because the first login is not ignored; it is the start of the transaction.

Answer

The search will fail due to overlapping transactions.

Answer

It will create multiple transactions for each login.

Answer

It will ignore the first login and start at the last login.

Question 15

A team uses a lookup to enrich web logs with customer region. The lookup is file-based and updated daily. Some events are not being enriched even though the lookup file has matching keys. What could be the issue?

Accepted Answer

The lookup file has leading or trailing spaces in key fields.. Leading or trailing spaces in the lookup file's key field or the search event's field will cause matching to fail silently. Splunk requires exact string matches for lookups, so extra spaces prevent the lookup key from being found. Option A (maximum file size) is incorrect because exceeding maximum size would typically cause an error or truncated results, not a silent failure of matching. Option B (file not sorted) is incorrect because file-based lookups do not require sorting; sorting is only needed for time-based lookups or certain efficient memory modes but not for basic matching. Option C (wrong timestamp format) is irrelevant because this lookup is for region enrichment based on a key field, not a time-based lookup.

Answer

The lookup file exceeds the maximum size.

Answer

The lookup file is not sorted.

Answer

The lookup definition uses the wrong timestamp format.