SPLK-1002 Practice Test 21 — 15 Questions

Question 1

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

Accepted Answer

streamstats. (streamstats) is correct because it calculates a running total per customer across events without creating multivalued fields. Option B (stats) aggregates all events into a single result per group, not a running total. Option C (transaction) groups related events but does not compute running totals. Option D (eventstats) adds aggregate values to each event but not a per-row progression.

Answer

stats

Answer

transaction

Answer

eventstats

Question 2

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Accepted Answer

Filter events before the transaction command.. Reducing maxspan and maxpause limits the time window, thus fewer open transactions. Filtering events early and using the fields command to limit fields reduce data volume. Increasing maxopentxn and keepevicted=true increase memory usage.

Answer

Use keepevicted=true.

Answer

Increase maxopentxn.

Question 3

Which three statements about the transaction command are correct? (Choose three.)

Accepted Answer

The transaction command automatically adds an 'eventcount' field.. Options A, D, and E are correct. The transaction command automatically adds the 'eventcount' and 'duration' fields to each result. It can also correlate events from different indexes, as it uses fields like ‘_time’ and a group-by field; there is no restriction that all events must come from the same index. Option B is false because startswith/endswith are optional; transaction can also use a field-based group (e.g., by session_id). Option C is false because transaction can correlate events from different sourcetypes.

Answer

The transaction command requires a startswith or endswith parameter.

Answer

The transaction command can only correlate events within the same sourcetype.

Question 4

A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?

Accepted Answer

Specify exact field names instead of wildcards. Using specific field names instead of wildcards reduces the overhead of matching multiple fields, improving transaction performance. Option B is invalid syntax; `nullif` is not a transaction option here. Option C increases limits but does not address the root cause of wildcard inefficiency. Option D changes the approach to `stats`, which may not preserve transaction boundaries.

Answer

Use `transaction *id, nullif=null`

Answer

Increase maxopentxn in limits.conf

Answer

Replace transaction with stats

Question 5

A lookup definition includes the option 'batch_index_query=True'. What is the effect?

Accepted Answer

The lookup is populated from an index query when first used.. Batch_index_query=True means the lookup is populated from an index search when first used. Option B is wrong because it incorrectly implies batch processing to reduce lookups. Option C is wrong because it incorrectly implies the lookup is applied to all indexes. Option D is wrong because caching is separate.

Answer

The lookup is batch-processed to reduce number of lookups.

Answer

The lookup is applied to all indexes at once.

Answer

The lookup is cached across all search heads.

Question 6

An admin is troubleshooting a saved search that uses the `| `my_macro` command. The macro definition is `stats count by $1$`. The saved search is scheduled to run hourly. Which of the following issues could cause the saved search to fail? (Choose three.)

Accepted Answer

The macro argument passed in the saved search contains a space without quotes. Options A, B, and D are correct. A: If the macro argument contains a space without quotes, it will be parsed incorrectly. B: If the macro definition includes a pipe at the start but the invocation also includes a pipe, the double pipe causes a syntax error. D: If the macro is not shared to the app where the saved search is stored, the saved search cannot access it. C: 'All time' time range is not a direct cause of failure. E: Overlap might cause skip but not necessarily failure.

Answer

The saved search's time range is set to 'All time'

Answer

The saved search has a cron schedule that overlaps with another saved search

Question 7

A search analyst wants to calculate the average transaction time for each user and then find users whose average transaction time exceeds the overall average. Which approach is most efficient?

Accepted Answer

Use stats by user, then eventstats to add overall avg, then where. It first uses `stats by user` to compute per-user average transaction times, then uses `eventstats` to append the overall average across all users to each row, allowing a direct `where` comparison. This approach is efficient because `eventstats` adds the global aggregate without requiring a separate subsearch or additional data pass, minimizing resource usage.

Answer

Use eventstats to add overall average, then stats by user, then where condition

Answer

Use stats by user to get avg, then appendpipe to add overall avg, then eval

Answer

Use transaction to group events, then stats

Question 8

A search needs to find events where the same user logged in from more than 3 different IP addresses within a 5-minute window. Which combination of commands is most efficient?

Accepted Answer

`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`. The `transaction` command groups events by `user` within a 5-minute window (`maxspan=5m`), then `eval distinct_ip=mvcount(src_ip)` counts the unique IP addresses in that transaction. This directly answers the requirement of finding users who logged in from more than 3 different IPs within a 5-minute window, and it is efficient because `transaction` handles the time-bounded grouping natively without needing to pre-aggregate or use subsearches.

Answer

`| streamstats count by user src_ip | where count > 3`

Answer

`| timechart span=5m limit=0 values(src_ip) by user | eval count=mvcount(values(src_ip)) | where count > 3`

Answer

`| stats count by user, src_ip | where count > 3`

Question 9

A large e-commerce company uses Splunk to monitor its web application performance. The operations team has created a dashboard with a timechart showing the 95th percentile of page load times over the last 24 hours. Recently, the dashboard stopped showing data for the last hour. The Splunk administrator confirms that the index is receiving data and the sourcetype is correctly configured. The search string is:

`index=web_app sourcetype=access_combined earliest=-24h@h latest=@h | timechart perc95(page_load_time) by host`

The dashboard panel uses a base search and a post-process search. The base search is:

`index=web_app sourcetype=access_combined earliest=-7d@d latest=@h`

What is the most likely cause of the missing last hour of data?

Accepted Answer

The base search time range is set to latest=@h, which excludes data from the current partial hour.. The base search uses `latest=@h`, which snaps the end time to the beginning of the current hour (e.g., 14:00:00), excluding any data from the current partial hour (e.g., 14:00:01 to 14:59:59). Since the dashboard panel relies on this base search, the post-process search inherits that time range, causing the last hour of data to be missing even though the index is actively receiving data.

Answer

The post-process search has a time range override that conflicts with the base search.

Answer

The base search uses a macro that is not defined in the app context.

Answer

The index is not being searched because the base search uses a wrong sourcetype.

Question 10

A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is:

```
[build_network_summary]
definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary
args = sourcetype, time_range
iseval = 0
```

The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

Accepted Answer

Modify the macro definition to enclose the `$sourcetype$` argument in quotation marks: `sourcetype="$sourcetype$"`. When a macro argument contains special characters like hyphens, Splunk may misinterpret them as operators (e.g., subtraction) or search syntax modifiers. Enclosing the `$sourcetype$` argument in quotation marks, i.e., `sourcetype="$sourcetype$"`, ensures the entire value is treated as a literal string, preventing parsing errors for sourcetypes with hyphens. Option A is incorrect because increasing the index range doesn't address the parsing issue. Option C is unrelated to the sourcetype name problem. Option D is irrelevant as acceleration does not fix data ingestion or search syntax issues.

Answer

Increase the summary index range to cover all sourcetypes in one pass rather than iterating.

Answer

Change the macro's time_range argument to use a static time range to avoid relative time issues.

Answer

Enable acceleration on the network_summary index to improve data completeness.

Question 11

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

Accepted Answer

Use `transaction user_id maxspan=5m maxevents=100`. The correct approach is to use `transaction user_id maxspan=5m maxevents=100`. This limits each transaction to a maximum of 100 events within a 5-minute window, preventing huge transactions from service accounts while still allowing grouping by user_id and computation of statistics like duration. Option B directly addresses both concerns without excluding data. Pre-filtering (option C) removes data, which may lose needed events or skew results, and is less robust than bounding transaction size.

Answer

Set `maxpause=1m` to break large transactions by gaps

Answer

Exclude service accounts using `where user_id!="svc*"` before transaction

Answer

Switch to `stats values(_raw) by user_id` to avoid transaction overhead

Question 12

A security analyst needs to find all events where the field 'status' is either 'error' or 'critical', and then count the number of events per source IP. Which search is correct?

Accepted Answer

index=security (status=error OR status=critical) | stats count by src_ip. Both A and C return events where status is error or critical. A does this at search time and is the most efficient. C uses the where command, which is valid but less efficient. B is incorrect because AND requires both statuses. D lacks parentheses and is evaluated incorrectly.

Answer

index=security status=error AND status=critical | stats count by src_ip

Answer

index=security status=error OR status=critical | stats count by src_ip

Question 13

Arrange the steps to create a scheduled report in Splunk in the correct order.

Accepted Answer

Run a search, Save as report, Set schedule, Set time range. Scheduled reports require saving a search as a report, then configuring its schedule and time range.

Answer

Run a search, Set schedule, Save as report, Set time range

Answer

Set schedule, Run a search, Save as report, Set time range

Answer

Run a search, Save as report, Set time range, Set schedule

Question 14

A company has a Splunk environment with multiple indexers and a search head. They have a large CSV lookup file for user permissions that is used in many dashboards. Recently, users have reported that dashboards are timing out or slow. The lookup file is about 500 MB and is stored in $SPLUNK_HOME/etc/apps/app_name/lookups/. The lookup is defined as an automatic lookup in props.conf for the source type 'user_activity'. The dashboards use the lookup to enrich events and then perform aggregations. The administrator checks the search logs and sees that searches using the lookup are taking a long time, and some are failing with 'Search head timeout'. The lookup file is updated daily by a script that replaces the file. Which course of action would best improve performance without sacrificing data enrichment?

Accepted Answer

Convert the CSV lookup to a KV Store lookup with the same data. Converting the CSV lookup to a KV Store lookup provides better performance for large lookups. KV Store lookups are indexed and more efficient for large datasets, and they support automatic lookups. Simply using the lookup command in dashboards would not address the size issue, splitting into multiple files adds complexity, and increasing timeout only masks the problem.

Answer

Split the lookup into multiple smaller files and use multiple lookups

Answer

Remove the automatic lookup and use the lookup command only in the dashboards

Answer

Increase the search head timeout setting

Question 15

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. The filename is relative; Splunk looks for it in the lookups directory of the app where the transforms.conf is defined. Therefore, option D is correct because the file 'departments.csv' must be placed in the lookups directory of the same app where the lookup definition (transforms.conf) resides. Option A is incorrect because $SPLUNK_HOME contains many directories, not specifically lookups. Option B is incorrect because while the search app's lookups directory could work if transforms.conf is in that app, the definition is not necessarily in the search app. Option C is incorrect because $SPLUNK_HOME/etc/system/lookups is a system-wide lookup directory, but for app-specific definitions, it should be in the app's lookups directory.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.