SPLK-1002 Practice Test 18 — 15 Questions

Question 1

A user wants to join data from two datasets in a search. Which command is used to combine results based on a common field, but only returns matching results?

Accepted Answer

join. The join command performs an inner join by default, returning only matches. Append adds rows without matching, union is not a Splunk command, and lookup enriches data.

Answer

append

Answer

union

Answer

lookup

Question 2

Which THREE of the following are features of the `timechart` command?

Accepted Answer

It automatically creates a time-based chart with a default span.. A, B, and C are correct. timechart automatically creates a time-based chart with a default span (A), supports the `by` clause to split into multiple series (B), and can aggregate data using functions like count, sum, avg (C). D is incorrect because timechart does not output results to a lookup file; use the `outputlookup` command instead. E is incorrect because the `span` option is optional; if omitted, Splunk auto-selects a span based on the time range.

Answer

It can output results to a lookup file.

Answer

It requires the `span` option to be specified.

Question 3

A security analyst wants to map IP addresses to hostnames using a CSV lookup file. Which command is correct to define a lookup that maps the IP field to hostname field, with the file named 'ip_host.csv'?

Accepted Answer

lookup ip_host.csv ip as ip_output hostname as hostname_output. The lookup command syntax for mapping multiple fields is 'lookup

as

as '. Here, 'lookup ip_host.csv ip as ip_output hostname as hostname_output' correctly maps the ip field from your data to ip_output in the lookup, and hostname from the lookup to hostname_output. Option A incorrectly uses OUTPUT, which is used for single field output. Option B has reversed order and missing output alias. Option C returns all rows without mapping.

Answer

lookup ip_host.csv hostname OUTPUT ip

Answer

lookup ip_host.csv hostname as hostname ip as ip_output

Answer

inputlookup ip_host.csv

Question 4

A Splunk admin wants to create a reusable macro that accepts a time range parameter and searches all indexes for events within that range. The macro will be used in dashboards and reports. Which macro definition is correct?

Accepted Answer

define my_search($timerange$) [search index=* earliest=$timerange$]. Macro definitions use the format `define macro_name($arg$) [definition]`, where arguments are enclosed in dollar signs and the definition is enclosed in square brackets. Option A is incorrect because it uses `$timerange` without closing dollar sign. Option B is incorrect because it lacks the enclosing brackets. Option C is incorrect because it uses angle brackets instead of square brackets. Only option D correctly uses both the argument syntax and brackets.

Answer

define my_search($timerange) [search index=* earliest=$timerange]

Answer

define my_search($timerange$) search index=* earliest=$timerange$

Answer

define my_search($timerange$) <search index=* earliest=$timerange$>

Question 5

A Splunk admin is accelerating a CIM data model for the "Network_Traffic" dataset. After acceleration, some searches that use the data model are slower than expected. What is the most likely reason?

Accepted Answer

The acceleration summary range is set too low. Data model acceleration works by creating a summary of data within a specified time range (the summary range). If the summary range is set too low, searches that span beyond that range will not benefit from acceleration and may be slower as they have to scan the full raw data. Option A is incorrect; acceleration selects specific fields. Option B is false; CIM data models are compatible with acceleration. Option C is less specific and not the most likely reason.

Answer

The acceleration uses too many fields

Answer

The data model acceleration is not compatible with the CIM

Answer

Searches are not using the `| datamodel` command correctly

Question 6

A Splunk admin needs to schedule a search to run every day at 2 AM and send an email alert if more than 100 events are found. Which saved search configuration achieves this?

Accepted Answer

Set schedule to 'Daily' at 02:00, trigger on 'Number of Events' > 100, action 'Email'. Splunk saved searches allow setting a schedule with 'Daily' at a specific time (02:00), and you can configure an alert trigger condition 'Number of Events' > 100, with action 'Email'. Option A uses 'Custom condition' with a string 'search result count > 100', which is not a standard trigger and the syntax is incorrect. Option B uses 'Every day' which is not a valid schedule option in Splunk; valid options include 'Daily'. Option D uses 'Result count' which is not a standard trigger condition name; the correct term is 'Number of Events'.

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Custom condition' `search result count > 100`, action 'Send email'

Answer

Set schedule to 'Every day' at 2:00, trigger on 'Number of Events' > 100, action 'Send email'

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Result count' > 100, action 'Email'

Question 7

A Splunk admin creates a macro named `lookup_user` that is defined as `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name`. The macro is used in a search like `index=main | `lookup_user(user_id)`. However, the results show no matches even though valid user_id values exist. What is the most likely cause?

Accepted Answer

The macro definition incorrectly includes a leading pipe. Because the macro is invoked with a pipe (`| `lookup_user...), the definition should not include a leading pipe. If it does, the expanded search becomes `| | lookup...`, which causes a syntax error or unexpected behavior. Option A could be possible but less likely; if the lookup file lacks the field `user`, the lookup would fail silently. Option B not likely. Option C inputlookup is for static lookups.

Answer

The macro is missing a closing parenthesis

Answer

The lookup file does not have a field named `user`

Answer

The lookup command should be `inputlookup` instead of `lookup`

Question 8

Which TWO are correct about saved search permissions and scheduling? (Choose two.)

Accepted Answer

A saved search's permissions can be set to 'global' so that any user can run it.. Options A and D are correct. A saved search's permissions can be set to 'global' so any user can run it. When a saved search is scheduled, it runs with the permissions of the owner, not the user who views it. Option B is wrong because scheduling a saved search requires the 'schedule_search' capability, which not all users have. Option C is wrong because saved searches inherit permissions from the user who created them, not the app's default. Option E is wrong because saved searches are private to the owner by default.

Answer

Any user can schedule a saved search regardless of role.

Answer

A saved search that is a report automatically inherits the app's default permissions.

Answer

All saved searches are visible to everyone in the app by default.

Question 9

An organization uses the Splunk Common Information Model (CIM) to normalize data from various sourcetypes. After onboarding a new firewall vendor, the data is not populating the Network Traffic data model. Which of the following is the most likely cause?

Accepted Answer

The appropriate CIM tags have not been assigned to the new sourcetype.. The Splunk CIM uses tags to map sourcetypes to specific data models. Without the appropriate CIM tags (such as 'network' or 'traffic'), the data will not populate the Network Traffic data model, even if the sourcetype is included in data model acceleration or indexed into any index. Option A is incorrect because data model acceleration includes all sourcetypes unless explicitly excluded, but tagging is still required for data model population. Option C is irrelevant because custom indexes do not affect CIM mapping; tagging is the key factor. Option D is incorrect because the CIM normalizes fields via tags and field aliases—exact field name match is not required if proper tags are assigned.

Answer

The sourcetype is not included in the 'Network Traffic' data model acceleration.

Answer

The data is being indexed into a custom index that is not monitored by the data model.

Answer

The fields in the firewall data do not match the data model field names exactly.

Question 10

A saved search that runs every hour is showing 'No results' in its history, but the same search when run manually returns results. Which two of the following are likely causes? (Choose TWO.)

Accepted Answer

The index being searched is not available at the scheduled time.. Options D and E are correct. Scheduled searches use a specific time range (e.g., 'Last 1 hour') while manual searches often use 'All time' or different presets, leading to different result sets (E). If the index being searched is unavailable at the scheduled time, no results can be returned (D). Option A is incorrect because outdated acceleration would show old data, not empty results. Option B is incorrect; deleting the user does not cause empty results—usually a permissions error occurs. Option C is incorrect; a macro typo would likely cause an error, not silently return no results.

Answer

The saved search's acceleration is outdated.

Answer

The user who created the saved search has been deleted.

Answer

The saved search uses a macro that has a typo in its definition.

Question 11

Refer to the exhibit. The macro `count_by_host` is defined as shown. The macro is invoked as `| `count_by_host`. What will the expanded search look like?

Accepted Answer

`| | stats count by host, sourcetype`. Since the macro definition includes a leading pipe, invoking it with `| `count_by_host` results in two pipes – one from the invocation and one from the definition. So the expanded search becomes `| | stats count by host, sourcetype`. Option A would be missing the second pipe, option B shows the macro invocation unexpanded, and option C would be missing both pipes.

Answer

`| stats count by host, sourcetype`

Answer

`| `count_by_host`

Answer

`stats count by host, sourcetype`

Question 12

A team needs to create a saved search that runs automatically every Monday at 8 AM and emails a CSV file of the results. Besides configuring the search string, which steps are required?

Accepted Answer

Set a schedule (Cron: 0 8 * * 1) and add an email alert action with attachment format CSV.. To send a scheduled search via email with a CSV attachment, you need to set a schedule (Cron: 0 8 * * 1) and add an email alert action configured to attach the results as CSV. Option A is incorrect because dashboard panels do not send emails directly. Option B is incorrect because summary indexing is not required; you can directly schedule the search and add an alert action. Option D is incorrect because setting the time range alone does not enable email delivery.

Answer

Create a dashboard panel that runs the search on schedule and sends email.

Answer

Set the search to 'Summary Index' and run a separate alert on the summary.

Answer

Define the schedule and set the time range to 'Last 7 days'.

Question 13

In the CIM, which field is commonly used to identify the user responsible for an authentication event?

Accepted Answer

user. In the CIM Authentication data model, the standard field for identifying the user responsible for an authentication event is 'user'. This field contains the username of the account involved. Option B (user) is correct. Option A (dest) typically refers to the destination endpoint. Option C (src_user) is not a standard field in the CIM Authentication data model; the source user is usually captured in the 'user' field. Option D (src) refers to the source IP address.

Answer

dest

Answer

src_user

Answer

src

Question 14

Which Common Information Model (CIM) data model is appropriate for standardizing authentication events?

Accepted Answer

Authentication. The CIM includes the 'Authentication' data model for authentication events. Option C (Authentication) is correct. Option A (Change Analysis) is for configuration changes. Option B (Network Traffic) is for network sessions. Option D (Endpoint) is for operating system events.

Answer

Change Analysis

Answer

Network Traffic

Answer

Endpoint

Question 15

A security team uses the CIM 'Authentication' data model to investigate failed logins. They have enabled acceleration on the data model and set a summary range of '1d'. After one week, searches against the data model are still slow and use the `search` command instead of `tstats`. What should they check first?

Accepted Answer

Confirm that the data model acceleration is built and that the search time range is within the summary range.. Data model acceleration must be built and the search time range must be within the summary range for `tstats` to be used. If acceleration is not built or the search time range exceeds the summary range, Splunk will fall back to the `search` command. Therefore, the first check should be confirming that acceleration is built and the search time is within the summary range.

Answer

Verify that the 'Authentication' data model is assigned to the correct index.

Answer

Ensure that the 'Authentication' data model has the 'authentication' tag on relevant events.

Answer

Check that the data model acceleration has completed building for the exact time range of the search.