SPLK-1002 Practice Test 15 — 15 Questions

Question 1

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Accepted Answer

maxspan. maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Answer

mvcount

Answer

maxpause

Answer

keepevicted

Question 2

Which of the following are characteristics of the Splunk Common Information Model (CIM)? (Choose three.)

Accepted Answer

It requires the installation of the Splunk Common Information Model Add-on. Options B, C, and D are correct. B: The CIM requires the installation of the Splunk Common Information Model Add-on. C: Data models defined in the CIM can be accelerated to improve search performance. D: It provides a set of standard field names and tags for different data sources. A is false: The CIM does not automatically rename all fields; it uses field aliases and tagging to map data to the standard. E is false: The CIM provides data models and field standardization, not predefined dashboards (dashboards are provided by other apps like the Splunk App for Enterprise Security).

Answer

The CIM automatically renames all fields in incoming data to match its standard

Answer

The CIM includes predefined dashboards and reports

Question 3

An admin notices that a saved search with a scheduled alert is not triggering as expected even though the search returns results. The search uses a macro with arguments. Which troubleshooting step should the admin take first?

Accepted Answer

Review the macro definition for syntax errors, such as missing brackets or incorrect argument references.. When a saved search using a macro with arguments fails to trigger despite returning results, the admin should first review the macro definition for syntax errors (Option B). Common issues include missing brackets, incorrect argument references, or improper use of pipe characters within the macro. This is the most direct troubleshooting step because the macro may be defined incorrectly, causing the alert to fail even though the search itself returns results when run manually. Option A (name conflicts) is possible but less likely and should be checked after syntax. Option C (permissions) is irrelevant if the macro is used in a saved search that already runs. Option D (job inspector) is useful for deeper analysis but not the first step.

Answer

Ensure that the macro name does not conflict with existing commands or other macros.

Answer

Verify the macro's permissions are set to global.

Answer

Check the search head's job inspector for the expanded search string.

Question 4

A security team has a saved search that runs every 5 minutes and looks for 'FAILED' events in Windows Security logs. The search uses a macro 'failed_logins' defined as: `define failed_logins() [search index=windows sourcetype=WinEventLog:Security EventCode=4625]`. Recently, the team noticed that the search is returning no results even though there are failed login events. What is the most likely issue?

Accepted Answer

The macro definition includes empty parentheses 'failed_logins()' but is being called without parentheses, causing Splunk to treat it as a different macro.. The macro is defined with parentheses 'failed_logins()', indicating it expects an argument, but when it is called in the saved search, it is likely called without parentheses (e.g., `failed_logins`). In Splunk, a macro defined with parentheses must be called with parentheses even if no arguments are passed; otherwise, Splunk treats it as a different macro. This causes the search to not expand the macro, leading to no results. Option B is incorrect because permissions are not the issue if it worked before. Option C is incorrect because macros can be called with a pipe, not backticks. Option D is incorrect because wildcards in sourcetype are allowed.

Answer

The macro does not have read permissions for the security team.

Answer

The macro must be called with backticks like `failed_logins` instead of pipe.

Answer

The sourcetype field is using a wildcard, which is deprecated.

Question 5

Which of the following are valid ways to define a macro in Splunk? (Choose two.)

Accepted Answer

Using named arguments like $field$ in the definition, with the argument names defined in the macro properties. Options C and E are correct ways to define a macro in Splunk. Macros can use named arguments (e.g., $field$) with argument names defined in the macro properties, or positional arguments (e.g., $1$, $2$) that are referenced by position. Option A is incorrect because the `macro` command does not exist; macros are defined in Settings > Advanced Search > Search Macros. Option B is incorrect because there is no `| macro` search command. Option D is incorrect because there is no `define` command for macros; macros are defined in the knowledge object settings.

Answer

Using the `macro` command in a saved search

Answer

Using the `| macro` command in a search

Answer

Using the `define` command in the search bar

Question 6

Which TWO statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

The 'transaction' command can include events from multiple sourcetypes.. Options C and D are correct. The `transaction` command groups events based on common field values and time proximity, and it can include events from multiple sourcetypes. Option A is false because `transaction` can be used with `stats` (e.g., `... | transaction ... | stats count`). Option B is false because `transaction` works on any field, not just indexed fields. Option E is false because `transaction` does not require events to be from the same host; it can group events across different hosts if they share common field values.

Answer

The 'transaction' command cannot be used with the 'stats' command.

Answer

The 'transaction' command only works on indexed fields.

Answer

The 'transaction' command requires all events to be from the same host.

Question 7

An analyst creates a macro that uses `| inputlookup` to validate a macro argument. Which statement about macro validation is true?

Accepted Answer

The macro can use `| inputlookup` to define a list of valid values for an argument.. Macros can use `| inputlookup` within their definition to validate arguments by checking against a lookup table. Option A is incorrect because macro validation is possible using lookups. Option C is incorrect because validation is implemented within the macro, not in the saved search. Option D is incorrect because macros do not support regex validation; they rely on lookups for argument validation.

Answer

Macro validation is not possible; arguments are always trusted.

Answer

Macro validation must be implemented in the saved search that uses the macro.

Answer

Macro arguments can be validated using regular expressions inside the definition.

Question 8

A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?

Accepted Answer

Transaction command requires at least one field to group events into sessions.. The transaction command requires at least one field (like src_ip) to group events into sessions; without a grouping field, events cannot be correlated. Option C is correct because the transaction command can define transaction boundaries using startswith and endswith conditions, enabling detection of a sequence like failed login followed by successful login. Option A is incorrect because transaction is not optimized for very long time ranges; it can be resource-intensive and is better suited for shorter windows. Option D is incorrect because transaction does not require identical timestamps; events can span time. Option E is incorrect because transaction does not automatically deduplicate events; you would need the dedup command for that.

Answer

Transaction command is optimized for correlating events over very long time ranges (over 24 hours).

Answer

Transaction command can only be used with events that have identical timestamps.

Answer

Transaction command automatically deduplicates events within a transaction.

Question 9

Refer to the exhibit. The search returns no transactions even though there are login and logout events in the index. What is the most likely cause?

Accepted Answer

The transaction command may be timing out due to large data volume.. When the transaction command processes a large volume of data, it may exceed the default memory or time limits, causing the search to complete without returning any results. This is a common issue with transaction, especially when there are many events to correlate. Option A is incorrect because the maxpause value is not specified in the exhibit; if it were too short, events close together might be missed, but no transactions at all suggests a different problem. Option B is incorrect because any misspelling in startswith or endswith would typically prevent the search from running or cause syntax errors. Option C is incorrect because the sourcetype appears to be present in the events; the issue is not about missing sourcetype.

Answer

The maxpause value is too short.

Answer

The startswith and endswith options are mispelled.

Answer

The sourcetype is incorrect.

Question 10

Refer to the exhibit. The eval command combines two fields into one. What is a potential issue with this search?

Accepted Answer

If an event has both sessionid and correlation_id, the coalesce may create a new value that does not match other events.. If an event has both sessionid and correlation_id, the coalesce function will use the first non-null value. However, if the two fields have different values for the same logical session, coalesce may produce a value that does not correspond to any existing field value, causing other events in the transaction to not match. Option A is false because eval syntax is fine. Option B is false because transaction can be used after eval. Option C is false because maxspan can be placed before transaction.

Answer

The eval command may cause syntax errors.

Answer

Transaction does not allow eval before it.

Answer

The maxspan should be after the transaction command.

Question 11

An administrator runs a transaction command that groups events by a customer ID but notices that some transactions are missing expected events. The log shows that the events are present and within the maxpause. What could be the reason?

Accepted Answer

Events are from different hosts or sources.. The transaction command, by default, groups events not only by the specified 'by' fields but also by host, source, and sourcetype. If events for the same customer ID originate from different hosts or sources, they are treated as separate transactions. This explains why some transactions are missing expected events despite the events being present and within the maxpause. Option A correctly identifies this common pitfall. Option B is incorrect because startswith and endswith define transaction boundaries and do not conflict here. Option C is incorrect because the 'fields' option is not required; without it, the default grouping includes host and source, which causes the issue. Option D is incorrect because the maxpause is explicitly stated to be adequate.

Answer

The startswith and endswith are conflicting.

Answer

The fields option is missing.

Answer

The maxpause value is too short.

Question 12

Which THREE statements about the `transaction` command are true?

Accepted Answer

It can correlate events from different sourcetypes. Correct: A, C, D. A is true because the `transaction` command can correlate events from different sourcetypes into a single transaction. C is true because `transaction` sorts events within each transaction by `_time` to ensure chronological ordering. D is true because `transaction` can correlate events across multiple indexes. B is false because the `maxevents` option limits the maximum number of events per transaction, not the number of unique field values. E is false because `transaction` does not produce summary indexing output by default; it outputs events with a calculated duration field.

Answer

The maxevents option limits the number of unique field values per transaction

Answer

Transaction always produces summary indexing output

Question 13

You need to find the percentage of total events contributed by each sourcetype. Which command should follow index=* | stats count by sourcetype?

Accepted Answer

eventstats sum(count) as total | eval percent = count/total*100. `eventstats sum(count) as total` adds a new field 'total' containing the sum of the count field across all events, and then `eval percent = count/total*100` computes the percentage for each sourcetype. Option A (`addtotals`) adds row totals, not a column total, so it cannot be used to compute percentages of total. Option C uses `sum(count)` inside `eval`, which is a statistical function not available in `eval`. Option D (`appendpipe`) appends a row with the total, not a column, making the calculation incorrect because the total is not available per event in the subsequent `eval`.

Answer

addtotals

Answer

eval percent = count / sum(count) * 100

Answer

appendpipe [stats sum(count) as total] | eval percent = count/total*100

Question 14

A security analyst wants to find IP addresses that have been involved in both login failures and successful logins within a 5-minute window. Which approach is most efficient?

Accepted Answer

Using the transaction command. Using the transaction command. The transaction command groups events from the same IP address (or other field) within a specified time window, such as 5 minutes, making it ideal for correlating login failures and successes from the same source. Option B (appendcols) is inefficient because it requires manual field matching and does not handle time windows. Option C (subsearch) is resource-intensive and not designed for event correlation across time. Option D (stats with values) can aggregate fields but cannot guarantee temporal proximity between events. Thus, transaction is the most efficient and appropriate command for this scenario.

Answer

Using the appendcols command

Answer

Using a subsearch

Answer

Using the stats command with values

Question 15

A Splunk admin notices that a search using the transaction command takes too long. To debug, they want to see how events are grouped into transactions before the transaction command runs. Which command can be added to the search pipeline before transaction to inspect the grouping?

Accepted Answer

streamstats. Streamstats can be used to compute a transaction ID based on a time window or field change, allowing you to see how events would be grouped before the transaction command runs. Options A, B, and C do not help inspect grouping: map runs a subsearch per result, fields removes fields, and transaction is the command being debugged.

Answer

map

Answer

fields

Answer

transaction