SPLK-1003 Practice Exam 4 — 20 Questions

Question 1

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

Accepted Answer

`stats avg($field$) as avg_response`. Option D is correct because in Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro.

Answer

`stats avg($field$) | eval avg_response=$result$`

Answer

"stats avg($field$) as avg_response"

Answer

`stats avg($field$) as avg_$field$`

Question 2

An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?

Accepted Answer

The lookup definition is not configured as a CIDR type. The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet. Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.

Answer

The IP addresses in the events are in lowercase

Answer

The lookup file is not in CSV format

Answer

The lookup file is compressed and not being read correctly

Question 3

A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?

Accepted Answer

The search is not scheduled or set to 'Auto' for the panel.. Option B is correct because the single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.

Answer

The 'Token delay' is too high.

Answer

The time range picker is set to 'All time'.

Answer

The dashboard's 'Auto-refresh' interval is not set.

Question 4

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Answer

External lookup

Answer

KV Store lookup

Answer

Geospatial lookup

Question 5

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. Option C is correct because it first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 6

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

Accepted Answer

A lookup definition must be added to transforms.conf. When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Answer

The lookup file must be uploaded via the UI instead of placed manually

Answer

The search head must be configured as a lookup server

Answer

The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory

Question 7

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Accepted Answer

transaction by transaction_id. Option A is correct because the `transaction` command with `by transaction_id` groups all events sharing the same `transaction_id` field value into a single transaction, with no default time constraints. This matches the requirement to correlate events across `web_access`, `auth_log`, and `app_log` sourcetypes without any time window restrictions.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 8

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

Accepted Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h. Option C is correct because the `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h

Answer

index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time

Answer

index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h

Question 9

Which TWO statements are true about the `transaction` command in Splunk?

Accepted Answer

It can group events based on one or more common field values.. Option A is correct because the `transaction` command groups events that share one or more common field values, such as `session_id` or `user_id`, into a single transaction. This allows you to correlate related events across different sources or sourcetypes based on matching field values.

Answer

It automatically calculates the duration between the first and last event.

Answer

It can only correlate events from the same sourcetype.

Answer

It automatically sorts events in chronological order within each transaction.

Question 10

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. Option A is correct because the 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 11

A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?

Accepted Answer

maxpause=1800. Option D (maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.

Answer

startswith=login endswith=logout

Answer

mvlist=session_id

Answer

maxspan=30m

Question 12

A security team needs to correlate failed login attempts across multiple web servers to identify brute force attacks. Each server logs authentication failures with timestamps and source IPs. The team wants to create a transaction that groups failed attempts within 5 minutes from the same IP, but only if there are at least 3 failures. Which approach correctly implements this requirement?

Accepted Answer

index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m maxevents=3. Option B is correct because the `transaction` command groups events by `clientip` with a `maxspan=5m` window, and `maxevents=3` ensures only transactions with at least 3 events are retained. This directly meets the requirement to correlate failed login attempts (status=401) from the same source IP within 5 minutes, identifying brute force attacks.

Answer

index=web sourcetype=access_combined status=401 | search clientip=* | head 3

Answer

index=web sourcetype=access_combined status=401 | stats count by clientip, _time

Answer

index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m

Question 13

Which THREE of the following are valid use cases for the `transaction` command in Splunk?

Accepted Answer

Identifying a sequence of events that indicate a brute-force attack (multiple failed logins followed by a success).. Option A is correct because the `transaction` command groups related events into a single transaction based on common fields and temporal constraints. In this case, it can group multiple failed login events followed by a successful login for the same user, which is a classic indicator of a brute-force attack. The command allows you to set `maxspan` and `maxpause` to define the time window and gap between events, making it ideal for detecting such sequences.

Answer

Generating an alert when a transaction contains more than five events.

Answer

Enriching events with external data from a CSV file based on a common key.

Question 14

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. Option D is correct because the `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 15

A Splunk administrator notices that a `transaction` command used for correlating VPN login and logout events is consuming excessive memory and causing search timeouts. The transaction groups events by `user` with `maxspan=12h` and `maxpause=30m`. The VPN logs contain millions of events per day. Which design change would most effectively reduce resource consumption while maintaining the ability to correlate logins and logouts within the same session?

Accepted Answer

Replace the transaction command with a stats command using earliest and latest functions on the event type.. Option C is correct because replacing `transaction` with `stats` using `earliest` and `latest` eliminates the in-memory event buffering that causes memory exhaustion. `transaction` holds all events in memory until the transaction boundary (maxspan/maxpause) is reached, which is extremely expensive for millions of VPN events. `stats` processes events in a streaming fashion, computing the first and last timestamps per user without storing the full event list, drastically reducing memory and avoiding timeouts.

Answer

Remove the maxpause option from the transaction command to simplify grouping.

Answer

Reduce maxspan to 4h to limit the time window for grouping events.

Answer

Add maxevents=2 to the transaction command to limit each transaction to exactly two events.

Question 16

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

Accepted Answer

The same clientip can appear in multiple transactions, causing overcounting.. The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.

Answer

The sourcetype does not contain enough methods to satisfy the condition.

Answer

The stats command should use `dc(clientip)` instead of `count by clientip`.

Answer

The mvcount function counts the number of unique methods, not events.

Question 17

A security analyst is writing a search to detect lateral movement across servers by correlating authentication events from multiple domain controllers. Each event has a `user`, `src_ip`, and `dest_ip`. The analyst wants to group events where the same user authenticates from at least 3 different source IPs within 10 minutes. Which THREE components must be part of the search to achieve this? (Choose THREE.)

Accepted Answer

Use `transaction user` to group events by user.. Option A is correct because the `transaction` command groups events that share a common field value (in this case, `user`) into a single transaction. This is essential for correlating authentication events from multiple domain controllers where the same user appears, allowing subsequent analysis of the source IPs within each group.

Answer

Use `maxevents=3` to ensure at least three events per transaction.

Answer

Use `dedup user` before the transaction to reduce events.

Question 18

A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?

Accepted Answer

index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip). Option A is correct because it uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.

Answer

index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8

Question 19

Arrange the steps to create a scheduled report in Splunk in the correct order.

Question 20

Order the steps to create a data model in Splunk in the correct order.