SPLK-1002 Practice Exam 4 — 20 Questions

Question 1

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 2

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. It first filters out outliers (response_time < 10000) using the where command, then calculates the average response time per user with stats avg(response_time) by user. This ensures outliers are excluded before the average is computed. Option A is incorrect because it uses if() after stats, which incorrectly modifies the average after it includes outliers. Option B is incorrect because the where clause after stats erroneously filters based on the per-user average itself, not on individual response_time values. Option C is incorrect because eventstats computes an overall average that still includes outliers, and the subsequent filter does not retroactively affect that average.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 3

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 4

A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)

Accepted Answer

Increase 'maxevents'.. Options C and E are correct. 'maxevents' sets the maximum number of events per transaction; increasing it allows more events to be collected before the transaction times out. 'maxtime' sets the maximum time (in seconds) from the first event to the transaction completion; increasing it gives the transaction more time to complete. Option A ('maxopentxn') controls the maximum number of concurrent open transactions, not the timeout. Option B ('connected=false') changes event grouping behavior and does not extend time. Option D ('maxspan') defines the maximum time span between earliest and latest event in a transaction; decreasing it would shorten the window and likely cause more timeouts.

Answer

Increase 'maxopentxn'.

Answer

Set 'connected=false'.

Answer

Decrease 'maxspan'.

Question 5

Which of the following searches correctly computes the average response time per host?

Accepted Answer

index=main | stats mean(response_time) by host. The `stats` command with `mean(response_time)` calculates the arithmetic mean of the response_time field, and the `by host` clause groups the calculation per host, producing the average response time for each host. This is the standard Splunk syntax for computing averages in a grouped statistics table.

Answer

index=main | stats average(response_time) by host

Answer

index=main | eventstats avg(response_time) by host

Answer

index=main | stats avg response_time by host

Question 6

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 7

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Accepted Answer

Reduce the time range of the search.. Reducing the time range limits the volume of data scanned by the search head, directly reducing I/O and processing overhead. This is one of the most effective ways to improve search performance because Splunk must read and filter every event in the specified time window from the index.

Answer

Use wildcard characters at the beginning of search terms.

Answer

Use the transaction command to group events.

Answer

Use the dedup command as early as possible.

Question 8

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

Accepted Answer

Choropleth map. C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Answer

Single value

Answer

Gauge

Answer

Scatter plot

Question 9

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Accepted Answer

Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart. Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Answer

Use | where status=401 | dedup src_ip | timechart count by region

Answer

Use | where status=401 | mvexpand region | timechart count by region

Answer

Use | where status=401 | top limit=100 region

Question 10

Order the steps to create a dashboard panel using the XML source editor in Splunk.

Accepted Answer

Open the dashboard in Edit mode, then click Source to open the XML editor, then add a panel element containing a search query and visualization, then save the XML.. Dashboard panels are defined in XML by adding a panel with a search query and visualization.

Answer

Click Source to open the XML editor, then open the dashboard in Edit mode, then add a panel element, then save.

Answer

Add a panel element, then open the dashboard in Edit mode, then click Source, then save.

Answer

Open the dashboard in Edit mode, then add a panel element, then click Source to open the XML editor, then save.

Question 11

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

Accepted Answer

The `search` command should be `where` to use wildcard on extracted fields.. The search uses `search ip=10.0*` which attempts to apply a wildcard pattern to an extracted field. However, the `search` command does not support wildcards for field-value comparisons; it treats `10.0*` as a literal string. To use wildcards on extracted fields, the `where` command with a `like` operator (e.g., `where ip like "10.0%"`) or a regex match is required. This is why option C is correct.

Answer

The regex pattern is incorrect.

Answer

The field 'ip' is not extracted properly.

Answer

The index should be specified at the beginning of the search.

Question 12

A user creates a lookup definition for a CSV file containing user roles. The lookup is used in a search: `| lookup user_roles username OUTPUT role`. The search returns no additional field. The lookup file has columns: 'username', 'role', 'department'. What is the MOST likely issue?

Accepted Answer

The lookup definition uses a different filename than the CSV.. The lookup definition must reference the exact filename of the CSV file. If the definition points to a different filename than the actual CSV, the lookup will fail to load the file, and no fields will be returned. The search syntax is otherwise correct, so the issue lies in the mismatch between the definition and the file.

Answer

The username field in the search is not extracted.

Answer

The lookup file is not in the lookups directory.

Answer

The 'role' field is misspelled in the search.

Question 13

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

Accepted Answer

The same clientip can appear in multiple transactions, causing overcounting.. The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.

Answer

The sourcetype does not contain enough methods to satisfy the condition.

Answer

The stats command should use `dc(clientip)` instead of `count by clientip`.

Answer

The mvcount function counts the number of unique methods, not events.

Question 14

Match each Splunk component to its function.

Accepted Answer

Search Head: Distributes search requests and merges results from indexers.. In a Splunk distributed environment, the Search Head handles search distribution and result merging, the Indexer indexes and stores data, the Universal Forwarder collects and forwards data, and the Deployment Server manages configuration deployment. Common mistakes include swapping the roles of Search Head and Indexer, or confusing the Deployment Server with a forwarder.

Answer

Search Head: Indexes and stores incoming data.

Answer

Deployment Server: Lightweight forwarder that sends data to indexers.

Question 15

Which TWO of the following are valid methods to join two sets of search results?

Accepted Answer

join. The `join` command in Splunk merges two result sets based on a common field, similar to a SQL JOIN. It requires both datasets to have a matching field and supports inner, left, outer, and other join types. Option B is correct because the `append` command simply adds the results of a subsearch to the main search results, effectively concatenating the two sets without requiring a common field.

Answer

union

Answer

stats values(*)

Answer

addcoltotals

Question 16

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Accepted Answer

Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.. The correct optimization is Option C: replacing the transaction command with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'. The transaction command is inefficient because it groups all session events in memory and calculates duration, which consumes significant resources on 20 indexers with 2 TB/day. The stats approach is streaming and reduces data to one row per session before the eval and avg, drastically lowering memory and CPU usage. Option A (reducing time range to 1 hour) might help but doesn't address the core inefficiency and could miss sessions spanning longer than an hour. Option B (adding eventstats before transaction) adds extra processing without removing the bottleneck, still using transaction. Option D (removing maxspan) would allow sessions to remain open indefinitely, increasing memory consumption and potentially causing timeouts. Therefore, Option C is the most effective optimization.

Answer

Reduce the time range to 1 hour.

Answer

Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

Answer

Remove the maxspan parameter from the transaction command to allow longer sessions.

Question 17

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 18

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

Accepted Answer

maxpause=2m. Maxpause=2m (Option C). This option specifies the maximum period of inactivity between events in a transaction. When no events matching the transaction are received for 2 minutes, the transaction closes. This is ideal for correlating events with variable delays because it waits for activity and closes after a quiet period. In contrast, maxspan (option B) sets a total time window from the first event, which would close the transaction regardless of activity after 2 minutes from the start. Options A and D (startswith/endswith) define specific start and end events rather than a timeout. Thus, maxpause ensures the transaction remains open as long as events arrive within 2 minutes of each other.

Answer

endswith="end"

Answer

maxspan=2m

Answer

startswith="start"

Question 19

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 20

Which THREE of the following are correct about the transaction command's default behavior?

Accepted Answer

Transaction groups events by host, source, and sourcetype by default.. Options A, B, and C are correct. By default, the transaction command groups events by host, source, and sourcetype (A). It does not require startswith or endswith to be specified; you can use fields or other options (B). Transactions can evict partial transactions if maxpause is exceeded, meaning if no new events arrive within the maxpause period, the transaction is considered complete and evicted (C). Option D is false because transaction does not require all events to come from the same host; by default it uses host, source, sourcetype but you can override with fields. Option E is false because evicted transactions are not included in the results unless you use the keepevicted=true option.

Answer

Transaction requires all events to come from the same host.

Answer

Transaction always includes all evicted events in the results.