SPLK-1002 Practice Test 12 — 15 Questions

Question 1

A user reports that a macro named `my_macro` is not working in a search. The macro is defined with no arguments and uses a simple search string. What is the most likely issue?

Accepted Answer

The macro permissions are not shared to the user's role.. In Splunk, macros have permissions that determine which users or roles can access them. If a macro is not shared with the user's role, the user will not be able to use it in searches, even if the macro name is correct and the definition is valid. Since the macro is defined with no arguments and uses a simple search string, the most likely issue is a permissions problem. The user must have the macro shared to their role or be in a role that has access.

Answer

The macro is defined with wrong arguments.

Answer

The macro name is misspelled in the search.

Answer

The macro contains a subsearch that fails.

Question 2

Which three considerations are important when creating a visualization for a dashboard that will be displayed on a large monitor? (Choose 3)

Accepted Answer

Ensure the chart type is appropriate for the data. Option B is correct because on a large monitor the audience must grasp the message quickly, so choosing a chart type that matches the data (e.g., bar for categorical comparison, line for trends over time) ensures the visualization communicates accurately rather than misleading or confusing viewers. Option C is correct because high contrast colors improve legibility and accessibility from a distance, which is critical when a dashboard is displayed on a large screen viewed by many people at varying distances. Option D is correct because large-monitor dashboards typically serve as high-level overviews, so drill-down actions let viewers start with summary KPIs and then navigate to detailed views on demand without cluttering the main display. Option A is not appropriate because small font sizes reduce readability at a distance, defeating the purpose of a large-monitor display. Option E is not appropriate because minimizing data points is not a general requirement; the goal is to show the right amount of relevant data, and reducing points arbitrarily can hide important trends or patterns.

Answer

Use small font sizes to fit more information

Answer

Minimize the number of data points

Question 3

Which TWO of the following are limitations of the transaction command in Splunk?

Accepted Answer

It defaults to a maximum of 1000 events per transaction.. The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.

Answer

It cannot be used inside an eval statement.

Answer

It only works with indexed fields.

Answer

It cannot correlate events from multiple sourcetypes.

Question 4

Which THREE of the following are valid uses of the stats command? (Select three.)

Accepted Answer

Calculating the average of a field across all events.. Option A is correct because stats avg(field) computes the arithmetic mean of a numeric field across all events in the result set, which is a core aggregation function of the stats command. Option B is correct because stats min(timestamp) (or earliest()) returns the earliest timestamp value, and when combined with a by clause it produces the earliest timestamp per category. Option C is correct because stats count() by category_field groups events by the categorical field and counts events in each group, the canonical grouping use of stats. Option D is not a valid stats use because time-based charts with multiple series are produced by the timechart command, not stats. Option E is not a valid stats use because enriching events with external lookup fields is done by the lookup command, not stats.

Answer

Creating a time-based chart with multiple series.

Answer

Enriching events with fields from an external lookup.

Question 5

In a dashboard, a bar chart shows sales by region. The user wants to click on a bar and have a table filter to show only that region's details. Which drilldown technique should be used?

Accepted Answer

Set a token using $click.value$ in the drilldown and add a dependency on the token in the table search. In Splunk dashboards, drilldown tokens like $click.value$ capture the value of the clicked element (e.g., the region bar). Setting this token in the drilldown and then adding a token dependency to the table's search ensures the table filters dynamically based on the clicked region. This is the standard token-based drilldown pattern in Simple XML dashboards.

Answer

Enable drilldown in the bar chart and set the search to automatically apply the clicked field

Answer

Configure a form input dropdown and set default value from drilldown

Answer

Use a static filter with a predefined list of regions

Question 6

Refer to the exhibit. A security analyst runs this search to group SSH login events into sessions based on a session_id that is extracted only from 'Accepted publickey' events. However, the resulting transactions contain only the 'Accepted publickey' event and none of the subsequent commands or logouts. What is the most likely cause?

Accepted Answer

The session_id field is only populated for the 'Accepted publickey' event, so other events have a different or null session_id and do not join the transaction.. The `transaction` command groups events by the `session_id` field. If `session_id` is only extracted from 'Accepted publickey' events (e.g., via a `rex` or `eval` command), subsequent commands and logout events will have a null or different `session_id`. Since `transaction` requires all events in the group to share the same `session_id` value, those other events cannot join the transaction, resulting in a transaction containing only the single 'Accepted publickey' event.

Answer

The maxpause=5m is too short, causing the transaction to close before other events occur.

Answer

The transaction command requires that all events have a non-null session_id to be grouped.

Answer

The sourcetype filter is too restrictive.

Question 7

An analyst runs `index=web status=500 | top 10 uri` and gets results. Which statement is true about the 'top' command's behavior?

Accepted Answer

It counts the number of events per URI and displays the 10 with the highest count.. The `top` command in Splunk counts the occurrences of each distinct value of a specified field (here, `uri`) and returns the values with the highest counts. By default, it returns the top 10 results, so option E correctly describes that it counts events per URI and displays the 10 with the highest count.

Answer

It returns the 10 URIs that appeared most recently.

Answer

It computes the average latency per URI and shows the top 10.

Answer

It sums a numeric field per URI and shows the top 10 sums.

Answer

It requires a 'by' clause to specify the field to group by.

Question 8

A saved search is configured with a schedule but is not triggering at the expected time. The admin checks the "Job Inspector" and sees that the scheduled search is "skipped". What is a common reason for a scheduled search to be skipped?

Accepted Answer

There are too many concurrent searches scheduled. A scheduled search is marked 'skipped' when the scheduler cannot start it at its scheduled time because the search head's concurrency limits are already saturated by other running searches. Splunk enforces a maximum number of concurrent scheduled and ad-hoc searches per search head; when that limit is hit, the scheduler skips the run rather than queuing it indefinitely. This is why the Job Inspector shows a 'skipped' status instead of a failure or success.

Answer

The search time range exceeds the bucket's time range

Answer

The search is configured as a real-time search

Answer

The search string has a syntax error

Question 9

An alert saved search runs every 5 minutes and is set to trigger when count > 0. The alert keeps triggering repeatedly for the same events. What is the recommended solution?

Accepted Answer

Increase the alert throttle period.. When an alert triggers repeatedly for the same events, the standard fix is to configure throttling so the alert suppresses duplicate notifications for a defined period. Increasing the throttle period prevents the same triggering events from generating repeated alerts. This is the built-in Splunk mechanism for alert deduplication.

Answer

Set the alert to trigger once per hour.

Answer

Disable the alert and re-enable.

Answer

Change the condition to count > 1.

Question 10

A team needs to create a saved search that runs automatically every Monday at 8 AM and emails a CSV file of the results. Besides configuring the search string, which steps are required?

Accepted Answer

Set a schedule (Cron: 0 8 * * 1) and add an email alert action with attachment format CSV.. A scheduled saved search that emails results requires two configurations beyond the search string: a cron schedule and an alert action. The cron expression '0 8 * * 1' fires at 08:00 every Monday (day-of-week 1 = Monday in Splunk's cron). Adding an email alert action with the attachment format set to CSV delivers the results as a CSV file. Together these satisfy the requirement of running weekly and emailing a CSV.

Answer

Create a dashboard panel that runs the search on schedule and sends email.

Answer

Set the search to 'Summary Index' and run a separate alert on the summary.

Answer

Define the schedule and set the time range to 'Last 7 days'.

Question 11

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Accepted Answer

Use the timechart command with a split-by field. Option A is correct because the timechart command is the Splunk search command designed to plot a metric (here, count of events) over time, and adding a split-by clause (e.g., timechart count by status) produces one series per status value, which is the data foundation for a stacked bar chart. Option E is correct because, after the timechart results are rendered, the user must set the visualization's stack mode to 'stacked' in the Format/Visualization options to actually stack the success and failure series into a single bar per time bucket. Option B is not required because the count-by-status series can be produced directly by timechart's split-by field without creating any new field via eval. Option C is not appropriate because the chart command does not inherently bin results by time the way timechart does, so it would not give the time-based x-axis needed here. Option D is incorrect because a line chart type would not produce the requested stacked bar chart.

Answer

Use the eval command to create a new field

Answer

Use the chart command with a split-by field

Answer

Select the 'line' chart type

Question 12

Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?

Accepted Answer

The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.. The `maxspan` parameter in the transaction command sets an upper limit on the total duration of the transaction from the first to the last event, regardless of the `maxpause` setting. With `maxspan=30m` (1800 seconds), a transaction can have a total duration up to 1800 seconds, even if individual gaps between events exceed `maxpause=5m` (300 seconds). The `maxpause` only limits the idle time between consecutive events, not the overall span, so transactions with gaps larger than 300 seconds but within the 1800-second span are still valid.

Answer

The transaction command is including events that are more than 5 minutes apart because the maxpause is ignored when maxspan is set.

Answer

The eventcount field is inflated, causing duration to be calculated incorrectly.

Answer

The duration field represents milliseconds, so 600 seconds is actually 0.6 seconds.

Question 13

A user wants to see the top 5 most common HTTP methods (field "method") from web access logs, along with their percentage of total. Which search is best?

Accepted Answer

index=web | top method limit=5 showperc=t. `top` with `limit=5` returns the five most common values of the `method` field, and `showperc=t` automatically calculates and displays each value's percentage of the total events. This directly meets the requirement to see the top 5 HTTP methods and their percentages without needing additional commands.

Answer

index=web | top method countfield=percent

Answer

index=web | eventstats count | top method

Answer

index=web | stats count by method | sort - count | head 5

Question 14

Refer to the exhibit. An admin configures acceleration for the Network_Traffic data model as shown. A user runs a search using the data model over the last 60 days. Why might the search be slower for data older than 7 days?

Accepted Answer

The earliest_time is set to -7d@d, so the acceleration index only covers the last 7 days. In Splunk data model acceleration, the earliest_time setting defines the start of the time range that gets summarized into the acceleration index. With earliest_time = -7d@d, only events from the last 7 days are accelerated, so searches over 60 days must fall back to raw event scanning for the older 53 days, which is dramatically slower. The acceleration only helps within the window it actually covers.

Answer

The data model is not compatible with acceleration

Answer

The summary_range is set to 30d, so only data within 30 days is accelerated

Answer

The search must use the `| datamodel` command to benefit from acceleration

Question 15

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

Accepted Answer

streamstats. The streamstats command calculates cumulative (running) statistics as it processes events in order, adding the result to each event without collapsing them into a single row. This makes it ideal for computing a running total of sales per customer across events while preserving the event-level detail and avoiding a multivalued field. By using streamstats with a sum(sales) and a by-clause for customer, you get an incremental total on each event.

Answer

stats

Answer

transaction

Answer

eventstats