SPLK-1002 Practice Test 22 — 15 Questions

Question 1

A Splunk Power User is building a scheduled saved search that must run every day at 06:00 and email a CSV of results to the security team. The saved search is created in the Search & Reporting app, but the team also wants it visible when they open the Enterprise Security app. Which action makes the saved search available in both apps without duplicating it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the saved search's permissions so it is shared globally (All apps), then grant the appropriate roles read access.. Saved searches and other knowledge objects have a sharing scope. When the scope is set to global, the object is available across all apps, so users working in Enterprise Security can see and use the same saved search created in Search & Reporting. Read permissions granted to the relevant roles determine which users can view or run it, and no duplication or app packaging is needed.

Answer

Move the saved search into the /opt/splunk/etc/apps/search/local/savedsearches.conf file and restart Splunk Enterprise so the configuration is reloaded.

Answer

Set the saved search permissions to be shared in the current app only, then add the Enterprise Security app to the search's app context list.

Answer

Export the saved search as an app and install that app on the search head, then reference it from Enterprise Security dashboards.

Question 2

A Splunk Power User is investigating a series of failed login attempts followed by a successful login from the same user. They want to create a transaction that groups all events for a user within a 5-minute window, but only if the transaction contains at least one failed login and one successful login. Which transaction parameter should they use to ensure the transaction only includes events that meet this condition?

Accepted Answer

There is no single transaction parameter to enforce this; a subsearch or additional filtering with `search` is required.. The transaction command groups events but does not filter based on the presence of specific events. To require that a transaction contains both failed and successful logins, you must use additional search commands after the transaction, such as filtering with `search` or using `stats` to count event types. Therefore, no single transaction parameter can enforce this condition.

Answer

maxspan=5m

Answer

startswith="failed"

Answer

maxpause=5m

Question 3

A network engineer needs, for each src_ip, the single destination port that received the most connections. The raw data has one event per connection with fields src_ip and dest_port. Which search returns exactly one row per source with its most frequent port?

Accepted Answer

index=net | top limit=1 dest_port BY src_ip. The top command is purpose-built for frequency analysis and, when combined with a BY clause and limit=1, returns the single most common value of a field within each group. That produces exactly one row per src_ip containing the dominant dest_port. Ranking with a global sort followed by dedup or taking a numeric maximum of the port field does not isolate the per-group mode, so those alternatives cannot guarantee the correct port.

Answer

index=net | stats max(dest_port) AS dest_port BY src_ip

Answer

index=net | eventstats count BY src_ip, dest_port | dedup src_ip

Answer

index=net | stats count BY src_ip, dest_port | sort - count | dedup src_ip

Question 4

A Splunk Power User needs to correlate events that share a common `correlation_id` field, but the events may arrive out of order and can be separated by long periods of inactivity. The analyst wants to ensure that events are grouped even if there are large gaps between them. Which transaction option should be configured?

Accepted Answer

maxpause=24h. maxpause defines the maximum time between consecutive events within a transaction. A large value like 24h allows events with long gaps to remain grouped, which is appropriate when correlating by a shared correlation_id despite inactivity. maxspan limits total duration, maxpause=0 breaks transactions at any gap, and keepevicted controls retention of over-limit transactions, none of which support grouping across long gaps.

Answer

maxspan=0

Answer

keepevicted=false

Answer

maxpause=0

Question 5

A Power User needs a saved search that runs every Monday at 06:00 and writes a summarized count of events per host into the `summary` index. The user creates the search and sets it to run on a cron schedule, but wants to confirm the schedule expression that produces a 06:00 Monday run. Which cron expression should be used?

Accepted Answer

`0 6 * * 1`. Splunk cron expressions order fields as minute, hour, day-of-month, month, day-of-week, with day-of-week 0 being Sunday and 1 being Monday. A weekly 06:00 Monday run therefore requires minute 0, hour 6, and day-of-week 1, with wildcards for day-of-month and month. Mistaking the day-of-week numbering or swapping the minute and hour fields are the common failure modes.

Answer

`0 6 * * 0`

Answer

`0 6 1 * *`

Answer

`6 0 * * 1`

Question 6

A Splunk user wants to display the results of a search as a single value visualization that shows the total count of events from the last 24 hours. Which of the following should be used?

Accepted Answer

Use the `stats count` command and select the Single Value visualization.. To display a single value such as a total count, the search should return exactly one row and one column. The `stats count` command does this by aggregating all events into a single count. Other commands like timechart, top, or table return multiple rows or columns, which are not compatible with the Single Value visualization without additional transformation.

Answer

Use the `top` command and select the Single Value visualization.

Answer

Use the `timechart count` command and select the Single Value visualization.

Answer

Use the `table` command and select the Single Value visualization.

Question 7

A Power User needs a reusable snippet that always filters events to a specific index and sourcetype before any other command runs. The snippet must accept no arguments and be inserted at the start of many ad-hoc searches. Which macro configuration best fits this requirement?

Accepted Answer

A search macro with no arguments whose definition is `index=firewall sourcetype=fw_traffic`, invoked as `` `firewall_base` `` at the start of the search.. A search macro is designed to store reusable search text that can be invoked by name with backticks. Defining a zero-argument macro that contains the fixed index and sourcetype filter lets any search start from the same dataset with a single reference. This promotes consistency and reduces errors compared with retyping the filter, and no arguments are needed because the fragment is constant.

Answer

A lookup definition named firewall_base that maps index and sourcetype values for the search to apply automatically.

Answer

A saved search named firewall_base that runs on a schedule and writes results to a summary index for later lookup.

Answer

An event type named firewall_base that contains `index=firewall sourcetype=fw_traffic`, referenced with `eventtype=firewall_base`.

Question 8

A Splunk Power User is using the transaction command to group events by `user_id`. They notice that some transactions contain events that are separated by more than 30 minutes, even though they expected transactions to be limited to a 30-minute window. Which transaction parameter should they adjust to enforce a maximum time gap between events in a transaction?

Accepted Answer

maxpause. The maxpause parameter defines the maximum time between consecutive events in a transaction. If the time difference between two events exceeds maxpause, the transaction is split. Setting maxpause=30m ensures that events more than 30 minutes apart are not grouped together. This directly solves the problem of transactions containing events with large time gaps.

Answer

endswith

Answer

maxspan

Answer

startswith

Question 9

A Splunk administrator maintains a macro named `net_agg` that is invoked by twelve different saved searches across the org. A change to the underlying firewall sourcetype means the macro's base search must now use `sourcetype=pan:traffic` instead of `sourcetype=cisco:asa`. The admin edits the macro definition once and saves it. What is the result for the existing saved searches?

Accepted Answer

All twelve saved searches use the updated definition the next time they run, with no edits to the saved searches.. Macros are stored as reusable SPL definitions and expanded when a search is dispatched, so updating the macro's definition propagates to every saved search that calls it without touching those saved searches. This central maintenance is exactly why macros are used for logic shared across many searches. Re-saving, re-importing, or separating scheduled execution would all be unnecessary or incorrect.

Answer

The saved searches fail until the macro is re-imported into each app that owns them.

Answer

Each saved search must be re-saved individually before the new sourcetype is picked up.

Answer

The change applies only to ad-hoc searches; scheduled saved searches keep the original definition.

Question 10

A Splunk analyst runs a search that uses `transaction` to group events by session ID, but the results include transactions that span more than 5 minutes. The analyst wants to limit transactions to a maximum duration of 5 minutes. Which argument should be added to the `transaction` command?

Accepted Answer

maxspan=5m. The maxspan argument of the transaction command sets the maximum total duration for a transaction. By specifying maxspan=5m, any transaction that would exceed 5 minutes is either truncated or split, depending on other arguments like maxpause. This is the correct way to enforce a maximum duration on grouped events.

Answer

maxpause=5m

Answer

startswith=5m

Answer

endswith=5m

Question 11

An analyst needs to enrich each event with the previous event's status code for the same user session, assuming events are already sorted by time. The session ID field is `session_id` and the status field is `status`. Which SPL search accomplishes this?

Accepted Answer

index=web | sort 0 + _time | streamstats current=f global=f last(status) AS prev_status BY session_id. To get the previous event's field value within a session, you need a streaming command that can look back at prior events. streamstats with current=f excludes the current event, and global=f ensures the calculation resets for each session_id, so last(status) yields the prior status. Sorting by time ensures correct order.

Answer

index=web | sort 0 + _time | streamstats current=t global=t last(status) AS prev_status BY session_id

Answer

index=web | sort 0 + _time | eventstats last(status) AS prev_status BY session_id

Answer

index=web | sort 0 + _time | delta status AS prev_status BY session_id

Question 12

An analyst correlates application events by `order_id` with `transaction order_id maxspan=1h`. A downstream dashboard then needs the number of events and the time between the first and last event of each transaction. Which approach reliably produces those per-transaction metrics?

Accepted Answer

Use the `eventcount` and `duration` fields that the transaction command automatically adds to each transaction.. The transaction command enriches each emitted transaction with `eventcount`, the number of events grouped, and `duration`, the elapsed seconds between the first and last event. Because these fields are attached automatically, a dashboard can reference them directly without additional aggregation, making them the straightforward and reliable source for the per-transaction metrics the analyst needs.

Answer

Add `mvlist=true` so that the multivalue list length reveals the event count and duration.

Answer

Add `keepevicted=true` so closed transactions expose their event count and duration.

Answer

Pipe the transaction output to `stats count by order_id` to obtain the event count and duration.

Question 13

A Splunk Power User is correlating purchase events where each event contains a `cart_id` field. Events for a single cart can be interleaved with events from other carts, and the user wants each transaction to contain only events that share the same `cart_id`. Which search should be used?

Accepted Answer

`... | transaction cart_id`. The transaction command with a field name groups events sharing the same field value into a single transaction, which is exactly what is needed for interleaved cart events. It also adds useful metadata like duration and eventcount. The other options either produce statistical output, merge unrelated events, or use a non-existent command.

Answer

`... | correlate cart_id`

Answer

`... | stats list(_raw) by cart_id`

Answer

`... | transaction maxpause=5m`

Question 14

A SOC analyst correlates authentication events with `transaction user` and notices the resulting transactions contain events from unrelated activities because the 'user' field also appears in application logs that share the same index. The analyst wants transactions built only from authentication events. Which approach correctly scopes the correlation?

Accepted Answer

Add sourcetype=auth to the base search before transaction. Correlation operates on whatever events reach the transaction command, so the reliable way to exclude unrelated logs is to filter them out in the base search, for example with sourcetype=auth. Post-filtering happens after grouping and cannot undo mixed transactions, and transaction does not offer a sourcetype argument. Scoping the input ensures each transaction contains only the intended events.

Answer

Add fields user to the transaction command

Answer

Add `| where sourcetype=auth` after the transaction

Answer

Add `| transaction user sourcetype=auth`

Question 15

An analyst wants to correlate events from a firewall log where each session is identified by a `src_ip` and `dest_ip` pair. The events include a `bytes` field. The analyst needs to calculate the total bytes transferred per session. Which SPL search accomplishes this?

Accepted Answer

index=firewall | stats sum(bytes) by src_ip, dest_ip. To calculate total bytes per session defined by src_ip and dest_ip, the most straightforward and correct approach is to use the stats command with sum(bytes) grouped by src_ip and dest_ip. This aggregates the bytes field across all events for each unique session without the overhead of the transaction command. The transaction command is unnecessary here because the session identity is already captured by the field pair.

Answer

index=firewall | transaction src_ip dest_ip | stats sum(bytes) by src_ip, dest_ip

Answer

index=firewall | transaction src_ip dest_ip | eval total_bytes = sum(bytes)

Answer

index=firewall | transaction src_ip dest_ip | stats sum(bytes) by transaction_id