SPLK-1002 Practice Test 13 — 15 Questions

Question 1

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.. Summary indexing pre-aggregates the error counts by severity every 5 minutes, so the dashboard queries a small summary index instead of scanning 500 GB/day of raw data. This preserves the exact output (counts by severity over 5-minute spans) while drastically reducing search load, making it the standard Splunk performance-tuning pattern for repetitive dashboard searches.

Answer

Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

Answer

Limit the time range to the last 1 hour instead of 24 hours.

Answer

Enable search acceleration for the index.

Question 2

A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?

Accepted Answer

Transaction command requires at least one field to group events into sessions.. Option B is correct because the transaction command must be given at least one grouping field (for example, src_ip or user) so it knows which events belong to the same session; without a field or a startswith/endswith boundary, it cannot form meaningful transactions. Option C is correct because transaction supports startswith and endswith arguments that let the analyst define explicit session boundaries, such as startswith="failed login" and endswith="successful login", which is exactly how brute-force sequences can be framed. Option A is wrong because transaction is designed for relatively short, bounded event groupings and is not optimized for very long time ranges over 24 hours; other approaches like stats or streamstats are better there. Option D is wrong because transaction groups events across time using their timestamps and maxspan/maxpause, not only identical timestamps. Option E is wrong because transaction does not automatically deduplicate events; it groups them, and any deduplication would require an explicit command such as dedup.

Answer

Transaction command is optimized for correlating events over very long time ranges (over 24 hours).

Answer

Transaction command can only be used with events that have identical timestamps.

Answer

Transaction command automatically deduplicates events within a transaction.

Question 3

A security analyst wants to use a macro that accepts two arguments: a field name and a value to filter on. The macro should be invoked as `filter(field, value)` and should expand to `field=value`. Which macro definition correctly achieves this?

Accepted Answer

`$1$=$2$`. Splunk macros use positional arguments referenced as $1$, $2$, etc. To define a macro that takes two arguments and expands to `field=value`, the definition must be `$1$=$2$`. This ensures that when the macro is invoked with specific field and value, they are correctly substituted in the search.

Answer

`$field$=$value$`

Answer

`$field$=$2$`

Answer

`$arg1$=$arg2$`

Question 4

A search uses transaction to group login and logout events. What happens if a user has multiple logins before logging out?

Accepted Answer

The transaction will include the first login and all events until the first logout.. Splunk's transaction command groups events between a start and end marker. When a user has multiple logins before a logout, the transaction begins at the first login event and continues until the first matching logout event, encompassing all intermediate events. Subsequent logins are absorbed into that same transaction rather than starting new ones.

Answer

The search will fail due to overlapping transactions.

Answer

It will create multiple transactions for each login.

Answer

It will ignore the first login and start at the last login.

Question 5

A security analyst wants to visualize the count of login failures per hour, grouped by source IP. Which SPL command should they use?

Accepted Answer

timechart count by src_ip. The timechart command is purpose-built for time-series visualizations, automatically bucketing events by time and producing a table where each row is a time interval and each column is a distinct value of the split-by field. Using 'timechart count by src_ip' yields a per-hour count of login failures for each source IP, which can be rendered directly as a line or column chart. It also handles time span selection and binning automatically, unlike stats or chart.

Answer

stats count by _time, src_ip

Answer

chart count by src_ip over _time

Answer

eventstats count by src_ip

Question 6

Which three statements about the transaction command are correct? (Choose three.)

Accepted Answer

The transaction command automatically adds an 'eventcount' field.. Option A is correct because the transaction command automatically adds an eventcount field that records how many events were grouped into each transaction. Option D is correct because transaction also automatically adds a duration field showing the elapsed time between the first and last event of the transaction. Option E is correct because transaction can correlate events across different indexes, sourcetypes, and hosts as long as the grouping fields match. Option B is incorrect because startswith and endswith are optional parameters used to define transaction boundaries, not required ones. Option C is incorrect because transaction is not limited to a single sourcetype; it can group events from multiple sourcetypes.

Answer

The transaction command requires a startswith or endswith parameter.

Answer

The transaction command can only correlate events within the same sourcetype.

Question 7

A user wants to create a trellis chart with multiple panels, each showing data for a different department. What attribute should be used to split the visualization?

Accepted Answer

Split by. In Splunk, a trellis chart (also called a small multiples chart) displays multiple panels of the same visualization, each representing a different subset of data. The 'Split by' attribute is used to divide the data into these subsets based on a field, such as department. This creates a separate panel for each distinct value of the specified field, allowing side-by-side comparison.

Answer

Overlay

Answer

Drilldown

Answer

Color

Question 8

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Accepted Answer

Use the 'fields' command to limit fields before transaction.. Option A is correct because placing the 'fields' command before 'transaction' reduces the amount of data carried into the transaction processing, lowering memory and CPU usage so the search runs faster. Option C is correct because replacing 'transaction' with 'stats' using values() and range() achieves similar grouping results without the high memory cost of transaction, which is the main cause of slowness with high event volume. Option B is wrong because 'keepevicted' retains evicted search results rather than freeing memory, which would not optimize a slow transaction search. Option D is wrong because the 'local' parameter is not a valid way to force processing onto a single indexer and does not address transaction performance. Option E is wrong because increasing maxspan would group more events into each transaction, increasing memory usage and making the search slower, not faster.

Answer

Use the 'keepevicted' option to free memory.

Answer

Use the 'local' parameter to process on a single indexer.

Answer

Increase the maxspan value to reduce the number of transactions.

Question 9

Refer to the exhibit. The search results show a large number of hosts, but the `limit=5` only shows the top 5. The eval statement fails with an error. Why?

Accepted Answer

The field names created by timechart are based on the host names, not `count_1`, etc.. The `timechart` command in Splunk dynamically creates field names based on the values of the split-by field (in this case, `host`). When you use `timechart count by host limit=5`, the resulting fields are named after the actual host names (e.g., `host1`, `host2`), not generic names like `count_1`. The subsequent `eval` statement fails because it references `count_1`, which does not exist as a field in the results.

Answer

The timechart span should be smaller to avoid too many fields.

Answer

Eval cannot be used after timechart.

Answer

The eval statement must use aggregation functions.

Question 10

A team wants to correlate events from different sourcetypes (web, db) on a common `sessionid`. They use `transaction sessionid` across both sourcetypes. The results show that some transactions are missing events. What is the most likely cause?

Accepted Answer

Timestamps from different sourcetypes are misaligned. Transaction search correlates events based on timestamps and fields; if timestamps from different sourcetypes are misaligned (e.g., due to time zone differences or clock skew), events may fall outside the transaction window, causing missing events. This is the most likely cause when correlating across sourcetypes.

Answer

The search is running at 'info' level instead of 'verbose'

Answer

maxevents is set too low

Answer

sessionid field has different names in each sourcetype

Question 11

A user reports that a macro named `my_macro` is not expanding in a search. The macro is defined in a private app called 'App_A'. The user is running the search in a different app called 'App_B'. What is the most likely cause of the issue?

Accepted Answer

The macro is not shared to the global context.. In Splunk, macros are scoped to the app where they are defined unless they are shared to the global context. A macro defined in a private app (App_A) is only available within that app. When a user runs a search in a different app (App_B), the macro will not be found unless it has been shared globally or exported to App_B. Therefore, the most likely cause is that the macro is not shared to the global context.

Answer

The macro has a syntax error that prevents expansion.

Answer

The user does not have permission to view the macro.

Answer

The macro name is case-sensitive and the user used wrong case.

Question 12

A security team notices that using `transaction` on a large dataset of firewall logs causes memory issues. Which alternative approach would most efficiently correlate events while reducing resource consumption?

Accepted Answer

Use `stats` by session_id list(src_ip), list(dest_ip) with `bin` time. Using `stats` with `bin` on time and grouping by session_id, then listing src_ip and dest_ip, is the most efficient alternative. The `stats` command is a streaming, memory-efficient aggregation that does not hold all events in memory like `transaction` does, and `bin` buckets events into time windows to approximate session grouping. This correlates events while dramatically reducing resource consumption.

Answer

Use `concurrency` command to group events

Answer

Increase `maxtransize` and `maxopentxn` in limits.conf

Answer

Use `append` with subsearch to join events

Question 13

Refer to the exhibit. What is the result of this search?

Accepted Answer

A table of users and their total counts, sorted by count descending, limited to 5 rows.. The search uses the `top` command, which by default returns the most common values of a field sorted by count in descending order, limited to 10 results. The `limit=5` parameter overrides the default to return only the top 5 users. The `countfield` option renames the count column to 'total', and the `showcount=f` hides the percent column, producing a table of users and their total counts sorted by count descending, limited to 5 rows.

Answer

A list of all users sorted by count ascending.

Answer

The first 5 events with failed password.

Answer

The top 5 users by username alphabetically.

Question 14

Match each Splunk component to its function.

Accepted Answer

Search Head: Distributes search requests and merges results from indexers.. In a Splunk distributed environment, the Search Head handles search distribution and result merging, the Indexer indexes and stores data, the Universal Forwarder collects and forwards data, and the Deployment Server manages configuration deployment. Common mistakes include swapping the roles of Search Head and Indexer, or confusing the Deployment Server with a forwarder.

Answer

Search Head: Indexes and stores incoming data.

Answer

Deployment Server: Lightweight forwarder that sends data to indexers.

Question 15

An analyst wants to group events by 'session_id' but only if the events occur within 5 minutes of each other, and there must be at least 2 events per transaction. Which transaction parameters achieve this?

Accepted Answer

transaction session_id maxpause=300 minevents=2. Maxpause=300 ensures events are within 5 minutes of each other, and minevents=2 ensures at least 2 events. Option A (maxspan=300) only limits total time. Option B (maxevents=2) limits event count but not grouping window. Option D (minpause) is not a valid parameter.

Answer

transaction session_id maxspan=300

Answer

transaction session_id maxspan=300 maxevents=2

Answer

transaction session_id maxspan=300 minpause=300