SPLK-1002 Practice Test 2 — 10 Questions

Question 1

A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?

Accepted Answer

Use the transaction command with startswith='login' and endswith='logout'.. The `transaction` command is specifically designed to group related events that share a common field (e.g., user or session ID) and occur within a defined time window. By using `startswith='login'` and `endswith='logout'`, it correctly identifies the beginning and end of a user session, grouping all intermediate events into a single transaction. This is the most direct and efficient method for correlating login and logout events in Splunk.

Answer

Use the sort command by user and time to manually identify sessions.

Answer

Use the stats command with values() and earliest().

Answer

Use the eval command to create a session ID based on time differences.

Question 2

A company uses a large Splunk environment with many users creating dashboards. They notice that some searches are slow and consume excessive resources. What is the best practice to optimize search performance?

Accepted Answer

Use the tstats command with summariesonly=t. The `tstats` command with `summariesonly=t` is the best practice because it queries accelerated data models or summary indices rather than raw event data, drastically reducing the amount of data scanned. This command leverages pre-computed statistics, which is the most efficient way to perform searches over large datasets, especially when users are building dashboards that run repeatedly.

Answer

Use the search command with a large time range

Answer

Use the eval command to create new fields

Answer

Use the stats command with by clause on high cardinality fields

Question 3

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

Accepted Answer

... | sort date | streamstats sum(sales) as running_total. It first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Answer

... | eval running_total = running_sum(sales)

Answer

... | eventstats sum(sales) as running_total

Answer

... | stats sum(sales) by date

Question 4

A user wants to create a chart showing the count of errors per hour for the last 24 hours, with time bucketed hourly. Which search is correct?

Accepted Answer

index=main error | timechart count span=1h. The `timechart` command automatically creates a time-based chart with a default count aggregation. The `span=1h` argument explicitly sets the bucket size to one hour, which groups events into hourly intervals over the last 24 hours. This produces the exact output the user needs: a count of errors per hour.

Answer

index=main error | bucket _time span=1h | stats count by _time

Answer

index=main error | chart count by _time span=1h

Answer

index=main error | timechart count by _time span=1h

Question 5

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Accepted Answer

index=web status=404 | top limit=5 user_agent. It first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.

Answer

index=web | top limit=5 user_agent status=404

Answer

index=web | top limit=5 user_agent

Answer

index=web | stats count by user_agent | where status=404 | top 5 user_agent

Question 6

What is the MOST likely reason the search returns no results?

Accepted Answer

The `inputlookup` command expects the definition name, not the filename.. The `inputlookup` command in Splunk expects the lookup definition name as its argument, not the filename of the CSV file. If a user specifies the filename (e.g., `| inputlookup myfile.csv`) instead of the lookup definition name (e.g., `| inputlookup my_lookup`), Splunk will not find the lookup and returns no results. This is a common mistake because the command syntax requires the logical name defined in the lookup table configuration, not the physical file path.

Answer

The user does not have permission to read the lookup.

Answer

The lookup definition is not configured.

Answer

The CSV file has no header row.

Question 7

To count events by host for the last hour, which search is most efficient?

Accepted Answer

index=* earliest=-1h | stats count by host. It uses `index=*` to search all indexes and `earliest=-1h` to restrict the search to the last hour at the index level, which is the most efficient way to filter time. The `stats count by host` then aggregates counts per host without needing to process events outside the time range. This approach leverages Splunk's time-based index pruning, minimizing data scanned.

Answer

index=* | stats count by host | where _time > relative_time(now(), "-1h")

Answer

search index=* | head 1000 | stats count by host

Answer

sourcetype=access_combined | timechart count by host

Question 8

Refer to the exhibit. What is the purpose of the eval command in this search?

Accepted Answer

It creates a new field 'status_category' based on the numeric status code, grouping into three categories.. The eval command creates a new field 'status_category' by evaluating a CASE expression that maps numeric HTTP status codes (e.g., 200, 404, 500) into three descriptive categories: 'OK', 'Client Error', and 'Server Error'. This is a common pattern for enriching raw data with human-readable labels without altering the original 'status' field. The correct answer is D because the search explicitly defines the new field based on the status code values.

Answer

It replaces the status field with the category.

Answer

It adds a temporary field that is not retained after stats.

Answer

It converts the status field to a string.

Question 9

Which THREE steps are necessary to create a file-based lookup?

Accepted Answer

Upload the lookup file to the correct directory.. To create a file-based lookup in Splunk, three steps are necessary: upload the lookup file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply the changes (E). The lookup definition maps the file to a lookup table name. Props.conf is not used for defining lookups; it is for field extractions and event processing. Restarting Splunk is required because changes to transforms.conf take effect only after a restart. Automatic lookups (D) are optional and defined separately if needed.

Answer

Create a lookup definition in props.conf.

Answer

Define an automatic lookup in props.conf.

Question 10

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

Accepted Answer

eval domain=mvindex(split(email,"@"),1). `split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Answer

eval domain=mvindex(split(email,"@"),0)

Answer

eval domain=replace(email,".*@(.*)","\1")

Answer

eval domain=substr(email, indexof(email,"@")+1)