SPLK-1002 Practice Test 22 — 15 Questions

Question 1

Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?

Accepted Answer

overall_avg is not available in the where clause because it is created in eventstats. The search uses eventstats to compute overall_avg, adding it to each event. Then the stats command groups by user, computing user_avg, but it does not retain overall_avg in the output. Therefore, when the where clause references overall_avg, that field no longer exists, causing the search to return no results. Option A is wrong because eventstats before stats is the correct order to compute overall_avg from all events. Option B is wrong because the where clause is appropriate for filtering; no need to use search command here. Option D is wrong because a subquery is not required; the issue is the field being dropped.

Answer

eventstats should be after stats

Answer

The where clause should use the 'search' command

Answer

The search requires a subquery to compute overall_avg

Question 2

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

Accepted Answer

Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.. The `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Answer

Increase maxspan to allow more events to complete.

Answer

Use the 'mvlist' option to list all user_uuid values.

Answer

Add 'closed_txn=1' to the transaction command to only output complete transactions.

Question 3

Which of the following is a recommended practice when creating a lookup table file?

Accepted Answer

Include a header row with field names that contain no spaces.. The recommended practice is to include a header row with field names that contain no spaces (Option C). This ensures proper parsing and avoids issues with special characters or spaces in field names. Option A is incorrect because the global lookups directory is not recommended; instead, lookup files should be placed in the app's lookups directory to ensure portability. Option B is incorrect because mixed case field names can cause case-sensitivity problems; lowercase is preferred. Option D is incorrect because tab-separated values are less standard and more error-prone than comma-separated values (CSV), which is the preferred format with a header row.

Answer

Place the file in the global lookups directory.

Answer

Use mixed case field names.

Answer

Use tab-separated values.

Question 4

Refer to the exhibit. What does the pct field represent?

Accepted Answer

The percentage of each status within each one-hour time bucket.. The `pct` field in the context of a time-based chart (e.g., `timechart count by status`) represents the percentage of each status value within each one-hour time bucket. This is calculated by dividing the count of a specific status in that bucket by the total count of all statuses in the same bucket, then multiplying by 100. Option C correctly identifies this per-bucket proportional breakdown.

Answer

The running total percentage of events over time.

Answer

The percentage of each status across the entire time range.

Answer

The percentage of events for that status compared to the maximum count in that hour.

Question 5

Which TWO of the following are valid aggregation functions in the `stats` command? (Choose 2)

Accepted Answer

sum. The `stats` command in Splunk supports many aggregation functions, including `sum()` and `list()`. `sum()` calculates the total of numeric values for each group, while `list()` returns a multivalue list of all values for a field. Option B is correct because `sum` is a valid aggregation function in `stats`. Option D is correct because `list` is also a valid function. Other options: `median` is not a valid `stats` function (it is available only in `eventstats` or `streamstats`); `earliest` and `distinct_count` are also valid, but the question asks for two specific correct answers, and `sum` and `list` are the intended choices.

Answer

median

Answer

earliest

Answer

distinct_count

Answer

last

Question 6

A lookup configured with WILDCARD match_type for pattern '10.*.25' is not matching some events. Which of the following event values would NOT be matched by this lookup?

Accepted Answer

10.1.25.1. The wildcard pattern '10.*.25' matches any value that starts with '10.' and ends with '.25', with any characters (including none) in between due to the wildcard '*'. Options A (10.1.2.25), C (10.1.25), D (10.2.25), and E (10.10.25) all start with '10.' and end with '.25', so they match. Option B (10.1.25.1) ends with '.1', not '.25', so it does not match the pattern. Therefore, option B is the value that would NOT be matched.

Answer

10.1.2.25

Answer

10.1.25

Answer

10.2.25

Answer

10.10.25

Question 7

Order the steps to set up a data input for monitoring a log file in Splunk.

Accepted Answer

Navigate to Settings > Add Data, then select 'Monitor' as input type, then specify the log file path, then set the source type and index.. Adding a file monitor involves selecting the input type, specifying the file, and configuring source type and index.

Answer

Navigate to Settings > Add Data, then specify the log file path, then select 'Monitor' as input type, then set the source type and index.

Answer

Navigate to Settings > Add Data, then set the source type and index, then select 'Monitor' as input type, then specify the log file path.

Answer

Select 'Monitor' as input type, then navigate to Settings > Add Data, then specify the log file path, then set the source type and index.

Question 8

What is the most likely reason for this behavior?

Accepted Answer

The 'max_time' setting limits the accelerated data to the last 1 day, so tstats only queries that time range.. The 'max_time' setting in the acceleration configuration limits the accelerated data to the last 1 day. When using tstats, it only queries this accelerated time range, ignoring the 'earliest_time' of -7d in the search. Therefore, even though the search spans 7 days, tstats returns results only from the last 24 hours because the acceleration does not cover the older data.

Answer

The acceleration summaries are only generated at the 5-minute and 1-hour intervals, not daily.

Answer

The acceleration is disabled because 'enabled' is set to true incorrectly.

Answer

The acceleration automatically becomes outdated after 1 day and requires a rebuild.

Question 9

A user defined a macro that includes a lookup command. The macro works correctly in ad-hoc searches. However, when the macro is used in a scheduled saved search, the macro fails to expand. Administration confirms the macro is shared globally. What is the most likely cause of this failure?

Accepted Answer

The lookup used in the macro is not accessible in the saved search's app context.. Scheduled saved searches run under the context of the app where the saved search is defined. Even though the macro itself is shared globally, any commands or lookups used within the macro must be accessible in that app context. If the lookup used in the macro is defined in a different app and not shared to the saved search's app, the macro will fail at schedule time while working in ad-hoc searches where the user has access to the lookup. Therefore, option B is correct. Option A is unlikely because macro arguments would cause failure in ad-hoc as well. Option C is false as administration confirmed the macro is shared globally. Option D is incorrect because a syntax error would also manifest in ad-hoc searches.

Answer

The macro expects arguments that are not provided in the saved search.

Answer

The macro is not shared to the global context despite confirmation.

Answer

The macro contains a syntax error that only appears at schedule time.

Question 10

A company needs to enrich events with lookup data that changes over time, such as daily exchange rates. Which lookup method is most appropriate?

Accepted Answer

Use a time-based lookup with a time_field parameter. A time-based lookup with a time_field parameter allows the lookup to return different values based on the event timestamp. Option A is incorrect because a KV Store lookup is not time-aware by default and would require additional logic. Option B is incorrect because a file lookup without time context cannot handle time-varying data. Option D is incorrect because index-time lookups are static and require reindexing to reflect changes.

Answer

Use a KV Store lookup with a time-range filter in the search

Answer

Use a file lookup without time context

Answer

Use an index-time lookup

Question 11

Which TWO of the following commands can be used to create a table of unique values for a field, along with their counts?

Accepted Answer

stats count by field_name. The `stats count by field_name` command groups events by the unique values of the specified field and outputs a table with each value and its count. The `top field_name` command also produces a table of the most frequent field values along with their counts, sorted in descending order by count. Both commands generate the required table of unique values with counts.

Answer

fields field_name

Answer

rare field_name

Answer

dedup field_name

Question 12

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. It uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10

Question 13

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 14

A Splunk admin wants to create a saved search that triggers an alert when the average CPU usage across all servers exceeds 80% over a 5-minute window. The data is in a 'perfmon' sourcetype. Which search best fits this requirement?

Accepted Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80. It uses `earliest=-5m latest=now` to restrict the time range to the last 5 minutes, `bucket _time span=5m` to explicitly define the 5-minute window (even though the range is exactly 5 minutes, this ensures proper grouping for saved searches that may run later), `stats avg(Value) as avg_cpu by host` to compute the average per host within that window, and `where avg_cpu > 80` to filter hosts exceeding 80%. Option A uses `timechart`, which creates a separate series per time bucket and host, making the `where` clause ineffective (it would try to compare a field that doesn't exist). Option B omits the `bucket`, so the average is computed over the entire 5-minute range without explicit windowing, which can cause issues if the saved search runs with a different time range. Option C uses `streamstats`, which calculates a running average rather than a fixed-window average, not matching the requirement.

Answer

index=os sourcetype=perfmon counter="% Processor Time" | timechart avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" | streamstats avg(Value) as avg_cpu by host | where avg_cpu > 80

Question 15

A Splunk search uses 'transaction' with a large dataset and causes a 'max transaction' error. What is the most likely cause and best practice to avoid it?

Accepted Answer

The number of open transactions exceeds the limit; use fields to reduce cardinality or increase maxopentxn.. The error indicates the number of open transactions exceeded the limit (maxopentxn). Reducing field cardinality or increasing maxopentxn helps. Options A, C, and D address other issues.

Answer

The transaction command is used on non-indexed fields; use indexed fields instead.

Answer

The maxspan value is too low; increase maxspan.

Answer

The maxevents value is too low; increase maxevents.