SPLK-1002 Practice Test 21 — 15 Questions

Question 1

A dashboard developer is building a panel that must display a single numeric value, the total number of blocked connections in the last hour, centered and large for an executive view. Which two considerations apply when implementing this panel in Splunk? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The search should produce a single row and single column result, such as | stats count AS blocked. A single value panel is driven by a search that returns exactly one row and one numeric column, so the aggregation must collapse the data with stats and alias the result to a readable name. The panel type must also be set to single value, since chart visualizations expect multi-row series and would not render the centered executive indicator the developer wants.

Answer

The search must append | table blocked to guarantee a tabular result

Answer

The search must include a timechart command to bin the last hour into intervals

Answer

The panel requires a trellis layout to split the count by source

Question 2

A Splunk administrator is troubleshooting a search that uses the `transaction` command with `maxspan=30m` and `maxpause=5m`. The search is expected to create transactions for user sessions but is producing many small transactions that should be part of a larger session. The events are ordered by time and have a `user` field. What is the most likely cause?

Accepted Answer

The `maxpause` value is too small, causing transactions to be split when there is a pause longer than 5 minutes between events.. The maxpause parameter defines the maximum allowed time between consecutive events in a transaction. If a session has periods of inactivity longer than 5 minutes, the transaction command will split the session into multiple transactions. This matches the symptom of many small transactions that should be part of a larger session. Adjusting maxpause to a larger value would allow longer gaps and keep the session together, provided maxspan is also sufficiently large.

Answer

The events are not sorted by time, causing the transaction command to misinterpret the sequence.

Answer

The `user` field is not properly extracted, so transactions are grouped incorrectly.

Answer

The `maxspan` value is too small, causing transactions to be split prematurely.

Question 3

A security analyst needs to correlate events from three different sourcetypes: `auth`, `vpn`, and `proxy`. All events share a common field `session_id`. The analyst wants to create a single transaction for each `session_id` that includes all related events, regardless of sourcetype. Which SPL search should be used?

Accepted Answer

index=main (sourcetype=auth OR sourcetype=vpn OR sourcetype=proxy) | transaction session_id. The transaction command groups events that share the same value for the specified field(s). To correlate events from multiple sourcetypes that share a session_id, the search should retrieve all relevant events and then use transaction session_id. This creates one transaction per session_id containing events from all sourcetypes. No additional parameters are needed unless there are specific time constraints.

Answer

index=main (sourcetype=auth OR sourcetype=vpn OR sourcetype=proxy) | transaction session_id sourcetype

Answer

index=main sourcetype=auth OR sourcetype=vpn OR sourcetype=proxy | stats values(*) by session_id

Answer

index=main (sourcetype=auth OR sourcetype=vpn OR sourcetype=proxy) | transaction session_id maxspan=1h

Question 4

A security analyst correlates web proxy events by `session_id` using the `transaction` command. The resulting transactions sometimes merge events from two different users because the proxy reuses `session_id` values across users. Which TWO actions will most reliably prevent this cross-user merging? (Choose two.)

Accepted Answer

Group by both `session_id` and `user` in the transaction command.. Cross-user merging occurs because `session_id` alone is not unique. Making the grouping key composite, either by listing `user` alongside `session_id` in the transaction command or by creating a calculated field that concatenates the two, ensures each group is scoped to one user. Both approaches eliminate the ambiguity at the point of grouping rather than trying to compensate afterward.

Answer

Add `mvlist=true` to retain all values of `user` per transaction.

Answer

Add `maxpause=1s` to force rapid closure of each transaction.

Answer

Add `keepevicted=true` so incomplete transactions are also returned.

Question 5

An analyst reviews a correlation search that uses `transaction host maxspan=10m maxpause=2m`. The analyst wants to understand how the two time parameters interact. Which statement correctly describes their behavior?

Accepted Answer

`maxspan` limits the total duration of a transaction, while `maxpause` limits the gap between consecutive events in the same transaction.. The two parameters constrain different aspects of a transaction's time profile. `maxspan` bounds the overall duration from the earliest to the latest event, while `maxpause` bounds the idle interval between consecutive events. When both are specified, a group is closed as soon as either threshold is exceeded, which is why they are frequently combined to keep sessions both short-lived and contiguous.

Answer

`maxspan` and `maxpause` are mutually exclusive, so specifying both causes the search to ignore `maxpause`.

Answer

`maxspan` limits the gap between events, while `maxpause` limits the total transaction duration.

Answer

`maxspan` applies only to transactions grouped by a single field, while `maxpause` applies only to transactions grouped by multiple fields.

Question 6

An e-commerce company uses Splunk to analyze shopping cart abandonment. Each user session generates events with a `session_id` and an `action` field (e.g., `add_to_cart`, `checkout`, `purchase`). The analyst runs `index=web | transaction session_id startswith=("action=add_to_cart") endswith=("action=purchase") maxpause=10m`. They notice that some transactions include events from two different sessions that occurred 15 minutes apart. Which parameter should the analyst adjust to prevent this?

Accepted Answer

Set `maxpause` to a value less than 15 minutes, such as 5 minutes, to break transactions when the gap between events exceeds that value.. The `maxpause` parameter controls the maximum time between consecutive events in a transaction. When the gap between events exceeds `maxpause`, the transaction is split. In this scenario, events from different sessions are 15 minutes apart, so setting `maxpause` to less than 15 minutes (e.g., 5 minutes) will prevent them from being grouped into the same transaction. `maxspan` limits total duration, but the issue is the gap, not the total span. `closed` does not affect grouping based on time gaps.

Answer

Reduce `maxspan` to 10 minutes to limit the total duration of the transaction.

Answer

Use `startswith=("action=add_to_cart")` and `endswith=("action=purchase")` with a `maxspan` of 5 minutes to limit the transaction to a shorter total duration.

Answer

Add `closed=true` to ensure that only transactions with both start and end events are included.

Question 7

A Splunk user wants to create a lookup that maps HTTP status codes to descriptive messages. The user has a CSV file with fields status_code and description. After uploading the CSV file via the Splunk Web interface, what is the next step to make the lookup available for use in searches?

Accepted Answer

Define a lookup definition that references the uploaded CSV file.. To use an uploaded CSV file as a lookup, you must create a lookup definition that points to the file and defines the fields. This is typically done via Settings > Lookups > Lookup definitions in Splunk Web or by editing transforms.conf. The lookup definition is required for the lookup command to access the CSV data.

Answer

Edit the props.conf file to add a stanza for the CSV file.

Answer

Use the inputlookup command to load the CSV file into memory for each search.

Answer

Create a new index and import the CSV file into it.

Question 8

A user wants to create a lookup that maps user IDs to full names. The mapping data is stored in a CSV file on the search head. Which lookup type should the user choose when defining the lookup in Splunk Web?

Accepted Answer

File-based lookup. File-based lookups are designed to read from CSV files and are the standard method for static mappings such as user ID to name. They are easy to set up and require no scripting or external dependencies. The other lookup types are intended for different use cases: external for dynamic external data, KV Store for mutable datasets, and geo for IP geolocation.

Answer

KV Store lookup

Answer

External lookup

Answer

Geo lookup

Question 9

A dashboard developer needs to add a lookup to a dashboard so that users can view the mapping between error codes and descriptions. The mapping is stored in a CSV file named error_codes.csv with columns code and description. Users should be able to see the full mapping in a table panel without having to run a search that references any index. Which search should be used in the panel?

Accepted Answer

| inputlookup error_codes.csv. The inputlookup command is designed to read a lookup file and return its rows as search results. Because the panel only needs to display the static mapping in error_codes.csv, using inputlookup without an index search is the correct and efficient approach. It avoids scanning event data and directly presents the lookup contents in the table panel.

Answer

| datamodel error_codes.csv

Answer

| lookup error_codes.csv code OUTPUT description

Answer

| from error_codes.csv

Question 10

You are a Splunk power user at a manufacturing company. You have created a timechart that shows machine temperature readings over time. The data is indexed with timestamps every minute, but the timechart shows gaps where no data exists because some machines may not report at all times. You want to fill the gaps with 0 values to avoid misleading visualizations. The current search is: index=manufacturing sourcetype=temperature | timechart span=1h avg(temp) by machine. Which modification to the timechart command will fill the gaps with 0?

Accepted Answer

timechart span=1h usenull=t. Usenull=t fills null values with 0. Option A is incorrect because cont=t ensures continuous time buckets but does not fill nulls with 0. Option B is incorrect because limit=0 does not affect null filling. Option D is incorrect because usenull=f leaves gaps, and useother=f is irrelevant.

Answer

timechart span=1h cont=t

Answer

timechart span=1h limit=0

Answer

timechart span=1h usenull=f useother=f

Question 11

A compliance team wants a dashboard that shows the number of events per hour for the last 24 hours, but they want the chart to display the data as a stacked column chart with a separate column for each sourcetype. Which Splunk visualization should they use?

Accepted Answer

Column chart with stacked mode. The column chart visualization supports a stacked mode, where each column represents a time interval and segments within the column represent different series (e.g., sourcetypes). By using a timechart or chart command with split by sourcetype, the data can be rendered as stacked columns, fulfilling the need to show hourly counts per sourcetype.

Answer

Single value visualization

Answer

Line chart

Answer

Pie chart

Question 12

A power user wants to create a report that shows the number of events per sourcetype, but only for sourcetypes that have more than 1000 events. Which SPL search accomplishes this?

Accepted Answer

index=main | stats count by sourcetype | where count > 1000. The stats command aggregates event counts by sourcetype, and the where command filters those aggregated results based on a numeric condition. Using where count > 1000 correctly returns only sourcetypes with more than 1000 events. Other options either use incorrect commands or unnecessary steps.

Answer

index=main | stats count by sourcetype | search count > 1000

Answer

index=main | stats count by sourcetype | eval count=if(count>1000, count, null) | where count>1000

Answer

index=main | stats count by sourcetype | filter count > 1000

Question 13

An analyst uses the transaction command to group events by `session_id` and includes the `duration` field. They notice that the duration values are in seconds, but they need them in minutes for a report. Which SPL command should they use to convert the duration field from seconds to minutes?

Accepted Answer

eval duration_minutes = duration / 60. The eval command is used for calculations and field manipulation in SPL. To convert seconds to minutes, divide the duration field by 60. This creates a new field or overwrites the existing one. The other commands do not perform arithmetic: convert changes data types, rex extracts fields, and multiplication would give the wrong result.

Answer

convert duration / 60

Answer

eval duration = duration * 60

Answer

rex field=duration "(?<minutes>\d+)"

Question 14

A compliance officer needs to create a report that shows all failed login attempts, but the report must exclude any attempts from IP addresses that are on an approved whitelist. The whitelist is maintained in a CSV file called approved_ips.csv with a field named ip. Which SPL search should the officer use to filter out events from approved IPs?

Accepted Answer

index=security action=failure | lookup approved_ips.csv ip OUTPUT ip AS approved | where isnull(approved). Using lookup to add a field from the whitelist and then filtering with where isnull(approved) correctly excludes events from approved IPs. The opposite filter would include them, the subsearch approach is less efficient, and join is unnecessary and heavy for this simple exclusion.

Answer

index=security action=failure | search NOT [ | inputlookup approved_ips.csv | fields ip ]

Answer

index=security action=failure | lookup approved_ips.csv ip OUTPUT ip AS approved | where isnotnull(approved)

Answer

index=security action=failure | join ip [ | inputlookup approved_ips.csv ]

Question 15

A Splunk administrator is designing a saved search that runs every hour to detect potential data gaps. The search should alert only if the total event count for the previous hour is less than 100. The administrator wants to avoid false positives during scheduled maintenance windows when data ingestion is intentionally paused. Which of the following approaches best meets these requirements?

Accepted Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and add a time-based filter to exclude maintenance windows using a lookup of known maintenance periods.. Using a lookup of known maintenance windows allows the search to dynamically exclude time periods when low event counts are expected. This is more precise than throttling, weekday-only schedules, or host-based exclusions, which do not directly address scheduled maintenance. The lookup can be maintained and updated as needed, providing a flexible solution.

Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and configure the alert to run only on weekdays.

Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and set the alert to throttle for 24 hours to avoid repeated alerts.

Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and add a subsearch that excludes events from the maintenance host.