SPLK-1002 Practice Test 14 — 15 Questions

Question 1

Which Common Information Model (CIM) data model is appropriate for standardizing authentication events?

Accepted Answer

Authentication. The Authentication data model in the Splunk CIM is purpose-built to normalize authentication-related events such as logins, logouts, and failed authentication attempts. It defines fields like user, src, dest, action, and app that security teams use for consistent correlation across disparate identity sources. This makes it the correct choice for standardizing authentication events.

Answer

Change Analysis

Answer

Network Traffic

Answer

Endpoint

Question 2

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

Accepted Answer

It limits the number of transactions that can be open simultaneously in memory.. The maxopentxn parameter in the transaction command specifies the maximum number of open transactions that Splunk will keep in memory at any given time during the transaction grouping process. When this limit is reached, Splunk will close the oldest open transactions to free up memory, ensuring that the search does not consume excessive resources. This is particularly important when dealing with large datasets where many transactions might be open concurrently, as it prevents memory exhaustion and maintains search performance.

Answer

It limits the total number of transactions in the search results.

Answer

It limits the number of events per transaction.

Answer

It limits the time span of open transactions.

Question 3

Order the steps to create a workflow action in Splunk.

Accepted Answer

Navigate to Settings > Fields > Workflow actions, click New, specify Label, Action type, and URI with field references, then click Save.. Workflow actions are created by specifying a label, action type, and URI with field references.

Answer

Click New, then navigate to Settings > Fields > Workflow actions, specify Label, Action type, and URI with field references, then click Save.

Answer

Navigate to Settings > Fields > Workflow actions, specify Label, Action type, and URI with field references, then click New, then click Save.

Answer

Navigate to Settings > Fields > Workflow actions, click New, click Save, then specify Label, Action type, and URI with field references.

Question 4

Match each Splunk search mode to its behavior.

Accepted Answer

Fast: Optimized for speed and returns only aggregate data.. Search modes control Splunk's behavior: Fast for speed (summary data), Verbose for completeness (all data), Smart as default balance. Common confusions involve swapping these definitions.

Answer

Fast: Returns all fields and all events.

Answer

Verbose: Optimized for speed.

Answer

Smart: Returns only summary data.

Question 5

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 6

A saved search is configured to run every 5 minutes and send an alert when the count of failures exceeds 10. After several days, users report they are not receiving alerts even though failures are occurring. The saved search runs successfully and produces results. What is the most likely cause?

Accepted Answer

Alert throttling is enabled and suppressing subsequent alerts.. The most likely cause is that alert throttling is enabled and suppressing subsequent alerts. Throttling limits the number of alerts triggered by a saved search within a specified period. If the search runs every 5 minutes and failures exceed 10 frequently, throttling may suppress alerts after the first one, preventing users from receiving further notifications.

Answer

The saved search owner does not have permission to send alerts.

Answer

The alert action is not configured to send to the intended recipients.

Answer

The alert condition is set to trigger when count is less than 10.

Question 7

An analyst needs to correlate events from two different data sources (web logs and database logs) based on a common session ID. The events occur within a short time window of 5 seconds. Which command is most appropriate?

Accepted Answer

transaction sessionid maxspan=5s. The transaction command groups events that share a common field value (sessionid) into a single transaction, and the maxspan=5s argument limits the maximum time between the first and last event in a transaction to 5 seconds. This directly matches the requirement to correlate web and database logs by session ID within a 5-second window.

Answer

transaction sessionid

Answer

join type=inner sessionid [search index=db]

Answer

append [search index=db]

Question 8

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 9

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Accepted Answer

It improves the ability to correlate events from different technologies.. Option A is correct because CIM normalizes data from disparate sources into a common schema of event categories, tags, and field names, which lets Splunk correlate activity across different technologies (for example, matching a firewall event with an authentication event on shared fields like src, dest, and user). Option B is correct because CIM's standardized field names (such as src, dest, user, action) allow a single search or data model to query many different sourcetypes without rewriting field references per source. Option C is not a CIM benefit: pre-aggregation for performance is provided by data model acceleration and summary indexing, not by CIM itself. Option D is not a CIM function: CIM supplies the normalized schema, while security monitoring use cases come from apps like Splunk Enterprise Security and its correlation searches. Option E is incorrect because CIM still requires field extractions or aliases to map raw fields to CIM-compliant names; it standardizes the target schema but does not remove the need for extraction work.

Answer

It improves search performance by pre-aggregating data.

Answer

It provides built-in security monitoring use cases.

Answer

It eliminates the need for custom field extractions.

Question 10

A Splunk administrator wants to create a static lookup table from a search result. Which approach is recommended?

Accepted Answer

Use the `outputlookup` command to save the search result as a CSV file.. The `outputlookup` command is specifically designed to write the results of a Splunk search to a lookup file, typically in CSV format, which can then be used as a static lookup table. It creates or overwrites the lookup file in the Splunk lookups directory (e.g., `$SPLUNK_HOME/etc/apps/<app>/lookups/`). This is the recommended and most efficient way to generate a static lookup from search results, as it directly materializes the data without manual intervention.

Answer

Use `inputlookup` to write to a CSV file.

Answer

Use the `lookup` command to create the file.

Answer

Manually copy the results into a spreadsheet and upload as CSV.

Question 11

An analyst needs to create a visualization that shows the relationship between source IP and destination port in network traffic. Which visualization type is most appropriate?

Accepted Answer

Sankey diagram. A Sankey diagram is ideal for visualizing the flow and relationship between two categorical fields, such as source IP and destination port. It shows the magnitude of flows between nodes, making it easy to see which source IPs communicate with which destination ports and the volume of traffic. This matches the analyst's need to show the relationship between source IP and destination port.

Answer

Choropleth map

Answer

Single value

Answer

Column chart

Question 12

A dashboard developer wants to display the count of errors over the last 24 hours with a line chart. Which search command should be the final command before the visualization?

Accepted Answer

timechart. The `timechart` command is designed to create time-series data, aggregating results into time buckets and producing a table suitable for a line chart. It automatically generates a `_time` field and is the standard command for displaying metrics over time, such as error counts over the last 24 hours. Therefore, `timechart` should be the final command before the visualization.

Answer

chart

Answer

trendline

Answer

stats

Question 13

A Splunk admin is tasked with creating a dashboard that shows the average response time per server over the last hour, updated every 60 seconds. The data comes from a sourcetype 'app_log' with fields: server, response_time. The admin wants to use a single search with a timechart and set the dashboard's time range picker to 'Last 60 minutes'. However, the chart shows only one data point (the average for the entire hour) instead of per-minute intervals. What is the most likely cause and solution?

Accepted Answer

The timechart command does not have a span specified; add | timechart span=1m avg(response_time) by server. The `timechart` command without an explicit `span` defaults to a single bucket for the entire search time range when the range is fixed (e.g., 'Last 60 minutes'). By adding `span=1m`, you force the command to create 1-minute buckets, producing a data point per minute. This is the most direct fix for the described behavior.

Answer

The dashboard uses a summary index; switch to a base search

Answer

The search is not set to real-time; change to a real-time search

Answer

The dashboard time range picker is set to 'All time'; change to 'Last 60 minutes'

Question 14

An analyst wants to calculate the average response time for each web server, but only for requests that returned status code 200. Which search accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(response_time) by host. It first filters events with `status=200` (only successful requests), then uses `stats avg(response_time) by host` to compute the average response time per web server. This ensures the aggregation is performed only on the relevant subset of data, matching the requirement precisely.

Answer

index=web sourcetype=access status=200 | sort host | stats avg(response_time)

Answer

index=web sourcetype=access | eval avg_time=avg(response_time) by host | where status=200

Answer

index=web sourcetype=access | stats avg(response_time) by host | search status=200

Question 15

A Splunk admin is accelerating a CIM data model for the "Network_Traffic" dataset. After acceleration, some searches that use the data model are slower than expected. What is the most likely reason?

Accepted Answer

The acceleration summary range is set too low. Data model acceleration builds summary datasets over a defined time range (the 'acceleration summary range'). If this range is set too low (e.g., 1 day when searches query 7 days), searches outside the accelerated window fall back to raw event scanning, making them slower than expected. Increasing the summary range to cover the query window restores acceleration benefits.

Answer

The acceleration uses too many fields

Answer

The data model acceleration is not compatible with the CIM

Answer

Searches are not using the `| datamodel` command correctly