SPLK-1002 Practice Exam 2 — 20 Questions

Question 1

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 2

A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?

Accepted Answer

Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`. Macro arguments must be referenced with $arg$ syntax and when the value contains spaces, it must be quoted. Option A defines the argument numerically (1) and uses $1$ without quotes, which fails for spaces. Option B defines the argument with $app$ (invalid syntax for definition) and uses $app$ without quotes. Option D defines 'app' without dollar signs, so the usage treats 'app' as literal text, not a variable. Option E uses $1 without a trailing dollar sign, which is invalid.

Answer

Definition: `filter_by_app(1)` and usage: `index=main app=$1$`

Answer

Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`

Answer

Definition: `filter_by_app(app)` and usage: `index=main app=app`

Answer

Definition: `filter_by_app($1)` and usage: `index=main app=$1`

Question 3

Which of the following is true about the sort command?

Accepted Answer

All of the above. The sort command in Splunk can sort in ascending order by default, can sort by multiple fields, and can use the limit parameter to restrict the number of results. All three statements (B, C, and D) are true, making 'All of the above' the correct choice.

Answer

It only sorts in ascending order by default

Answer

It can sort by multiple fields

Answer

It can use the limit parameter to limit results

Question 4

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]

Question 5

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

Accepted Answer

Add `| where count > 100` after the stats command.. The `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Answer

Use `| top limit=100 user` to get the top 100 users.

Answer

Add `| where count > 100` before the stats command.

Answer

Use `| filter count > 100` after the stats command.

Question 6

Arrange the steps to configure a lookup table file in Splunk.

Accepted Answer

Upload the lookup file to Splunk via Settings > Lookups > Lookup table files > New, then define the lookup table file by specifying the filename and options.. Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Answer

Define the lookup table file first via Settings > Lookups > Lookup table files, then upload the file.

Answer

Create a lookup definition first via Settings > Lookups > Lookup definitions, then upload the file, then define the lookup table file.

Answer

Upload the file to a custom directory, then create a lookup definition without defining the lookup table file.

Question 7

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Accepted Answer

The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.. Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Answer

The lookup file is not distributed to all indexers.

Answer

The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

Answer

The max_matches should be set to 0.

Answer

The lookup definition is missing the default_match setting, which should be set to 'no_match'.

Question 8

An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?

Accepted Answer

Splits the count by the 'method' field into separate series.. The `timechart` command with a `by` clause splits the count into separate series for each distinct value of the 'method' field, creating one line per method on the chart. Option A is incorrect because the time range is determined by the search, not necessarily per day. Option B is incorrect because the default span depends on the time range (e.g., less than 24 hours uses 1-minute bins, etc.). Option C is incorrect because `timechart` does not limit to top 10 by default.

Answer

Calculates the total count per day for each method.

Answer

Bins events into 1-hour intervals by default.

Answer

Shows only the top 10 methods.

Question 9

Which TWO of the following are valid ways to correlate events without using the transaction command?

Accepted Answer

Using eventstats to compute counts per transactionID. Options D and E are correct. Using stats ... by transactionID groups events by a common field and computes aggregate values, effectively correlating events. Using eventstats to compute counts per transactionID adds a calculated aggregate to each event, correlating events with the same transactionID. Both are valid correlation methods without using the transaction command. Options A and B (append and join) combine results from separate searches but do not correlate events in the same sense, and sort (C) merely orders events.

Answer

Using append to combine events from two searches

Answer

Using join to merge events on transactionID

Answer

Using sort to order events by transactionID

Question 10

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. The `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`

Question 11

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 12

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. The correct method is to define a macro with arguments using backticks and $arg$ syntax (Option C). Macros are designed for reusable search components that can accept parameters. Option A (saved search with tokens) is typically used in dashboards to pass values at runtime, not for creating reusable search fragments. Option B (eval statement) defines a variable but does not create a reusable search component. Option D (lookup definition) is used for enriching events with external data, not for defining search logic.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 13

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. The correct macro definition is option B because it uses a positional argument ($1$) and does not include a leading pipe. In Splunk, macros are invoked as part of a pipe chain, so the definition should not start with a pipe. Positional arguments are standard and do not require predefined argument names, whereas named arguments must be defined in the macro properties. Option A fails because it uses a named argument ($field$) without defining it, making it invalid. Options C and D incorrectly include a leading pipe at the start of the definition, which would cause a syntax error when the macro is expanded within a pipe.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 14

Which THREE are components of the Common Information Model (CIM) in Splunk?

Accepted Answer

Tags. The three components of the Common Information Model (CIM) in Splunk are Tags (A), Data Models (B), and Field Extractions (D). Tags are used to define the CIM data model's data source types and event types. Data Models provide the framework for the CIM, defining normalized fields and relationships. Field extractions are necessary to map raw data to the CIM fields. Lookup tables (C) and dashboards (E) are not part of the CIM; they may be used in conjunction with CIM but are not core components.

Answer

Lookup tables

Answer

Dashboards

Question 15

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Accepted Answer

Provides a consistent field naming convention across different data sources.. The Splunk Common Information Model (CIM) provides two key benefits: (A) It normalizes data from different sources into a consistent field naming convention, making it easier to search across diverse data sources. (E) It supports data model acceleration, which speeds up searches using the tstats command on CIM-compliant data models. Option B is incorrect because real-time correlation is not a direct feature of CIM; CIM standardizes fields but does not perform correlation. Option C is incorrect because CIM does not reduce indexing volume; indexing is independent of CIM. Option D is incorrect because CIM does not define sourcetypes; sourcetypes are defined at input time.

Answer

Enables real-time correlation of events across multiple data sources.

Answer

Reduces indexing volume by summarizing data into CIM-compliant indexes.

Answer

Defines the sourcetypes for common technologies (e.g., firewall, IDS).

Question 16

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

Accepted Answer

timechart span=5min count. The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Answer

chart count over _time span=5min

Answer

stats count by _time span=5min

Answer

streamstats count span=5min

Question 17

A data engineer has defined a CIM data model for 'Network_Traffic'. They have also created field aliases using `| fieldaliases` to map custom fields like `src_ip` and `dest_ip` to the CIM fields. When running searches against the data model, some events do not appear. The engineer verified that the tags are correctly applied. What is the most likely remaining issue?

Accepted Answer

The field aliases must be defined within the data model itself, not via `| fieldaliases`.. Field aliases defined using the `| fieldaliases` command are applied at search time but are not recognized by data model acceleration. Data models use their own field definitions and aliases must be defined within the data model itself (via the data model editor) to be included in accelerated searches. Option B is incorrect because the time range would affect all events equally and does not explain why some events are missing specifically due to field mapping. Option C is incorrect because custom fields do not need to be indexed; they can be extracted at search time, but the issue is that the aliases are not applied within the data model. Option D is incorrect because tags are correctly applied as verified, so the problem is not tag application.

Answer

The data model search is using a time range that excludes the events.

Answer

The custom fields are not indexed, so they cannot be used in data models.

Answer

The tags are applied only to a subset of events.

Question 18

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

Accepted Answer

Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.. Creating a summary index that pre-aggregates error counts by severity every 5 minutes reduces the amount of data scanned in real-time, improving performance without changing the dashboard's output. Option A is wrong because using 'bucket' and 'stats' with streaming commands still requires scanning all raw events; it does not precompute results and may not significantly reduce I/O. Option C is wrong because limiting the time range alters the dashboard's displayed data (e.g., less historical context), which violates the requirement to keep the output unchanged. Option D is wrong because search acceleration (e.g., data model acceleration) creates summaries for specific data models, not arbitrary field aggregations; it may not target the 'severity' breakdown efficiently and can consume significant resources.

Answer

Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

Answer

Limit the time range to the last 1 hour instead of 24 hours.

Answer

Enable search acceleration for the index.

Question 19

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 20

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.