SPLK-1002 Practice Test 19 — 15 Questions

Question 1

A Splunk Power User maintains a macro named `net_errors` defined with arguments as `sourcetype=$st$ status=error | stats count by host`. Several saved searches call it as `` `net_errors(firewall)` ``. The admin later needs one specific saved search to also break the count down by `src_ip` without altering the macro for everyone else. What is the most appropriate way to accomplish this within Splunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a second argumentized macro such as `net_errors_by_ip($st$,$grp$)` that appends `, $grp$` to the stats clause, and point only that saved search at it.. Passing the grouping field as a macro argument lets the shared definition remain generic while a single saved search requests the additional breakdown. Only the invocation changes, so other searches that call the original macro keep their host-only results. This preserves reuse and avoids the ripple effects of editing or deleting the shared macro, which is the core reason argumentized macros are preferred for scenario-specific variations.

Answer

Copy the macro body inline into the one saved search and add the extra by-field there, then delete the original macro to prevent drift.

Answer

Edit the existing `net_errors` macro definition to add `src_ip` to the stats clause, since macro changes propagate to all saved searches automatically.

Answer

Add `src_ip` to the stats clause of the macro and rely on the `ISNULL` function to hide the extra column in the other saved searches.

Question 2

A Splunk admin needs a macro that adds a computed severity label based on the `status` field and must guarantee it only runs where `status` exists. The admin writes the definition as `eval severity=case(status>=500,"critical",status>=400,"warning",true(),"info")` and saves it. A search on a sourcetype lacking `status` invokes the macro and returns rows with `severity=info`. What explains this behavior?

Accepted Answer

The `case` function's `true()` clause always matches, so rows without `status` fall through to the default label because a missing field compares as null.. Because `case` evaluates conditions in order and `true()` is an unconditional match, any event whose `status` does not satisfy the numeric branches receives the `info` label. Missing fields simply fail the numeric comparisons, so they land in the catch-all. To avoid labeling events that lack the field, the macro should test for field existence before assigning severity.

Answer

The `eval` command automatically creates missing fields with the value `info` when a `case` expression references them.

Answer

The macro's `true()` clause is ignored when the referenced field is null, so Splunk applies the default `info` label from the macro's metadata.

Answer

The macro failed to expand because `status` is missing, so Splunk reused the last successful expansion and labeled the rows `info` from cache.

Question 3

A support team has a lookup definition named ticket_priority that maps priority_code to a friendly priority label. They want a search to display both the original priority_code and the new priority_label field, while leaving priority_code unchanged even if the lookup contains a column with the same name. Which lookup command syntax accomplishes this?

Accepted Answer

lookup ticket_priority priority_code OUTPUTNEW priority_label. OUTPUTNEW adds only lookup fields that are not already present in the event, so the friendly priority_label is appended while the existing priority_code remains exactly as it was. This satisfies the need to display both values without the lookup clobbering the original code. Plain OUTPUT or explicitly listing the key field would risk overwriting the original value.

Answer

lookup ticket_priority priority_code OUTPUT priority_label

Answer

lookup ticket_priority priority_code OUTPUTNEW priority_code, priority_label

Answer

lookup ticket_priority priority_code OUTPUT priority_code, priority_label

Question 4

A Splunk administrator is reviewing how the Common Information Model enables cross-vendor reporting. Which two statements correctly describe how CIM data model acceleration and field aliasing work together? (Choose two.)

Accepted Answer

Field aliases map vendor-specific field names to CIM-standard field names so a single search can match data from multiple sources.. The Common Information Model depends on two complementary mechanisms. Field aliases normalize vendor-specific field names into standard CIM names at search time, enabling one search to span multiple sources. Data model acceleration precomputes summaries so queries against the model avoid scanning raw events. Together they deliver portable, high-performance reporting across heterogeneous data, and neither one requires reindexing or deletes source events.

Answer

Data model acceleration permanently removes the original raw events to save storage once the summary is built.

Answer

Accelerating a data model automatically creates field aliases for every sourcetype that contributes events to that model.

Answer

Field aliases are evaluated only at index time, so adding a new alias requires reindexing the affected data.

Question 5

A Splunk administrator wants to ensure that a saved search runs only on weekdays at 8:00 AM. Which cron expression should be used in the saved search schedule?

Accepted Answer

0 8 * * 1-5. The correct cron expression for weekdays at 8:00 AM is `0 8 * * 1-5`. This specifies minute 0, hour 8, any day of month, any month, and days 1 through 5 (Monday to Friday). This ensures the saved search runs only on weekdays at the desired time.

Answer

8 0 * * 1-5

Answer

0 8 * * 0-4

Answer

0 8 * * 6-7

Question 6

A Splunk Power User is creating a macro to normalize web proxy logs. The macro must extract the `action` field from the raw event and map it to the CIM `action` field. The raw event contains a field called `proxy_action` with values like 'allowed' or 'blocked'. The macro definition is: `eval action=case(proxy_action=="allowed", "allowed", proxy_action=="blocked", "blocked", true(), "unknown")`. When the macro is used in a search, the `action` field is not populated correctly. What is the most likely cause?

Accepted Answer

The `proxy_action` field is not extracted before the macro is applied.. The macro relies on the `proxy_action` field being present in the event. If that field is not extracted prior to the macro's execution, the `case` function cannot evaluate it, resulting in the default 'unknown' value. To resolve this, ensure that field extraction for `proxy_action` occurs before the macro is applied, either in the base search or within the macro itself. This is essential for correct CIM normalization.

Answer

The `case` function requires a numeric field for comparison.

Answer

The `case` function syntax is incorrect; it should use `if` instead.

Answer

The macro does not include the `index=` or `sourcetype=` to filter events.

Question 7

A Splunk Power User is asked to add a new data source to an existing CIM-compliant app so that its events populate the Authentication data model. The sourcetype has fields `user`, `src`, and `action`, but the events are not appearing in the data model. Which two actions are required to make the events appear? (Choose two.)

Accepted Answer

Map the sourcetype's fields to the CIM field names using field aliases or calculated fields in props.conf.. CIM data models choose their events with tags and expect normalized field names. The new source needs an event type or tag definition that applies the Authentication tag, plus field aliases or calculated fields that translate the source's field names to CIM names. Once both are configured, the model and any accelerated summaries can pick up the events without reindexing.

Answer

Reindex the source data so the data model acceleration files are regenerated with the new sourcetype included.

Answer

Convert the source's event timestamps to epoch format so the data model's time constraints can match the events.

Answer

Add the sourcetype to the `[cim_authentication]` stanza in indexes.conf so the indexer routes events to the model.

Question 8

A security team wants a lookup that matches events to threat intel entries valid for a specific date range, so an IP flagged last quarter does not match today's events. The threat feed is a CSV with ip, threat_label, valid_from, and valid_to columns. Which lookup configuration approach supports this time-bounded matching?

Accepted Answer

Define the lookup with a time field and configure a temporal match using valid_from and valid_to.. Temporal matching is a lookup definition feature that uses a designated event time field together with the lookup's begin and end timestamp columns. Configuring the definition this way makes Splunk include only rows whose validity range covers the event time, so expired threat intel is excluded. Match-field or output-field changes alone cannot enforce that window.

Answer

Use inputlookup to load the CSV and then append threat_label with appendcols.

Answer

Add valid_from and valid_to to the OUTPUT list of the lookup command.

Answer

Define the lookup with ip as the match field and set the definition type to automatic.

Question 9

A Splunk administrator is designing a set of macros to standardize searches across the team. Which two considerations are valid when defining macros in Splunk? (Choose two.)

Accepted Answer

Macros can be nested, meaning a macro definition can invoke another macro.. Macros can accept arguments referenced with dollar signs and can be nested to build modular search logic. These features enable standardization and reuse. The other options are incorrect: macros can be used in scheduled searches, can contain multiple commands, and have configurable permissions rather than being automatically global.

Answer

Macros are automatically shared globally and cannot be restricted to specific roles.

Answer

Macros are always evaluated at search time and cannot be used in scheduled searches.

Answer

Macros can only contain a single search command and cannot include pipes or multiple commands.

Question 10

A Power User defines a macro `net_traffic($src$, $dest$)` with the definition `index=net sourcetype=fw src=$src$ dest=$dest$`. The macro is invoked in a dashboard search as `` `net_traffic(10.0.0.1, 10.0.0.2)` ``. The dashboard returns events, but when the same macro is invoked in a scheduled alert the results are empty even though data exists. Which explanation is most likely?

Accepted Answer

The scheduled search runs under a user or role that lacks access to the index or fields referenced by the macro, so no events are returned.. When a macro works interactively but returns nothing in a scheduled alert, the usual cause is the permissions context in which the scheduled search runs. Scheduled searches run as their owner or a configured run-as user, and if that identity cannot access the index or fields the macro expands to, the search yields no events. Aligning role permissions or the run-as setting resolves the discrepancy.

Answer

The macro contains literal IP values that are not quoted, so the scheduled search treats them as field names rather than string values.

Answer

The macro's argument count does not match the invocation, so expansion silently drops the destination filter in scheduled context.

Answer

Macros cannot be used inside scheduled alerts; they only expand in interactive searches run from the search bar.

Question 11

A Splunk administrator is implementing the Common Information Model (CIM) for network traffic data. The data comes from various sourcetypes, and the administrator needs to ensure that the CIM Network Traffic data model is populated correctly. Which action is required to map the data to the CIM?

Accepted Answer

Define field aliases and tags for the sourcetypes to match the CIM data model fields.. To populate the CIM data model, data must be normalized using field aliases and tags. Field aliases map custom field names to CIM standard field names, and tags categorize events into the appropriate data model. This approach is scalable and supported. Lookups, direct JSON edits, and calculated fields are not the standard methods for CIM mapping and can lead to maintenance issues.

Answer

Modify the data model JSON file to include the new sourcetypes directly.

Answer

Create a lookup table that maps sourcetypes to CIM data model fields.

Answer

Create a calculated field for each CIM field and apply it to the sourcetypes.

Question 12

A Power User wants a saved search to run automatically every morning at 06:00 and store its results in a lookup file used by a dashboard. Which configuration should be applied to the saved search?

Accepted Answer

Set a cron schedule of `0 6 * * *` and add the `outputlookup` command to the search before saving it.. Scheduling is what makes a saved search run unattended, and the cron expression `0 6 * * *` expresses daily execution at 06:00. Persisting results to a lookup requires an explicit output command such as `outputlookup` inside the search SPL. Combining the schedule with that command ensures the lookup is refreshed each morning for the dashboard to consume.

Answer

Add the `collect` command to the search and schedule it with the `0 6 * * *` cron expression in the report's acceleration settings.

Answer

Set the saved search's time range to `earliest=-1d@d latest=@d` and enable alerting so the results are written to the lookup.

Answer

Create a report and add it to a dashboard panel with a scheduled refresh interval of 24 hours.

Question 13

A Splunk Power User is designing a macro to standardize the extraction of a user ID from various log sources. The macro will be used in multiple saved searches and dashboards. Which two considerations are most important when defining this macro? (Choose two.)

Accepted Answer

The macro should be defined with arguments to allow flexibility for different field names.. When defining a reusable macro for extracting user IDs from various sources, using arguments allows adaptation to different field names, and including validation handles missing values. These two considerations enhance flexibility and robustness. Private storage limits sharing, event types are for categorization, and scheduling does not apply to macros. Thus, arguments and validation are the key considerations.

Answer

The macro should be defined as an event type to automatically categorize events.

Answer

The macro should be created in the user's private directory to ensure it is not accidentally modified.

Answer

The macro should be scheduled to run regularly to keep the extractions up to date.

Question 14

A dashboard developer wants to add a single value visualization that shows the total number of failed login attempts in the last 24 hours. The search returns a single number. Which dashboard panel type should they use?

Accepted Answer

Single Value. The Single Value visualization is specifically designed to display a single numeric result, making it the correct choice for showing the total number of failed login attempts. Other visualizations like Gauge, Table, or Pie Chart are not optimized for this purpose and would either require additional configuration or not present the data clearly.

Answer

Gauge

Answer

Pie Chart

Answer

Table

Question 15

A Splunk Power User is investigating suspicious activity in the `web` index. They need to identify groups of events that share the same `src_ip` and occur within 2 minutes of each other, but they do not want to group events that are more than 30 seconds apart. Which transaction option and value should they use to limit the maximum time between events in a transaction?

Accepted Answer

maxpause=30s. The maxpause parameter sets the maximum time between consecutive events in a transaction. To ensure events are no more than 30 seconds apart, maxpause=30s is the correct choice. maxspan controls total duration, maxevents limits event count, and startswith defines a starting condition—none of which address the gap between events. This parameter is essential for grouping events that occur in close temporal proximity.

Answer

startswith=src_ip

Answer

maxspan=2m

Answer

maxevents=30