SPLK-1002 Practice Test 13 — 15 Questions

Question 1

A company's security team uses Splunk to monitor firewall logs. They have a lookup file named 'threat_intel.csv' containing 10,000 IP addresses classified by threat level. The lookup is used in a dashboard that shows the number of blocked connections from high-threat IPs over the past 24 hours. Recently, the dashboard has become slow, taking over 30 seconds to load. The lookup file is updated every 15 minutes via a script that replaces the entire file. The search currently uses: `index=firewall | lookup threat_intel.csv src_ip OUTPUT threat_level | where threat_level="high" | stats count`. Which of the following is the MOST efficient way to improve dashboard performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the lookup to a KV store collection with an index on src_ip.. Converting the lookup to a KV Store collection with an index on `src_ip` allows Splunk to perform efficient key-value lookups without loading the entire 10,000-row CSV into memory on every search. The KV Store uses an indexed data structure, which dramatically reduces lookup time compared to a file-based lookup that must be fully scanned each time, especially when the file is replaced every 15 minutes and the search runs over a 24-hour window.

Answer

Restrict the search to a smaller time range, such as the last hour.

Answer

Use the lookup with local=t to force it to run on the search head only.

Answer

Increase the lookup cache size in limits.conf.

Question 2

Refer to the exhibit. A user runs this search expecting to see the top 5 departments by count, but the results show all departments. What is the error?

Accepted Answer

The top command already calculates a count, so stats is unnecessary and can cause conflict. The top command already calculates a count and sorts, so using stats before top is redundant and can cause unexpected results. The correct approach is to use 'top limit=5 department' directly on the inputlookup without stats.

Answer

The limit parameter in top should be written before the field name

Answer

The sort command should be placed before stats

Answer

The inputlookup should be used with a subsearch

Question 3

Which TWO of the following are valid uses of the stats command in Splunk? (Choose two.)

Accepted Answer

stats values(ip) by user. The `stats` command in Splunk can compute aggregate statistics over fields. `values(ip) by user` is valid because `values()` returns a multivalue list of all distinct `ip` values for each `user`, which is a standard aggregation function. `count by host` is valid because `count` is a default aggregation that counts events per `host`.

Answer

stats mode(score) by group

Answer

stats median(response_time) by server

Answer

stats first(error_code) by session

Question 4

Which three considerations are important when creating a visualization for a dashboard that will be displayed on a large monitor? (Choose 3)

Accepted Answer

Ensure the chart type is appropriate for the data. High contrast improves readability, appropriate chart type is fundamental, and drill-down actions provide interactive details. Small fonts and minimizing data points are detrimental.

Answer

Use small font sizes to fit more information

Answer

Minimize the number of data points

Question 5

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Accepted Answer

1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.. The Field Extractor guides you through selecting sample data, defining extraction rules, testing, and saving.

Answer

1. Highlight the field value, 2. Select a sample event, 3. Name the field, 4. Save the extraction.

Answer

1. Name the field, 2. Select a sample event, 3. Highlight the field value, 4. Save the extraction.

Answer

1. Select a sample event, 2. Name the field, 3. Highlight the field value, 4. Save the extraction.

Question 6

An analyst needs to create a time-series chart showing the percentage of total HTTP status codes per day. Which approach is most efficient?

Accepted Answer

timechart count by status | eventstats sum(count) as total by _time | eval pct = round(count/total*100,2) | chart first(pct) over _time by status. Using timechart to get counts by status, then eventstats to compute total per day, and eval to calculate percentage, is efficient and clear. Option B is incorrect because using chart with a single stats command cannot compute percentages across groups per time bucket. Option C is incorrect because addtotals adds overall totals but does not compute per-day percentages. Option D is incorrect because overcomplicates with subsearches.

Answer

chart count by status over _time | eval pct = count / sum(count) * 100

Answer

timechart count by status | addtotals | eval pct = count / total * 100

Answer

timechart count by status | append [timechart count] | eval pct = count / [| timechart count] * 100

Question 7

Match each Splunk macro to its definition.

Accepted Answer

mvfilter: Filters multivalue fields based on a condition.. The correct matches are: mvfilter for filtering multivalue fields, dedup for removing duplicates, fields for removing fields, and rename for renaming fields. Common confusions include associating dedup with time formatting and fields with sorting.

Answer

dedup: Changes the time format of events.

Answer

fields: Sorts results by a field.

Question 8

A lookup table maps combinations of 'source_ip' and 'dest_port' to a 'policy' field. The lookup is defined in transforms.conf with a max_match of 1. Which lookup command syntax will correctly perform the lookup?

Accepted Answer

lookup policy_lookup source_ip dest_port OUTPUT policy. The lookup command takes a space-separated list of event fields to match against lookup fields in order.

Answer

lookup policy_lookup source_ip dest_port

Answer

lookup policy_lookup (source_ip, dest_port) OUTPUT policy

Answer

lookup policy_lookup source_ip, dest_port OUTPUT policy

Question 9

A lookup is not returning any results even though the search events contain the matching field. The lookup definition in transforms.conf includes 'default_match = false'. What is the most likely issue?

Accepted Answer

The lookup is case-sensitive and the event fields have different case. Lookups are case-sensitive by default; if event fields have different case than lookup fields, no match occurs. default_match=false causes no default value on mismatch.

Answer

The lookup has a time restriction that excludes the events

Answer

The lookup field names do not match the event field names

Answer

The lookup command is missing the 'OUTPUT' clause

Answer

The lookup file is empty

Question 10

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

Accepted Answer

Increase maxpause to 2 minutes. Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Answer

Decrease maxspan to 30 seconds

Answer

Remove maxpause and use only maxspan

Answer

Group by destination IP instead of source IP

Question 11

During peak hours, a search that uses a KV Store lookup frequently times out. The search runs on daily data but the KV Store collection has millions of records. Which approach is most effective to reduce lookup time while maintaining data freshness?

Accepted Answer

Pre-compute the lookup results using a scheduled search and write to a CSV, then use the CSV lookup. Pre-computing lookup results into a smaller CSV that is refreshed frequently can improve performance while keeping data up-to-date.

Answer

Increase the KV Store collection's replication factor

Answer

Reduce the fields stored in the KV Store collection

Answer

Use the 'lookup' command with the 'local=t' option

Question 12

The search returns a timechart with multiple series but the series colors are all the same. What is the most likely reason?

Accepted Answer

The number of distinct description values exceeds the default color palette. If the number of distinct description values exceeds the default color palette (typically 10), colors will repeat. This is a common issue with many series.

Answer

The 'timechart' command cannot handle multiple series from a lookup

Answer

The lookup should be performed before the eval

Answer

The 'eval' command is misspelled (status=code instead of status_code?)

Answer

The lookup is not working correctly

Question 13

A search includes a lookup that is used for every event. The lookup file has 500,000 rows. The search is running slowly. Which change could improve performance?

Accepted Answer

Use the lookup command with output fields limited to needed fields. Limiting output fields reduces data transfer and can improve lookup performance. KV Store may help but requires extra setup.

Answer

Use the stats command instead of lookup

Answer

Convert the lookup to a KV Store lookup

Answer

Use the inputlookp command with append=t

Answer

Increase the max_match in the lookup definition

Question 14

An analyst runs a search with the command 'lookup region_lookup region_code OUTPUT region_name'. The events have a region_code field with values like 'us-east' and 'eu-west'. The lookup file contains 'US-EAST' and 'EU-WEST'. The lookup returns no results. What is the most likely cause?

Accepted Answer

The case_sensitive_match is set to true. The lookup is case-sensitive ('Case_sensitive_match = true'), and the event fields have lowercase values while the lookup file has uppercase, causing no match.

Answer

The lookup file format is incorrect

Answer

The default_match setting prevents missing matches

Answer

The match_type is WILDCARD but no wildcards used

Answer

The max_match setting limits results

Question 15

A security analyst needs to enrich authentication logs with employee department information stored in a CSV file called 'employees.csv'. The CSV has fields: 'emp_id', 'name', 'department'. The authentication logs contain a field 'user_id' that matches 'emp_id'. Which search correctly enriches the events with the department field?

Accepted Answer

`index=auth | lookup employees.csv emp_id AS user_id OUTPUT department`. It uses the proper lookup syntax: `lookup

AS OUTPUT `. Here, `employees.csv emp_id AS user_id` maps the lookup field `emp_id` to the event field `user_id`, and outputs the `department` field. Option A incorrectly maps `user_id` to `emp_id`, which would look for a lookup field `user_id` and rename it, but the lookup table column is `emp_id`, so it will not match correctly. Option C has the same mapping error as A, and additionally outputs `name`, which is not required. Option D uses `inputlookup` which returns the contents of the lookup table, not enriching the events with a join.

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department`

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department, name`

Answer

`index=auth | inputlookup employees.csv where user_id=emp_id | table *`