SPLK-1002 Practice Test 20 — 15 Questions

Question 1

A Splunk user wants to create a lookup that maps employee IDs to department names. The data is currently in a CSV file on their local machine. Which Splunk feature should they use to upload the file and make it available for lookups?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > Lookups > Lookup table files. Lookup table files are managed under Settings > Lookups > Lookup table files. Uploading a CSV there creates a lookup table file that can be used in lookup definitions. This is the standard method to make a CSV available for lookups without indexing its contents as events.

Answer

Settings > Data inputs > Files & directories

Answer

Add Data > Upload

Answer

Settings > Fields > Calculated fields

Question 2

A fraud analyst has a dashboard panel driven by a search over 90 days of transaction logs. The panel must flag any account whose total transaction amount exceeds $10,000, and the threshold must be editable by dashboard viewers without modifying the underlying search string. The analyst adds a text input token named amount_threshold to the dashboard. Which search snippet correctly applies that token value as the comparison threshold?

Accepted Answer

| where total_amount > $amount_threshold$. A dashboard token is referenced by surrounding its name with dollar signs, and Splunk replaces that reference with the viewer's input before the search executes. Placing the unquoted token on the right side of the numeric comparison lets the where command evaluate the substituted number against the aggregated total_amount field, giving viewers an editable threshold without touching the saved search.

Answer

| eval amount_threshold = total_amount | where total_amount > threshold

Answer

| where total_amount > "$amount_threshold$"

Answer

| where total_amount > amount_threshold

Question 3

A fraud analyst needs to enrich transaction events with a risk score stored in a CSV lookup file. The risk scores change daily and are updated by an external system. The analyst wants the lookup to automatically use the latest file content without manually editing the lookup definition each time. Which lookup definition type should be configured?

Accepted Answer

File-based lookup. A file-based lookup definition points to a CSV file on the search head. When the external system replaces that file, subsequent searches read the new content automatically. KV Store lookups require explicit writes, automatic lookups only control application timing, and inline lookups embed data in the search itself, so none of those provide the required automatic file-based refresh.

Answer

KV Store lookup

Answer

Automatic lookup

Answer

Inline lookup

Question 4

A Splunk Power User is creating a macro to be used in multiple saved searches. The macro will perform a lookup against a CSV file to enrich events with user department information. The macro must be reusable and avoid hardcoding the lookup file path. Which two actions should the Power User take when defining the macro? (Choose two.)

Accepted Answer

Use the `lookup` command with the argument for the lookup file path, e.g., `lookup $lookup_file$ user OUTPUT department`.. To avoid hardcoding the lookup file path, the macro should accept the file path as an argument. This allows different saved searches to pass different lookup files as needed. The macro definition should include the `lookup` command with the argument placeholder, such as `lookup $lookup_file$ user OUTPUT department`. This makes the macro flexible and reusable without editing the macro itself when the lookup file changes.

Answer

Define the macro as a global macro so it can be used by all users.

Answer

Use the `lookup` command with a hardcoded path to the CSV file.

Answer

Define the macro with an argument for the lookup field name.

Question 5

A security analyst wants to create a lookup that maps user names to their department and manager. The mapping data is stored in a CSV file that is updated weekly by HR. The analyst needs the lookup to be used automatically in all searches that reference the user field, without requiring an explicit lookup command. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Define a lookup definition that points to the CSV file. To enable automatic lookup, you must first create a lookup definition that describes the CSV file, then configure an automatic lookup that ties that definition to the user field. Scheduled searches are for updating KV Store data, explicit lookup commands defeat the purpose, and calculated fields are unrelated to lookup enrichment.

Answer

Define a calculated field that references the CSV file

Answer

Create a scheduled search to update the lookup file weekly

Answer

Add the lookup command to every search that uses the user field

Question 6

A network operations team runs `index=netflow | transaction src_ip maxspan=10m` to group flows from the same source IP into sessions. After reviewing the results, they notice that a single transaction can contain events separated by more than 10 minutes of inactivity. Which transaction parameter should they add to ensure that consecutive events within a transaction are never more than 10 minutes apart?

Accepted Answer

maxpause=10m. The maxpause parameter enforces a maximum time gap between consecutive events in a transaction. When the gap exceeds maxpause, a new transaction starts. This is distinct from maxspan, which limits the overall transaction duration. Adding maxpause=10m ensures that events more than 10 minutes apart are not grouped together, directly fixing the issue of long pauses within a single transaction.

Answer

keepevicted=true

Answer

maxspan=10m

Answer

startswith="src_ip"

Question 7

A network operations team keeps a CSV file on the search head that maps circuit IDs to customer names. The file changes weekly, and the team wants searches to reflect the newest mapping immediately after the file is replaced, without redefining the lookup or restarting Splunk. Which lookup definition type should they configure?

Accepted Answer

A CSV lookup definition that references the file, because CSV lookups are read from disk at search time. File-based CSV lookup definitions resolve the referenced file at search time, so the fastest way to publish a weekly mapping change is simply to replace the CSV and let the next search pick it up. Because the definition is keyed to the file path rather than to a cached copy, the updated customer names appear without redefining the lookup or restarting the search head.

Answer

An automatic lookup, because automatic lookups are evaluated on every event at index time

Answer

A lookup definition based on a search, because scheduled searches push fresh results into the lookup table

Answer

A KV Store lookup, because it stores rows in the app's collections.conf and refreshes on its own schedule

Question 8

A Splunk administrator needs to create a lookup that will be used to map hostnames to asset owners. The mapping data is currently in a CSV file, but the administrator wants to be able to update the lookup directly from Splunk Web without editing the CSV file manually. Which lookup type should the administrator use?

Accepted Answer

KV Store lookup. KV Store lookups allow data to be stored in Splunk's internal key-value store, which can be edited directly in Splunk Web. File-based lookups require CSV file manipulation, automatic lookups are just a configuration, and inline lookups are ephemeral. Therefore, KV Store is the appropriate choice for direct web-based updates.

Answer

Automatic lookup

Answer

Inline lookup

Answer

File-based lookup

Question 9

A Splunk analyst is configuring a lookup to enrich event data with user department information from a CSV file. The analyst wants to ensure the lookup is efficient and correctly matches fields. Which two actions are necessary to define and use the lookup successfully? (Choose two.)

Accepted Answer

Create a lookup definition that specifies the CSV file and the field mappings.. To successfully enrich events with a lookup, you must first create a lookup definition that points to the CSV file and defines any necessary field mappings. Then, in your search, you use the `lookup` command, applying field aliasing if the event field names differ from the lookup column names. Automatic lookups and inputlookup are alternative methods but not required for this scenario.

Answer

Upload the CSV file to the Splunk indexers' lookups directory.

Answer

Use the `inputlookup` command to load the CSV into the search before joining.

Answer

Configure the lookup as an automatic lookup in props.conf and transforms.conf.

Question 10

A network operations team wants to correlate firewall events into sessions based on a `flow_id` field. They want to limit each transaction to a maximum of 20 events and ensure that transactions are not created if the events span more than 10 minutes. Which transaction options should be used together?

Accepted Answer

maxevents=20 maxspan=10m. To limit a transaction to a maximum number of events, use maxevents. To constrain the total elapsed time between the first and last event of a transaction, use maxspan. Together they enforce both the 20-event cap and the 10-minute duration cap. maxpause controls gaps between consecutive events, maxopenevents controls concurrency, and keepevicted retains otherwise discarded transactions.

Answer

maxevents=20 keepevicted=true

Answer

maxevents=20 maxpause=10m

Answer

maxopenevents=20 maxspan=10m

Question 11

A fraud analyst is reviewing a payment gateway's logs. Each event contains a `txn_id` and a `status` field. The analyst runs the search `index=payments | transaction txn_id startswith=("status=authorized") endswith=("status=settled")`. They expect only fully settled transactions, but the results include transactions where the `status` progressed from `authorized` directly to `declined` without a `settled` event. Which statement explains why the search returns these unexpected transactions?

Accepted Answer

The `transaction` command does not enforce the `endswith` condition by default; it only uses `startswith` and `endswith` to determine the transaction boundaries, but a transaction can still be returned without the end event unless the `closed` option is set.. The transaction command uses `startswith` and `endswith` to identify the first and last events of a transaction, but it does not require the end event to be present unless `closed=true` is specified. Without `closed`, transactions that start with an authorized event but never reach a settled event are still returned. Adding `closed=true` ensures only transactions with both boundary events are included.

Answer

The `status=authorized` and `status=settled` values must be enclosed in single quotes instead of double quotes for the `startswith` and `endswith` options to work correctly.

Answer

The `startswith` and `endswith` options accept only a single value, so the search silently ignores the `endswith` condition and groups every event sharing a `txn_id`.

Answer

The `maxspan` default of 5 minutes caused the `settled` event to be excluded, so the transaction closed prematurely at the `declined` event.

Question 12

An analyst uses `transaction session_id maxpause=30m` to group web session events. They notice that some transactions contain events from two different users because the session_id field was reused after a logout. Which approach best prevents events from different users being merged into the same transaction?

Accepted Answer

Add the user field to the transaction command so events are grouped by both session_id and user.. The transaction command groups events by the fields specified. When a session_id is reused across users, grouping only by session_id merges unrelated events. Adding the user field to the transaction command creates a composite key of session_id and user, ensuring that events from different users are never combined. Adjusting pause or boundary options does not change the grouping key and therefore does not solve the underlying issue.

Answer

Add keepevicted=true so that transactions with mixed users are retained and can be filtered later.

Answer

Use the startswith option to begin a new transaction whenever a login event is seen.

Answer

Reduce maxpause to 5m so that transactions close sooner and are less likely to include multiple users.

Question 13

A security analyst needs to correlate authentication and authorization events into sessions using the transaction command. The events share a `session_id` field, but the analyst wants to reduce memory usage and avoid transactions that grow too large. Which two transaction options should be used to limit resource consumption? (Choose two.)

Accepted Answer

maxopenevents. To reduce memory usage when using transaction, limit both the size of individual transactions and the number of concurrent open transactions. maxevents caps the events per transaction, and maxopenevents caps how many transactions can be open simultaneously. keepevicted affects retention of over-limit transactions, mvlist affects multivalue field rendering, and startswith defines a boundary marker, none of which directly control resource consumption.

Answer

mvlist

Answer

keepevicted

Answer

startswith

Question 14

An analyst manages a lookup definition named asset_owner whose file contains a host column and an owner column. Searches already reference the lookup explicitly, and results are correct. The security team now wants every search that returns a host field to automatically gain the owner value, with no changes to individual searches. What must the analyst configure?

Accepted Answer

Add an automatic lookup entry that maps host in the events to host in asset_owner and outputs owner. Automatic lookups are the mechanism that enriches events transparently at search time: an entry references the lookup definition, states which event field matches the lookup key, and names the fields to output. Once configured, any search returning the matched field gains the output field with no per-search edits, satisfying the requirement that existing and future searches both benefit.

Answer

Enable the lookup definition's global setting so Splunk applies it at index time

Answer

Edit each saved search to append | lookup asset_owner host OUTPUT owner

Answer

Create a field extraction that renames host to owner using the lookup file as a regex source

Question 15

A Splunk Power User needs to correlate events from two different sourcetypes: `web` and `auth`. The events share a common field `session_id`. The analyst wants to create transactions that include events from both sourcetypes, but only if the transaction contains at least one event from each sourcetype. Which transaction option should they use?

Accepted Answer

There is no direct transaction option to require multiple sourcetypes; the analyst should use a subsearch or stats to filter.. The transaction command lacks a parameter to enforce the presence of multiple sourcetypes. To correlate events from different sourcetypes and require both, the analyst must use additional SPL, such as a subsearch to filter session_ids that appear in both sourcetypes, or use stats with values(sourcetype) and filter for two distinct values. This is a common pattern for multi-source correlation.

Answer

endswith

Answer

startswith

Answer

maxevents