SPLK-1002 Practice Exam 1 — 20 Questions

Question 1

In the CIM, which field is commonly used to identify the user responsible for an authentication event?

Accepted Answer

user. In the CIM Authentication data model, the 'user' field represents the user who is the subject of the authentication event — the account being authenticated. This is the standard field for identifying the responsible user in login, logout, and failed authentication events. It is distinct from src_user, which represents the user who initiated the action on behalf of another user.

Answer

dest

Answer

src_user

Answer

src

Question 2

When creating a saved search that runs every hour and sends an email alert when the count of errors exceeds 10, which action must be configured in addition to the search logic?

Accepted Answer

Add an email alert action in the saved search settings.. Saved searches that trigger alerts require at least one alert action (e.g., email) to be defined in the saved search settings. Option B is incorrect because the `| alert` command is not used in search strings for saved search alerts. Option C is incorrect because a lookup table is not required for alerting. Option D is incorrect because summary indexing is unrelated to sending email alerts.

Answer

Include '| alert' command in the search string.

Answer

Create a lookup table to store error counts.

Answer

Enable summary indexing for the search.

Question 3

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

Accepted Answer

... | sort date | streamstats sum(sales) as running_total. It first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Answer

... | eval running_total = running_sum(sales)

Answer

... | eventstats sum(sales) as running_total

Answer

... | stats sum(sales) by date

Question 4

A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?

Accepted Answer

They are split into separate transactions because the gap exceeds maxpause.. The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.

Answer

They are merged because maxpause is 5s but maxspan is 30s, so the 10s gap is within maxspan.

Answer

They are considered part of the same transaction as long as total span ≤ 30s.

Answer

They are split only if the total span exceeds maxspan.

Question 5

Refer to the exhibit. What is the purpose of the eval command in this search?

Accepted Answer

It creates a new field 'status_category' based on the numeric status code, grouping into three categories.. The eval command creates a new field 'status_category' by evaluating a CASE expression that maps numeric HTTP status codes (e.g., 200, 404, 500) into three descriptive categories: 'OK', 'Client Error', and 'Server Error'. This is a common pattern for enriching raw data with human-readable labels without altering the original 'status' field. The correct answer is D because the search explicitly defines the new field based on the status code values.

Answer

It replaces the status field with the category.

Answer

It adds a temporary field that is not retained after stats.

Answer

It converts the status field to a string.

Question 6

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 7

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

Accepted Answer

0 10 8-14 * 5. The cron expression '0 10 8-14 * 5' fires at 10:00 AM on day-of-week 5 (Friday) but only when the day-of-month is between 8 and 14 — which is exactly the second Friday of the month. This is the standard way to express 'second Friday' in cron, since the second Friday always falls on days 8-14. The other fields (minute 0, hour 10, any month) complete the schedule.

Answer

0 10 * * 5

Answer

0 10 */2 * *

Answer

0 10 * * *

Question 8

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Accepted Answer

The original number of events is preserved.. Option A is correct because eventstats enriches each original event with the computed aggregate values rather than collapsing the result set, so the original number of events is preserved. Option C is correct because the aggregated fields produced by eventstats are added to each event and can therefore be referenced in later commands such as where, eval, or sort. Option E is correct because, since each event retains its own fields plus the aggregate values, you can inspect individual event details alongside the aggregate statistics. Option B is incorrect because eventstats generally consumes more memory than stats, since it must retain and enrich every event instead of reducing them to aggregate rows. Option D is incorrect because eventstats is not always faster than stats; it typically performs additional work to attach aggregates to each event, so performance depends on the search.

Answer

It uses less memory than stats.

Answer

It is always faster than stats.

Question 9

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.

Question 10

An analyst is using the transaction command to group events by a field that has high cardinality (millions of unique values). The search is taking too long and consuming too much memory. Which approach should be taken to improve performance?

Accepted Answer

Reduce the cardinality of the field by using a derived field with fewer values.. The transaction command groups events by a field, and high cardinality (millions of unique values) forces Splunk to maintain millions of separate transaction groups in memory, causing excessive memory use and slow performance. Reducing the cardinality of the grouping field — for example, by deriving a lower-cardinality field — directly reduces the number of transaction groups and the memory footprint.

Answer

Use the 'maxspan' option to narrow the time window.

Answer

Use the 'mvlist' option to reduce field storage.

Answer

Use the 'maxevents' option to limit number of events per transaction.

Question 11

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 12

Which command creates a new field that contains the string 'high' if a numeric field exceeds 100, otherwise 'low'?

Accepted Answer

eval status=if(value>100,"high","low"). The `eval` command with the `if` function correctly checks if the numeric field `value` exceeds 100 and returns the string 'high' or 'low'. In Splunk's `eval`, the `if` function requires the true and false results to be quoted strings when they are literal text, as shown in option A.

Answer

eval status=case(value>100,"high",true(),"low")

Answer

eval status=if(value>100,high,low)

Answer

None of the above

Question 13

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Accepted Answer

index=web status=404 | top limit=5 user_agent. It first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.

Answer

index=web | top limit=5 user_agent status=404

Answer

index=web | top limit=5 user_agent

Answer

index=web | stats count by user_agent | where status=404 | top 5 user_agent

Question 14

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Option A is correct because a lookup's core purpose is to enrich events by pulling in additional fields from an external source (CSV, KV store, or a lookup definition) and appending them to the search results. Option D is correct because automatic lookups are defined in props.conf, where you specify the lookup name, the input field(s), and the output field(s) so the enrichment happens at search time without an explicit lookup command. Option E is correct because lookups can be backed by CSV files (file-based lookups) or by KV store collections (KV store lookups), both of which are valid lookup types in Splunk. Option B is wrong because lookups also support CIDR and wildcard matching, not just exact match. Option C is wrong because lookup data does not need to be indexed; it is referenced at search time from a file or KV store collection.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 15

A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?

Accepted Answer

index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5. It uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories. Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.

Answer

Answer

index=main | top category | eval avg=avg(response_time) | where count>=100

Answer

index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

Question 16

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

Accepted Answer

`index=main | stats perc95(response_time) by service`. `stats perc95(response_time) by service` directly calculates the 95th percentile for each service across all events in one efficient pass. It is the simplest and most efficient way. Option C, while producing the same result, is less efficient because it first appends the percentile to every event using `eventstats` and then collapses with `stats values()`, adding unnecessary overhead. Option B uses time-based bucketing and option D uses a running calculation, both of which do not produce the desired overall percentile.

Answer

`index=main | timechart perc95(response_time) by service`

Answer

`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

Answer

`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

Question 17

A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?

Accepted Answer

maxevents=500. Adding maxevents=500 to the transaction command limits each transaction to a maximum of 500 events, preventing any single transaction from consuming excessive resources. This directly addresses the concern of orders with 1000+ events by capping the transaction size while still grouping events by order_id. It is the most appropriate option for resource control.

Answer

keepevicted=true

Answer

maxspan=1h

Answer

maxpause=5m

Question 18

A security team needs to group all login events from the same user session. Events include 'login' and 'logout' with a common session_id field. Which command should be used to combine these events into a single event per session?

Accepted Answer

transaction session_id. The transaction command is designed to group related events into a single transaction based on a common field such as session_id, using parameters like maxspan, maxpause, and startswith/endswith to define boundaries. It is the canonical Splunk command for sessionization of login/logout event pairs.

Answer

join session_id

Answer

stats by session_id

Answer

append session_id

Question 19

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. A macro with arguments is defined using backticks and $arg$ syntax, and it can be invoked in a search to accept parameters such as a sourcetype and time range. This is the correct method for creating a reusable search component that accepts parameters. The macro definition uses `$arg$` placeholders, and the invocation passes values in the backtick-delimited call.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 20

Arrange the steps to create a knowledge object of type 'Event Type' in Splunk.

Accepted Answer

Run a search that returns the desired events, then click 'Save As' and select 'Event Type', then enter a name and save.. Event types are created by defining a search string that matches events, then saving with a name.

Answer

Run a search that returns the desired events, then enter a name for the event type, then click 'Save As' and select 'Event Type'.

Answer

Click 'Save As' and select 'Event Type', then run a search that returns the desired events, then enter a name and save.

Answer

Enter a name for the event type, then click 'Save As' and select 'Event Type', then run a search that returns the desired events.