SPLK-1002 Practice Exam 4 — 20 Questions

Question 1

A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

endswith="action=deny". The endswith option in the transaction command defines the condition that marks the final event of a transaction. Setting endswith="action=deny" tells Splunk to close the transaction when a deny event for that session ID is encountered, which matches the requirement that the transaction ends on a deny.

Answer

endswith="action=allow"

Answer

startswith="action=deny"

Answer

maxevents=2

Question 2

Which TWO of the following statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

It can add a 'duration' field to the result events.. Option A is correct because the transaction command supports the duration option, which adds a 'duration' field to each resulting transaction event showing the elapsed time between the first and last event in the group. Option E is correct because transaction groups events into a single result when they share common field values (specified via the by clause) and occur within a defined time span (maxspan/maxpause), reflecting logical and temporal proximity. Option B is wrong because transaction expects events sorted in ascending _time order, not descending. Option C is wrong because transaction supports many options such as maxspan, maxpause, maxevents, and mvlist, not just startswith/endswith. Option D is wrong because the by clause is optional; transaction can group events using only time-based constraints.

Answer

It requires events to be sorted by _time in descending order.

Answer

It can only be used with 'startswith' and 'endswith' options.

Answer

It requires at least one field in the 'by' clause.

Question 3

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 4

A security analyst wants to calculate the average latency for each web server over the past hour, but only for requests where the status code is 200. The search result includes fields: server, latency, status. Which search correctly accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(latency) by server. It filters events to only those with status=200 before the stats command, ensuring the average latency is calculated exclusively over successful requests. The stats command then computes the average latency grouped by server, which directly answers the requirement without needing conditional logic or post-filtering.

Answer

index=web sourcetype=access | eval good_latency=if(status=200, latency, null) | stats avg(good_latency) by server

Answer

index=web sourcetype=access | eventstats avg(latency) by server | where status=200

Answer

index=web sourcetype=access | stats avg(latency) by server | where status=200

Question 5

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

Accepted Answer

Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.. When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.

Answer

The transaction command failed to group events properly and returned only the login event.

Answer

The transaction command is processing events out of order, causing login and logout timestamps to be the same.

Answer

The maxevents=5 limitation causes the transaction to close early, but the logged duration is still calculated correctly from the first event timestamp.

Question 6

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. For a lookup definition to work, the CSV file must be placed in the lookups directory of the same app where the transforms.conf is defined. Splunk looks for lookup files relative to the app's directory structure, so the file must reside in $SPLUNK_HOME/etc/apps/<app_name>/lookups/. This ensures the lookup is properly scoped and accessible to the app's configuration.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.

Question 7

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 8

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 9

An analyst runs `transaction user_id` to correlate events from a web server. The resulting transaction events have a field 'duration' that shows the time between the first and last event. However, some transactions span over 30 minutes. What transaction option should be added to limit the maximum time between the first and last event?

Accepted Answer

maxspan=30m. The maxspan option sets the maximum time span from the first event to the last event in a transaction.

Answer

maxpause=30m

Answer

maxevents=30

Answer

contime=30m

Question 10

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. It uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10

Question 11

A Splunk search uses 'transaction' with a large dataset and causes a 'max transaction' error. What is the most likely cause and best practice to avoid it?

Accepted Answer

The number of open transactions exceeds the limit; use fields to reduce cardinality or increase maxopentxn.. The 'max transaction' error occurs when the number of open transactions exceeds the default limit (maxopentxn) during a transaction search. The best practice is to reduce the cardinality of the transaction by using fields to group events more efficiently, or to increase the maxopentxn limit if appropriate. This error is about the number of concurrent open transactions, not about maxspan or maxevents.

Answer

The transaction command is used on non-indexed fields; use indexed fields instead.

Answer

The maxspan value is too low; increase maxspan.

Answer

The maxevents value is too low; increase maxevents.

Question 12

Which TWO of the following statements about lookup tables in Splunk are true?

Accepted Answer

KV Store lookups require defining a collection in collections.conf.. Option C is correct because KV Store lookups are backed by MongoDB collections that must be declared in collections.conf (with the stanza name matching the collection) before the lookup definition in transforms.conf can reference it. Option D is correct because CSV lookups read the file at search time, so replacing the CSV file (or uploading a new version via Settings > Lookups) takes effect immediately without restarting Splunk. Option A is wrong because lookups can overwrite existing field values when the lookup output field name matches an event field. Option B is wrong because external lookups can run scripts or binaries that return data from virtually any source, not just CSV. Option E is wrong because lookup files can live in any app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/<app>/lookups/) as well as system/lookups.

Answer

Lookups can only add new fields to events; they cannot replace existing field values.

Answer

External lookups can only retrieve data from CSV files.

Answer

Lookup files can only be stored in $SPLUNK_HOME/etc/system/lookups/.

Question 13

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

Accepted Answer

index=main | transaction user_id maxpause=15m | stats avg(duration). The transaction command with maxpause=15m groups events by user_id into sessions, closing a session when there is a gap of more than 15 minutes between events. The resulting transaction events include a duration field, and stats avg(duration) correctly computes the average session duration.

Answer

index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

Answer

index=main | transaction user_id maxpause=15 | stats avg(_time)

Answer

index=main | transaction user_id maxspan=15m | stats avg(duration)

Question 14

A systems engineer creates a summary index using a saved search that runs every 30 minutes. The summary index aggregates data from multiple sourcetypes. After a week, the engineer notices that the summary index contains duplicate events for certain time ranges. What is the most likely cause?

Accepted Answer

The summary index time range extends beyond the schedule interval, causing overlapping windows.. Duplicate events in a summary index typically occur when the saved search's time range overlaps between scheduled runs. If the search runs every 30 minutes but its time range covers, say, the last hour, each run re-summarizes events already captured in the previous run, producing duplicates. The fix is to align the search time range with the schedule interval (e.g., use '-30m to now' for a 30-minute schedule) or use a deduplication approach.

Answer

The macro used in the saved search includes a time zone conversion that shifts events.

Answer

The saved search schedule is set to run at the wrong time.

Answer

The summary index acceleration is enabled, causing automatic re-summarization.

Question 15

A search uses the transaction command with maxevents=1000 and maxspan=1h. The search is slow and memory-intensive. Which modification can reduce resource usage while still grouping related events?

Accepted Answer

Reduce maxevents to 100.. Reducing maxevents to 100 limits the number of events that the transaction command groups into a single transaction, which directly reduces memory consumption and processing overhead. This modification still allows related events to be grouped together, but with a smaller batch size, making the search less resource-intensive while preserving the core grouping logic.

Answer

Use eventstats with a time window.

Answer

Use tstats instead of transaction.

Answer

Increase maxspan to 2h.

Question 16

Order the steps to set up a data input for monitoring a log file in Splunk.

Accepted Answer

Navigate to Settings > Add Data, then select 'Monitor' as input type, then specify the log file path, then set the source type and index.. Adding a file monitor involves selecting the input type, specifying the file, and configuring source type and index.

Answer

Navigate to Settings > Add Data, then specify the log file path, then select 'Monitor' as input type, then set the source type and index.

Answer

Navigate to Settings > Add Data, then set the source type and index, then select 'Monitor' as input type, then specify the log file path.

Answer

Select 'Monitor' as input type, then navigate to Settings > Add Data, then specify the log file path, then set the source type and index.

Question 17

A search uses 'transaction' to group events by session, but the results show too many transactions with only one event. What is the best way to filter out single-event transactions?

Accepted Answer

| transaction ... | where eventcount > 1. The `transaction` command groups events into transactions, and appending `| where eventcount > 1` filters out any transaction that consists of only a single event. This directly addresses the requirement to remove single-event transactions, as `eventcount` is a default field added by `transaction` that counts the number of events in each transaction.

Answer

Add maxspan=5m to the transaction command

Answer

| transaction maxevents=2 ...

Answer

| transaction ... | where eventcount=2

Question 18

Which of the following are characteristics of the Splunk Common Information Model (CIM)? (Choose three.)

Accepted Answer

It requires the installation of the Splunk Common Information Model Add-on. Option B is correct because the CIM is delivered as the Splunk Common Information Model Add-on, which must be installed (typically alongside the Splunk Common Information Model app) to provide the data models and knowledge objects that normalize data. Option C is correct because CIM data models support acceleration, which precomputes and stores model results in summary form to speed up searches that reference the data models. Option D is correct because the CIM's core purpose is to define standard field names, event categories, and tags so that data from different sources can be searched consistently. Option A is not correct because the CIM does not automatically rename fields; field aliases, calculated fields, and lookups must be configured to map raw fields to CIM names. Option E is not correct because predefined dashboards and reports are not a defining characteristic of the CIM itself; the CIM focuses on data models, field standards, and tags.

Answer

The CIM automatically renames all fields in incoming data to match its standard

Answer

The CIM includes predefined dashboards and reports

Question 19

A saved search is configured to run every hour and generate a summary index. The original search returns data that is then summarized. Which of the following best describes the purpose of summary indexing?

Accepted Answer

To speed up searches by pre-aggregating data into smaller datasets. Summary indexing runs a scheduled search and stores its results in a separate summary index, so future searches can query the much smaller pre-aggregated dataset instead of scanning massive raw event volumes. This dramatically speeds up reporting and dashboard searches over long time ranges by trading storage for query performance.

Answer

To reduce disk space usage by compressing raw data

Answer

To create real-time alerts based on historical data

Answer

To normalize data to the CIM

Question 20

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]