SPLK-1002 Practice Test 14 — 15 Questions

Question 1

Which TWO statements about lookup tables are true?

Accepted Answer

A lookup definition can include time-based expiration.. Options B and D are correct. B: A lookup definition can include time-based expiration, allowing lookups to automatically refresh after a specified period. D: Lookups can be defined from CSV files or KV store collections, providing flexibility in data sources. A is false because lookups can be defined by power users and administrators, not just administrators. C is false because lookups are case-insensitive by default, not case-sensitive. E is false because lookups can be used in multiple commands such as 'lookup', 'inputlookup', and 'outputlookup'.

Answer

Lookups can only be defined by administrators.

Answer

Lookups are case-sensitive by default.

Answer

Lookups can only be used in the 'lookup' command.

Question 2

A Splunk administrator wants to reduce maintenance effort when the same search logic is used in multiple saved searches. Which approach is most effective?

Accepted Answer

Define a macro that encapsulates the common search logic and reference the macro in each saved search.. Defining a macro allows you to encapsulate the common search logic in one place and reference it in multiple saved searches. This reduces duplication and maintenance effort, as changes only need to be made in the macro definition. Option B (CIM) normalizes data but does not directly reduce maintenance of repeated search logic. Option C (summary index) adds complexity and requires additional processing steps, which increases maintenance burden. Option D (report acceleration) improves performance but does not address reuse of search logic.

Answer

Use the Common Information Model (CIM) to normalize the data and then search using data model commands.

Answer

Create a summary index that contains the output of the common logic and have each saved search reference that summary index.

Answer

Enable report acceleration on each saved search to improve performance.

Question 3

Refer to the exhibit. What is the result of this search?

Accepted Answer

A table of users and their total counts, sorted by count descending, limited to 5 rows.. The search uses the `top` command, which by default returns the most common values of a field sorted by count in descending order, limited to 10 results. The `limit=5` parameter overrides the default to return only the top 5 users. The `countfield` option renames the count column to 'total', and the `showcount=f` hides the percent column, producing a table of users and their total counts sorted by count descending, limited to 5 rows.

Answer

A list of all users sorted by count ascending.

Answer

The first 5 events with failed password.

Answer

The top 5 users by username alphabetically.

Question 4

Which three of the following are benefits of using the Common Information Model (CIM)? (Choose THREE.)

Accepted Answer

Ensures consistent field naming across data sources.. The Common Information Model (CIM) normalizes data by ensuring consistent field naming across different data sources (A). It provides pre-built data models for common security and IT domains, accelerating development (B). Additionally, because CIM standardizes fields, dashboards and searches can be shared across environments that use the CIM (E). Option C is incorrect because while CIM can reduce the need for custom field extractions, it does not eliminate them entirely, and is not considered a primary benefit. Option D is incorrect because CIM does not automatically generate compliance reports; that requires additional configuration.

Answer

Reduces the need for custom field extractions.

Answer

Automatically generates reports for compliance.

Question 5

After upgrading Splunk to a new version, the Security team notices that the CIM Authentication dashboard is showing a much lower number of events than before. They verify that the data is still being indexed and that the sourcetype mappings to the Authentication data model are unchanged. The admin runs a search against the data model and sees some fields are missing. What is the most likely cause of the issue?

Accepted Answer

The data model acceleration needed to be rebuilt after the upgrade.. After an upgrade, data model acceleration may become stale and needs to be rebuilt. The acceleration caches field values, and if not rebuilt, it can lead to missing fields and lower event counts. Options B, C, and D are less likely because field definitions rarely change between minor upgrades, permissions affect visibility but not data content, and index configuration changes would affect all searches, not just the data model.

Answer

The upgrade changed the CIM field definitions, causing some extractions to fail.

Answer

The permissions on the data model were reset during the upgrade.

Answer

The index configuration changed, and the data is now in a different index.

Question 6

An admin creates a dashboard with a timechart panel that drills down to a search for that time range. The drilldown search works but does not include the time range. What is the likely cause?

Accepted Answer

The drilldown is set to 'search' without including tokens for time.. When a drilldown is configured as a simple search without tokens to pass the time range, the time range from the panel is not inherited. The drilldown performs a search using the default time range (e.g., All time) instead of the panel's time range. To include the time range, tokens like $earliest$ and $latest$ must be added to the drilldown search string. Options B, C, and D are incorrect: B would maintain the time if fixed, C affects the dashboard overall but not necessarily the panel's drilldown, and D would actually pass the time range correctly.

Answer

The timechart uses a fixed time range in the search string.

Answer

The dashboard's time input is disabled.

Answer

The drilldown is configured to use 'range' token but the panel's time range is not passed.

Question 7

An analyst observes that a lookup command with a large lookup file is causing the search to timeout. The lookup is used to extract additional fields based on a field value. What is the most effective immediate solution?

Accepted Answer

Reduce the lookup file size by removing unused columns or rows.. Reducing the lookup file size (by removing unused columns or rows) directly reduces the amount of data processed, improving performance and preventing timeouts. Option A (WILDCARD match) can worsen performance due to pattern matching overhead. Option C (inputlookup) loads the entire table, which would be even slower and exacerbate the timeout. Option D (increasing search timeout) does not address the root cause of slow data processing.

Answer

Change the match_type to WILDCARD to be more flexible.

Answer

Use the inputlookup command to load the entire table.

Answer

Increase the search timeout in limits.conf.

Question 8

Refer to the exhibit. What happens when a user clicks on a status value in the table?

Accepted Answer

The chart updates to show methods for that status. Clicking a status value sets a token ($selected_status$) that triggers a search refresh for the chart panel, which depends on that token. This causes the chart to update to show methods for the selected status. The table does not change because it has no dependency on the token. Option A is incorrect because the token is indeed used and the chart updates. Option B is incorrect because only the chart updates, not the table. Option C is incorrect because the table does not filter; only the chart updates.

Answer

Nothing happens; the token is not used

Answer

Both the table and chart update

Answer

The table filters to show only events with that status

Question 9

A company needs to enrich search results with additional fields from a CSV file. Which method should they use to define the lookup table so that it is available in all searches?

Accepted Answer

Define the lookup in transforms.conf with a filename and field mapping.. To make a lookup table available in all searches, the lookup definition must be created in transforms.conf. This file defines the lookup table filename, field mapping, and other properties. Once defined, the lookup can be used with the lookup command, the inputlookup command, or automatic lookups configured in props.conf. Option C correctly identifies this requirement.

Answer

Define the lookup in props.conf with an automatic lookup stanza.

Answer

Use the inputlookup command in a search.

Answer

Use the lookup command with the file path.

Answer

Use the eval command with the lookup function directly in search.

Question 10

An organization is implementing the Splunk Common Information Model (CIM) to normalize data. They have a source that provides event data with field names `src_ip` and `dst_ip`. To map these to CIM fields, which knowledge object should be created?

Accepted Answer

A field alias to create `src` from `src_ip` and `dest` from `dst_ip`. Field aliases allow mapping source-specific field names (src_ip, dst_ip) to CIM-standard field names (src, dest) without modifying raw data. Option A (tags) are for categorization, not field mapping. Option B (field extraction) extracts new fields but cannot rename existing ones. Option D (calculated fields) compute new fields from expressions, but simple renaming is better handled by aliases.

Answer

A tag to tag events with `src_ip` and `dst_ip` as network traffic

Answer

A field extraction to rename `src_ip` to `src` and `dst_ip` to `dest`

Answer

A calculated field to set `src=src_ip` and `dest=dst_ip`

Question 11

Which TWO components must be configured to enable an automatic lookup that populates fields at index time?

Accepted Answer

transforms.conf to define the lookup table and the field mapping.. Options A and D are correct. transforms.conf defines the lookup table and field mapping, and props.conf specifies which sourcetype should use the lookup automatically at index time. Option B is incorrect because the lookup table file must be placed in the 'lookups' directory of the app, not 'lookup' (typo) and also the file placement is necessary but not sufficient for automatic lookup; configuration files are required. Option C is incorrect because indexes.conf is for index configuration, not lookups. Option E is incorrect because lookups can be defined via configuration files, not only via Splunk Web.

Answer

The lookup table file must be placed in the lookup directory of the app.

Answer

indexes.conf to enable lookup acceleration.

Answer

The lookup must be defined via the Lookups menu in Splunk Web only.

Question 12

A saved search is configured with a schedule but is not triggering at the expected time. The admin checks the "Job Inspector" and sees that the scheduled search is "skipped". What is a common reason for a scheduled search to be skipped?

Accepted Answer

There are too many concurrent searches scheduled. Splunk can skip scheduled searches if there are too many concurrent searches due to scheduling limits. Option A would cause a failure, not skip. Option C might affect performance but not cause a skip. Option D real-time searches are not scheduled, so that is not relevant.

Answer

The search time range exceeds the bucket's time range

Answer

The search is configured as a real-time search

Answer

The search string has a syntax error

Question 13

A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?

Accepted Answer

index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5. Option D is correct because it uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories. Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.

Answer

Answer

index=main | top category | eval avg=avg(response_time) | where count>=100

Answer

index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

Question 14

A macro is defined as `mysearch` with definition `index=main | stats count by $source_type$`. The macro is invoked as `| `mysearch(access_combined)` but the search never finishes. What is the likely issue?

Accepted Answer

The macro definition uses a named argument but the invocation passes an unnamed argument. The macro definition uses `$source_type$` which is a named argument. In the invocation `| `mysearch(access_combined)``, the argument is passed positionally without the argument name. For named arguments, the invocation must specify the argument name, like `source_type=access_combined`. This mismatch causes the macro to treat `$source_type$` as a literal string instead of substituting the passed value, leading to the search never finishing because it's probably looking for a field that doesn't exist. Option B is incorrect because the quotes are not the issue; the problem is the positional vs. named argument mismatch. Option A is incorrect because there is no syntax error in the definition. Option D is incorrect because a filter is not required before stats.

Answer

The macro definition contains a syntax error

Answer

The macro argument should not be in quotes

Answer

The macro definition requires a filter before the stats command

Question 15

A Splunk administrator is asked to create a dashboard that shows the top 10 source IPs by count of failed logins over the past week. The data is already CIM-compliant and uses the Authentication data model. Which search is most appropriate?

Accepted Answer

| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src limit 10. It uses the tstats command on the Accelerated Authentication data model, filters for Authentication.action=failure, and uses the src field (CIM-compliant source IP) with a limit of 10 to get the top source IPs by failed logins. Option B is incorrect because summaryonly=true prevents retrieval of individual event counts needed for the top 10, and the action field is not fully qualified as Authentication.action. Option C is incorrect because the datamodel command is less efficient than tstats for accelerated data models, and using top on the full dataset is resource-intensive. Option D is incorrect because it does not leverage the CIM data model acceleration and searches across all sourcetypes, which may include non-authentication data, making it less accurate.

Answer

| tstats summaryonly=true count from datamodel=Authentication where action=failure by src

Answer

| datamodel Authentication search | search action=failure | top src

Answer

| search sourcetype=* authentication action=failure | stats count by src | sort - count | head 10