SPLK-1002 Practice Test 2 — 10 Questions

Question 1

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 2

Which command creates a new field that contains the string 'high' if a numeric field exceeds 100, otherwise 'low'?

Accepted Answer

eval status=if(value>100,"high","low"). The `eval` command with the `if` function correctly checks if the numeric field `value` exceeds 100 and returns the string 'high' or 'low'. In Splunk's `eval`, the `if` function requires the true and false results to be quoted strings when they are literal text, as shown in option A.

Answer

eval status=case(value>100,"high",true(),"low")

Answer

eval status=if(value>100,high,low)

Answer

None of the above

Question 3

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Accepted Answer

index=web status=404 | top limit=5 user_agent. It first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.

Answer

index=web | top limit=5 user_agent status=404

Answer

index=web | top limit=5 user_agent

Answer

index=web | stats count by user_agent | where status=404 | top 5 user_agent

Question 4

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Option A is correct because a lookup's core purpose is to enrich events by pulling in additional fields from an external source (CSV, KV store, or a lookup definition) and appending them to the search results. Option D is correct because automatic lookups are defined in props.conf, where you specify the lookup name, the input field(s), and the output field(s) so the enrichment happens at search time without an explicit lookup command. Option E is correct because lookups can be backed by CSV files (file-based lookups) or by KV store collections (KV store lookups), both of which are valid lookup types in Splunk. Option B is wrong because lookups also support CIDR and wildcard matching, not just exact match. Option C is wrong because lookup data does not need to be indexed; it is referenced at search time from a file or KV store collection.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 5

A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?

Accepted Answer

index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5. It uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories. Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.

Answer

Answer

index=main | top category | eval avg=avg(response_time) | where count>=100

Answer

index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

Question 6

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

Accepted Answer

`index=main | stats perc95(response_time) by service`. `stats perc95(response_time) by service` directly calculates the 95th percentile for each service across all events in one efficient pass. It is the simplest and most efficient way. Option C, while producing the same result, is less efficient because it first appends the percentile to every event using `eventstats` and then collapses with `stats values()`, adding unnecessary overhead. Option B uses time-based bucketing and option D uses a running calculation, both of which do not produce the desired overall percentile.

Answer

`index=main | timechart perc95(response_time) by service`

Answer

`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

Answer

`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

Question 7

A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?

Accepted Answer

maxevents=500. Adding maxevents=500 to the transaction command limits each transaction to a maximum of 500 events, preventing any single transaction from consuming excessive resources. This directly addresses the concern of orders with 1000+ events by capping the transaction size while still grouping events by order_id. It is the most appropriate option for resource control.

Answer

keepevicted=true

Answer

maxspan=1h

Answer

maxpause=5m

Question 8

A security team needs to group all login events from the same user session. Events include 'login' and 'logout' with a common session_id field. Which command should be used to combine these events into a single event per session?

Accepted Answer

transaction session_id. The transaction command is designed to group related events into a single transaction based on a common field such as session_id, using parameters like maxspan, maxpause, and startswith/endswith to define boundaries. It is the canonical Splunk command for sessionization of login/logout event pairs.

Answer

join session_id

Answer

stats by session_id

Answer

append session_id

Question 9

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. A macro with arguments is defined using backticks and $arg$ syntax, and it can be invoked in a search to accept parameters such as a sourcetype and time range. This is the correct method for creating a reusable search component that accepts parameters. The macro definition uses `$arg$` placeholders, and the invocation passes values in the backtick-delimited call.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 10

Arrange the steps to create a knowledge object of type 'Event Type' in Splunk.

Accepted Answer

Run a search that returns the desired events, then click 'Save As' and select 'Event Type', then enter a name and save.. Event types are created by defining a search string that matches events, then saving with a name.

Answer

Run a search that returns the desired events, then enter a name for the event type, then click 'Save As' and select 'Event Type'.

Answer

Click 'Save As' and select 'Event Type', then run a search that returns the desired events, then enter a name and save.

Answer

Enter a name for the event type, then click 'Save As' and select 'Event Type', then run a search that returns the desired events.