SPLK-1002 Practice Test 18 — 15 Questions

Question 1

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. Option D is correct because the Common Information Model (CIM) in Splunk is used to define tags and event types that categorize data into standardized models, enabling consistent searching and reporting across diverse data sources. Option E is correct because the CIM's core purpose is to normalize data from different sources into a common field naming convention, so that fields like src, dest, and user have consistent meanings regardless of the original sourcetype. Options A, B, and C are incorrect because user roles and permissions are handled by Splunk's role-based access control (RBAC) and authentication configuration, license usage is managed through the licensing manager and license pools, and creating indexes is an index management task; none of these are functions of the CIM.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 2

A security analyst runs the following search across a 24-hour window:

index=firewall action=blocked
| stats count by src_ip
| sort - count
| head 10

The job completes but returns a single row where src_ip is NULL and count is 48213. The analyst expected ten distinct blocked source addresses. Which explanation best accounts for the single NULL row?

Accepted Answer

The src_ip field is not extracted at search time because no field extraction is defined for the firewall sourcetype, so every event falls into a single bucket whose key is NULL.. The stats command groups events by the BY clause value, and events lacking that field are aggregated into one group whose key is null rather than being excluded. A firewall sourcetype with no defined src_ip extraction therefore yields one NULL row summing every blocked event. Verifying the extraction with a raw event or field summary confirms the diagnosis before rebuilding the search.

Answer

The stats command silently drops events whose BY field is null unless the fillnull command is applied beforehand.

Answer

The sort command cannot order results when a field contains null values, so it collapsed all groups into one row.

Answer

The head command is discarding the first nine groups and displaying only the residual NULL bucket that sort placed last.

Question 3

A Splunk power user maintains a macro named `net_flow_summary` whose definition is `stats sum(bytes) as total_bytes by src, dest`. Several scheduled saved searches invoke it as `` `net_flow_summary(dest)` `` and have run successfully for weeks. A new saved search invokes the same macro as `` `net_flow_summary(src, dest)` `` and fails with an error about argument count. What is the most likely cause?

Accepted Answer

The macro definition must be updated to `stats sum(bytes) as total_bytes by $1$, $2$` so it can accept two arguments.. A macro accepts only as many arguments as its definition references through positional tokens such as $1$ and $2$. Because this definition uses only $1$, it is a one-argument macro, and invoking it with two comma-separated values produces an argument-count error. Updating the definition to reference both $1$ and $2$ aligns the macro with the new invocation.

Answer

Argument values passed to a macro must be enclosed in quotes, so the invocation should be `` `net_flow_summary("src", "dest")` ``.

Answer

Macros that contain a `stats` command cannot be invoked from scheduled saved searches and must be run ad hoc first.

Answer

The macro must be converted from an eval-based macro to a search-based macro before it can accept multiple arguments.

Question 4

A fraud analyst runs this search:

index=transactions
| stats sum(amount) AS total BY account_id
| where total > 10000
| sort - total

The analyst now wants to add each account's transaction count and its average transaction size to the same result set, without running a second search or changing the grouping. Which change accomplishes this?

Accepted Answer

Replace the stats clause with: stats sum(amount) AS total, count AS txn_count, avg(amount) AS avg_amount BY account_id. A single stats clause can host several aggregation functions separated by commas, and every function is evaluated independently for each BY group. Adding count and avg(amount) next to sum(amount) enriches each account row with the extra metrics in the same pass, leaving the where filter and descending sort fully valid. Approaches that compute running totals or that run after the raw events are gone cannot supply final per-account values.

Answer

Add: | addtotals txn_count avg_amount before the where clause

Answer

Add: | streamstats count AS txn_count, avg(amount) AS avg_amount BY account_id before the stats clause

Answer

Append: | eventstats count AS txn_count, avg(amount) AS avg_amount after the existing stats clause

Question 5

A Splunk user wants to create a report that shows the number of events per hour for the past 24 hours, with a separate line for each host. Which search should the user run?

Accepted Answer

index=main earliest=-24h | timechart span=1h count BY host. The timechart command is specifically designed to create time-based charts. Using span=1h ensures hourly buckets, and BY host separates the data into one line per host. The earliest=-24h limits the search to the past 24 hours. This combination directly fulfills the requirement for a per-hour event count per host over the last day.

Answer

index=main earliest=-24h | stats count BY host, date_hour

Answer

index=main earliest=-24h | chart count OVER _time BY host

Answer

index=main earliest=-24h | timechart count BY host

Question 6

A SOC analyst wants a single table showing, for each sourcetype, both the total number of events and the number of distinct host values, but only for sourcetypes that produced more than 500 events. Which search is correct?

Accepted Answer

index=main | stats count AS events, dc(host) AS hosts BY sourcetype | where events > 500. Filtering on the output of an aggregation requires the comparison to occur after the aggregation stage. Using stats to compute count and dc(host) by sourcetype, then where to test the resulting events field, yields one row per qualifying sourcetype with both metrics. Raw-event filters cannot reference a field that stats has not yet produced, and eventstats leaves the data at event granularity rather than summarizing it.

Answer

index=main | stats count AS events, dc(host) AS hosts BY sourcetype | search events > 500

Answer

index=main | eventstats count AS events, dc(host) AS hosts BY sourcetype | where events > 500

Answer

index=main events>500 | stats count AS events, dc(host) AS hosts BY sourcetype

Question 7

A power user needs to calculate the average duration of sessions per user, but the session duration is stored as a string field 'duration' in the format 'HH:MM:SS'. Which SPL search correctly computes the average duration per user?

Accepted Answer

index=sessions | eval parts = split(duration, ":") | eval seconds = tonumber(mvindex(parts,0))*3600 + tonumber(mvindex(parts,1))*60 + tonumber(mvindex(parts,2)) | stats avg(seconds) as avg_seconds by user. To average a duration stored as a string in 'HH:MM:SS' format, it must first be converted to a numeric value representing seconds. The correct approach splits the string into components, multiplies each by the appropriate factor, sums them, and then uses stats avg() on the numeric field. This yields the accurate average duration per user.

Answer

index=sessions | eval seconds = strptime(duration, "%H:%M:%S") | stats avg(seconds) as avg_seconds by user

Answer

index=sessions | stats avg(duration) as avg_duration by user

Answer

index=sessions | eval seconds = tonumber(strptime(duration, "%H:%M:%S")) | stats avg(seconds) as avg_seconds by user

Question 8

A Splunk administrator needs to create a macro named `get_errors` that filters events where the `log_level` field equals `ERROR`. The macro will be used frequently in ad-hoc searches by the security team. The administrator wants the macro to be available to all users but only editable by members of the `admin` role. Which of the following is the correct configuration for the macro's permissions?

Accepted Answer

Set the macro's sharing to App and assign read permissions to all roles, and write permissions only to the admin role.. The macro must be usable by all users but editable only by admins. Sharing it at the app level with read permissions for all roles and write permissions for the admin role achieves this. Splunk's permission model separates read and write access, allowing granular control. Global sharing would extend beyond the app, and private sharing would limit usage.

Answer

Set the macro's sharing to App and assign read and write permissions to all roles.

Answer

Set the macro's sharing to Private and then manually share it with each user.

Answer

Set the macro's sharing to Global and assign read and write permissions to the admin role only.

Question 9

A Splunk power user needs a reusable search snippet that accepts a hostname as an argument and returns the average CPU usage for that host. The snippet will be used in multiple saved searches and dashboards. The user wants to ensure that when the macro is invoked without specifying the hostname, it defaults to 'web01'. Which of the following is the correct way to define the macro?

Accepted Answer

Create a search macro with arguments: hostname=web01, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$`. To provide a default value for a macro argument, the argument must be defined with an equals sign and the default value, such as hostname=web01. This allows the macro to be invoked with or without that argument, using the default when omitted. The other options do not correctly set a default for the macro argument.

Answer

Create a search macro with arguments: hostname, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$ | fillnull value="web01" hostname`

Answer

Create a search macro with arguments: hostname, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$`

Answer

Create a search macro with arguments: hostname, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$ | eval hostname="web01"`

Question 10

A Splunk Power User wants to create a macro that returns the top 5 values of a field, where the field name is passed as an argument, and the result should be sorted in descending order. The macro should be reusable across multiple searches. Which macro definition will accomplish this?

Accepted Answer

`stats count by $field$ | sort - count | head 5`. The macro should return the top 5 values of a field, which in Splunk typically means the most frequent values. Using stats count by the field, sorting by count descending, and limiting to 5 achieves this. This definition is parameterized with $field$, making it reusable. Other options either sort by field value rather than count, or do not aggregate counts, thus not meeting the common interpretation.

Answer

`sort - $field$ | head 5`

Answer

`top $field$ limit=5`

Answer

`dedup $field$ | sort - $field$ | head 5`

Question 11

A compliance officer needs to identify users who have not logged in during the past 30 days. The authentication index contains events with user and action=success. Which search correctly returns users with no successful login in the last 30 days?

Accepted Answer

index=auth earliest=-30d | stats count(eval(action="success")) AS successes BY user | where successes=0. To find users with zero successful logins, the search must include all users from the period, not just those with successes. Using eval inside stats to count successes per user, then filtering for a count of zero, correctly identifies users who never had a successful login in the last 30 days.

Answer

index=auth action=success earliest=-30d | append [search index=auth earliest=-30d | stats count BY user] | stats count BY user | where count=0

Answer

index=auth earliest=-30d | stats count BY user, action | where action!="success"

Answer

index=auth action=success earliest=-30d | stats count BY user | where count=0

Question 12

A Power User is building a dashboard that uses a lookup to enrich event data with a `priority` field from `priority_map.csv`. The lookup definition is named `priority_lookup` and matches on the `severity` field. The dashboard's base search returns events with a `severity` field, but the `priority` field is not appearing in the results. The Power User confirms the CSV is correctly formatted and the lookup definition is configured. Which SPL command should be added to the search to include the `priority` field?

Accepted Answer

`| lookup priority_lookup severity`. The `lookup` command is the correct way to enrich events with fields from a lookup table. By specifying the lookup definition name and the match field, Splunk will add the corresponding fields from the CSV to each event where the match field values align. This is the standard method for lookup enrichment in dashboards and searches, ensuring the `priority` field appears alongside event data.

Answer

`| outputlookup priority_lookup`

Answer

`| inputlookup priority_lookup`

Answer

`| join severity [inputlookup priority_lookup]`

Question 13

A Splunk power user is working with the Common Information Model (CIM) and needs to ensure that a custom sourcetype for a new application is properly mapped to the Authentication data model. The application logs contain fields: user, src_ip, action, and status. The user wants to create a tag and event type to facilitate this mapping. Which of the following is the correct approach?

Accepted Answer

Create an event type that matches the sourcetype, then add the tag 'authentication' to the event type, and ensure the fields are aliased to the CIM field names using field aliases.. The correct approach involves creating an event type with the appropriate tag and using field aliases to map custom fields to CIM field names. This ensures the data model can correctly identify and normalize the events. The other options either misplace tags or rely on automatic mapping that does not exist without proper configuration.

Answer

Create an event type that matches the sourcetype, then add the tag 'authentication' to the event type, and use the CIM add-on to automatically map the fields based on field names.

Answer

Create a field alias for each field to match the CIM names, then add the tag 'authentication' to the sourcetype using the Tags field in the sourcetype configuration.

Answer

Create a tag named 'authentication' and apply it directly to the sourcetype, then use the CIM editor to manually map fields.

Question 14

A network operations team has a lookup file named device_owners.csv that maps device_id to owner_name, but the file is updated nightly by an automated script. The field device_id appears in their firewall logs as src_device. They need searches to automatically return owner_name for each event without using the lookup command in every search. Which configuration should they use?

Accepted Answer

Create an automatic lookup that maps src_device to device_id in device_owners.csv and outputs owner_name.. Automatic lookups are configured in Settings > Lookups > Automatic lookups and apply to all searches without requiring the lookup command. By matching the event field src_device to the CSV column device_id and outputting owner_name, the lookup enriches events at search time. This satisfies the need for automatic, nightly-updated enrichment without editing individual searches.

Answer

Define a field alias so that src_device is renamed to device_id, then use the lookup command in each search.

Answer

Use a calculated field that concatenates src_device with values from the CSV file.

Answer

Create a scheduled report that runs the lookup command and writes results to a summary index, then search the summary index.

Question 15

An analyst wants to calculate the average response time per URL from a web access log, but only for URLs that have more than 100 requests. The search currently is `index=web | stats avg(response_time) AS avg_rt BY url`. Which modification will produce the desired result?

Accepted Answer

Change the stats command to `stats avg(response_time) AS avg_rt, count AS req_count BY url | where req_count > 100`.. To filter on the number of requests per URL, the count must be computed as part of the aggregation. Adding count AS req_count to the stats command creates the necessary field, and the where clause then filters URLs with more than 100 requests while preserving the average response time calculation.

Answer

Add `| where count > 100` after the stats command.

Answer

Add `| where count(response_time) > 100` after the stats command.

Answer

Add `| eventstats count AS req_count BY url | where req_count > 100` before the stats command.