SPLK-1002 Practice Exam 3 — 20 Questions

Question 1

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace transaction with streamstats to create a session ID, then use stats to aggregate. The transaction command is memory- and CPU-intensive because it must sort and group events by client_ip across the full time range, and with 10 million events per hour it will spill to disk and time out. Replacing it with streamstats to assign a session ID (using time-based resets) followed by stats aggregation achieves the same session grouping with a streaming, single-pass algorithm that scales linearly. This is the Splunk-recommended pattern for high-volume sessionization.

Answer

Add `maxevents=100` to limit events per transaction

Answer

Reduce maxspan to 15m and maxpause to 5m

Answer

Increase the search job concurrency

Question 2

What action can the administrator take to resolve this warning?

Accepted Answer

Increase the max_mem_usage_mb setting in limits.conf. The warning is triggered when a lookup exceeds the default memory limit for lookup tables in Splunk. The setting max_mem_usage_mb in limits.conf controls the maximum memory (in MB) that a lookup can consume; increasing it allows larger lookups to be processed without hitting the limit. This directly resolves the warning by raising the threshold, provided the system has sufficient memory. Other options either do not address the memory limit or are workarounds that may not be feasible.

Answer

Split the lookup into multiple smaller files

Answer

Convert the lookup to a KV Store lookup

Answer

Increase max_match in the lookup definition

Answer

Use the lookup command with local=t

Question 3

A Splunk administrator is troubleshooting a slow dashboard that uses a timechart with a large dataset. Which of the following is a best practice to improve performance?

Accepted Answer

Use data model acceleration. Data model acceleration is a best practice to improve the performance of slow dashboards using timechart with large datasets. It pre-computes and stores summaries of data model datasets, allowing searches to run faster by querying the accelerated data instead of raw events. This reduces search time and resource consumption.

Answer

Increase the number of concurrent searches

Answer

Use the eval command to add fields

Answer

Increase the search bucket count

Question 4

Arrange the steps to configure role-based access control in Splunk.

Accepted Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role or edit an existing one. Step 3: Enter a role name. Step 4: Assign desired capabilities (e.g., search, index). Step 5: Set index restrictions and other resource access. Step 6: Click 'Save'.. The correct sequence for configuring role-based access control in Splunk involves first creating or editing a role under Settings > Access Controls > Roles, then assigning capabilities (such as search and index management), followed by setting resource restrictions like index access, and finally saving. This ensures the role is fully defined before being assigned to users. Common mistakes include mixing up the order of capabilities and index restrictions, or mistakenly starting with user assignment.

Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role. Step 3: Enter a role name. Step 4: Set index restrictions first. Step 5: Then assign capabilities. Step 6: Click 'Save'.

Answer

Step 1: Navigate to Settings > Access Controls > Users. Step 2: Assign a role to an existing user. Step 3: Go to Roles and edit the role's capabilities. Step 4: Set index restrictions. Step 5: Save the role.

Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role. Step 3: Enter a role name. Step 4: Assign capabilities. Step 5: Click 'Save'. Step 6: Later, return to edit the role to add index restrictions.

Question 5

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

Accepted Answer

Use `transaction user_id maxspan=5m maxevents=100`. The `transaction` command's memory and runtime scale with the size of the largest transaction, so unbounded grouping by a high-cardinality field like user_id (with service accounts generating thousands of events) causes memory exhaustion. Adding `maxspan=5m` and `maxevents=100` caps each transaction's time window and event count, preventing runaway transactions while still allowing duration computation via the transaction's duration field. This directly addresses both the performance concern and the requirement to preserve duration statistics.

Answer

Set `maxpause=1m` to break large transactions by gaps

Answer

Exclude service accounts using `where user_id!="svc*"` before transaction

Answer

Switch to `stats values(_raw) by user_id` to avoid transaction overhead

Question 6

An analyst wants to create a visualization showing the average response time by hour over the past day, with each server in a separate line. Which command should they use?

Accepted Answer

`... | timechart span=1h avg(response_time) by server`. The timechart command with span=1h and a by clause on server creates a time-series chart with one line per server, showing the average response time per hour. This directly meets the requirement of average response time by hour with each server as a separate line.

Answer

`... | timechart avg(response_time) by server`

Answer

`... | chart avg(response_time) by hour, server`

Answer

`... | stats avg(response_time) by hour, server`

Question 7

A user wants to join data from two datasets in a search. Which command is used to combine results based on a common field, but only returns matching results?

Accepted Answer

join. The join command in Splunk combines results from a subsearch with the main search based on a common field, and by default it returns only matching results (inner join). This is exactly what the question describes: combining datasets and returning only matches.

Answer

append

Answer

union

Answer

lookup

Question 8

An organization uses the Splunk Common Information Model (CIM) to normalize data from various sourcetypes. After onboarding a new firewall vendor, the data is not populating the Network Traffic data model. Which of the following is the most likely cause?

Accepted Answer

The appropriate CIM tags have not been assigned to the new sourcetype.. CIM data models populate based on tags applied to sourcetypes and fields. For a new firewall vendor's data to appear in the Network Traffic data model, the sourcetype must be tagged with the appropriate CIM tags (e.g., `network`, `communicate`) and the fields must be normalised to CIM field names. Without these tags, the data model's search constraints do not match the events, so nothing populates.

Answer

The sourcetype is not included in the 'Network Traffic' data model acceleration.

Answer

The data is being indexed into a custom index that is not monitored by the data model.

Answer

The fields in the firewall data do not match the data model field names exactly.

Question 9

Which of the following is a recommended practice when creating a lookup table file?

Accepted Answer

Include a header row with field names that contain no spaces.. When creating a lookup table file (typically a CSV), Splunk requires that the first row contain the field names. These field names must not contain spaces because spaces would be interpreted as delimiters or cause parsing errors. Using a header row with no spaces ensures that the lookup fields can be correctly referenced in Splunk searches and configurations, such as in the lookup command or automatic lookups. This practice is explicitly recommended in Splunk documentation to avoid field name ambiguity and ensure compatibility.

Answer

Place the file in the global lookups directory.

Answer

Use mixed case field names.

Answer

Use tab-separated values.

Question 10

Which three of the following are benefits of using the Common Information Model (CIM)? (Choose THREE.)

Accepted Answer

Ensures consistent field naming across data sources.. Option A is correct because CIM enforces a standardized set of field names and tags (e.g., src, dest, user, action) so that data from heterogeneous sources is normalized into consistent field naming across data sources, enabling searches and correlation to work uniformly. Option B is correct because CIM ships with pre-built data models for common domains such as Authentication, Network Traffic, Web, and Endpoint, which provide predefined objects, fields, and constraints that accelerate analytics without building schemas from scratch. Option E is correct because once data is mapped to CIM data models, dashboards, reports, and searches built against those models become portable and can be shared and reused across different environments and data sources. Option C is not correct because CIM still requires field aliases and lookups (custom field extractions or knowledge objects) to map raw source fields into the CIM-compliant names; it does not eliminate that mapping work. Option D is not correct because CIM is a normalization and modeling framework, not a compliance reporting engine, and it does not automatically generate compliance reports.

Answer

Reduces the need for custom field extractions.

Answer

Automatically generates reports for compliance.

Question 11

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

Accepted Answer

Use the fields option to include only necessary fields.. Using the fields option to include only necessary fields reduces memory usage because the transaction command by default keeps all fields from the events, which can be memory-intensive. By specifying only the fields needed for the transaction logic, Splunk can discard unnecessary data, significantly lowering memory footprint while preserving the transaction grouping. This is the best approach to maintain transaction logic while optimizing memory.

Answer

Increase the maxeventtokens setting.

Answer

Replace transaction with stats to aggregate.

Answer

Use timeline to store transactions.

Question 12

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 13

Arrange the steps to create a new index in Splunk in the correct order.

Accepted Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Enter index name and configure settings. Step 4: Click Save.. Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Answer

Step 1: Click New Index. Step 2: Navigate to Settings > Indexes. Step 3: Enter index name and configure settings. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Enter index name and configure settings. Step 3: Click New Index. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Click Save. Step 4: Enter index name and configure settings.

Question 14

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. Option B, timechart, is correct because it produces a time-series visualization by bucketing events into time intervals (e.g., span=1d) and plotting aggregated values such as count or avg per bucket, which is exactly the time-series foundation needed for a week-over-week comparison. Option D, timewrap, is correct because it takes the output of a timechart and overlays or wraps multiple time periods (e.g., a 1-week span) so the current week and previous week can be compared side by side on the same chart. Used together, timechart builds the per-interval series and timewrap aligns the current and prior week for direct visual comparison. Option A, stats, is not correct here because it aggregates without producing a time-bucketed series, so it cannot by itself render a week-over-week time-series comparison. Option C, eventstats, is not correct because it adds aggregate values back to individual events rather than creating a time-series chart. Option E, appendcols, is not correct because it merely appends columns from a subsearch to the current results and does not perform time-period wrapping or time-series comparison.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 15

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Accepted Answer

`index=main | stats count by user, action`. Splunk macros with arguments substitute the positional tokens `$1$` and `$2$` with the values passed at call time. In the search `index=main | `mysearch(user, action)`, `$1$` becomes `user` and `$2$` becomes `action`, so the macro definition `stats count by $1$, $2$` expands to `stats count by user, action`. The final expanded search is therefore `index=main | stats count by user, action`.

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Question 16

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

Accepted Answer

It defines the time interval for each data point (1 hour).. The span argument in the timechart command defines the time interval for each data point on the chart. In the search `... | timechart span=1h count by status`, span=1h means each data point represents a 1-hour bucket, and the count is aggregated over that hour for each status value. This controls the granularity of the time series.

Answer

It limits the number of status values displayed.

Answer

It groups events into 1-minute intervals.

Answer

It sets the time range of the chart.

Question 17

Refer to the exhibit. This search returns an error. What is the most likely cause?

Accepted Answer

The timechart command requires a _time field which is not present after stats. The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Answer

The eval command cannot be used before timechart

Answer

The status_group field is not available after timechart because it was created in eval

Answer

The stats command aggregates data, so timechart cannot use the aggregated count field

Question 18

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Accepted Answer

1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.. The Field Extractor guides you through selecting sample data, defining extraction rules, testing, and saving.

Answer

1. Highlight the field value, 2. Select a sample event, 3. Name the field, 4. Save the extraction.

Answer

1. Name the field, 2. Select a sample event, 3. Highlight the field value, 4. Save the extraction.

Answer

1. Select a sample event, 2. Name the field, 3. Highlight the field value, 4. Save the extraction.

Question 19

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Accepted Answer

The field `uri_path` does not exist or contains data that does not match the pattern.. The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.

Answer

The stats command cannot be used after rex.

Answer

The search time range is too short to include any events.

Answer

The regex pattern is incorrectly written.

Question 20

A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?

Accepted Answer

The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.. The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D). Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.

Answer

The alert is disabled due to throttling or suppression settings.

Answer

The search uses a summary index that is not searchable by the alert system.

Answer

The time range in the saved search does not align with the alert schedule.