SPLK-1002 Practice Test 23 — 15 Questions

Question 1

A Splunk administrator is troubleshooting a search that uses the `transaction` command. The search is taking too long to complete and returning incomplete results. Which TWO changes are most likely to improve performance and accuracy of transaction searches? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use `fields` before `transaction` to include only necessary fields.. Using the `fields` command before `transaction` reduces the amount of data Splunk must process by retaining only the fields necessary for correlation and output. This minimizes memory and CPU overhead, directly improving search performance and reducing the risk of incomplete results due to resource limits.

Answer

Remove the `maxspan` parameter to allow transactions of any duration.

Answer

Use `mvcombine` to combine multivalued fields before the transaction.

Answer

Increase the `maxevents` value to allow more events per transaction.

Question 2

Which THREE of the following are valid ways to extract a substring from a field named "full_name" that contains "Firstname Lastname" into separate fields?

Accepted Answer

eval first=split(full_name," ")[0], last=split(full_name," ")[1]. The `split` function in Splunk's `eval` command returns a multivalue field from a string based on a delimiter, and array indexing with `[0]` and `[1]` extracts the first and second elements respectively. This directly splits "Firstname Lastname" into two separate fields named `first` and `last`.

Answer

extract field=full_name first=1 last=2

Answer

regex field=full_name "(?[^ ]+) (?[^ ]+)"

Question 3

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

Accepted Answer

The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.. The `search stage="*"` command filters out all transactions because `stage` is a multivalue field created by the `transaction` command. In Splunk, a multivalue field cannot be matched with a simple wildcard search like `stage="*"`; this search only returns events where `stage` is a single literal asterisk. To search for any value in a multivalue field, you must use `mvcount(stage)>0` or `search stage=*` (without quotes).

Answer

The transaction should group by user instead of src.

Answer

The case statement does not set stage for events that don't match either pattern.

Answer

The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.

Question 4

A large CSV lookup file (over 10 million rows) is causing search performance degradation. Which solution best improves performance without sacrificing accuracy?

Accepted Answer

Convert to a KV Store lookup and update the collection as needed. KV Store lookups provide indexed lookups and can be updated without reindexing, improving performance for large, dynamic datasets. Option A is incorrect because increasing max_memory in transforms.conf does not fundamentally improve lookup efficiency for large CSV files. Option B is incorrect because index-time lookups require reindexing and are not suitable for frequently changing data. Option D is incorrect because reducing the CSV file to only the most common keys would lose accuracy for less common lookup keys.

Answer

Increase the max_memory setting in transforms.conf

Answer

Convert to an index-time lookup with automatic re-indexing

Answer

Reduce the CSV file to only the most common lookup keys

Question 5

A saved search is configured to run every hour and generate a summary index. The original search returns data that is then summarized. Which of the following best describes the purpose of summary indexing?

Accepted Answer

To speed up searches by pre-aggregating data into smaller datasets. Summary indexing in Splunk is used to precompute and store aggregated results from a search, which allows subsequent searches to run much faster by querying the smaller summary index rather than the full raw data. Option D correctly describes this purpose. Option A is incorrect because summary indexing does not compress raw data; it creates new, summarized data. Option B is incorrect; summary indexing is not used for real-time alerts—alerts are separate. Option C is incorrect; summary indexing does not normalize data to the CIM; data model acceleration or other features do that.

Answer

To reduce disk space usage by compressing raw data

Answer

To create real-time alerts based on historical data

Answer

To normalize data to the CIM

Question 6

What is the most likely cause of this error?

Accepted Answer

The endpoint "/services/authentication/users" is incorrect; it should be "/services/authentication/users". Actually the correct endpoint is '/services/authentication/users' but the admin might have a typo.. The error message indicates a URL not found, which is typically caused by an incorrect REST endpoint path. Option D correctly identifies that the endpoint '/services/authentication/users' may have a typo in the macro definition. Even if the path appears correct, a subtle typo (such as an extra character or incorrect casing) would cause the REST command to fail with a 'URL not found' error. Options A, B, and C are not related to endpoint path errors.

Answer

The macro does not have read permissions for the administrator's role.

Answer

The macro is missing the '|' pipe in front of the rest command.

Answer

The macro definition should use curly braces {} instead of brackets [].

Question 7

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Lookups can be automatic via props.conf, can be based on CSV or KV Store, and are used to add fields from an external source. They are not limited to exact match (range lookups exist) and do not require data to be indexed in Splunk.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 8

A search returns raw events with a field 'response_time'. The analyst wants to calculate the average response time excluding any outliers that are more than 3 standard deviations from the mean. Which SPL approach is most efficient?

Accepted Answer

Use | eventstats avg, stdev(response_time) then | where response_time<=avg+3*stdev and response_time>=avg-3*stdev then | stats avg(response_time). It uses `eventstats` to compute the global average and standard deviation of `response_time` across all events, then filters out outliers (values more than 3 standard deviations from the mean) with a `where` clause, and finally calculates the clean average with `stats avg(response_time)`. This approach is efficient because `eventstats` adds the aggregate values to each event without reducing the dataset, allowing a single pass through the data for filtering and aggregation.

Answer

Use | top response_time

Answer

Use | stats avg(response_time) and then filter with where

Answer

Use | outlier action=remove

Question 9

A telecom company monitors call detail records (CDR). Each call has a unique call_id, and events are generated at each network node (setup, ringing, answer, hangup) with timestamps. The events are from different sourcetypes (cdr_setup, cdr_ring, etc.) and are indexed in near real-time. The analyst needs to correlate all events for the same call_id to calculate call duration. The current search is: `index=telecom sourcetype=cdr_* | transaction call_id maxspan=2h`. This search works but sometimes produces huge transactions (100+ events) due to noisy data, causing memory errors. The analyst has identified that each call should have exactly 4 events: setup, ringing, answer, hangup. Which approach would best correlation with minimal resource usage?

Accepted Answer

Use `transaction call_id maxevents=4 maxspan=2h` to limit to exactly 4 events.. `maxevents=4` directly limits the transaction to exactly four events per call_id, preventing memory errors from noisy data while ensuring each transaction contains the expected setup, ringing, answer, and hangup events. This constraint is applied during the transaction command itself, reducing resource usage by discarding oversized groups immediately rather than post-processing.

Answer

Use `transaction call_id maxspan=2h` and then filter using `where mvcount(_raw) = 4`.

Answer

Use `eventstats count by call_id` and then filter.

Answer

Use `search` with `call_id=*` and then use `streamstats` to calculate duration per call.

Question 10

An analyst notices that a timechart command with 'by host' shows only 10 hosts even though there are 50 distinct hosts. What could be the reason?

Accepted Answer

The 'limit' parameter is set to 10 by default.. By default, the `timechart` command sets the `limit` parameter to 10, which limits the number of series (columns) displayed to the top 10 by count. Even though there are 50 distinct hosts, only the top 10 will appear. Option A is incorrect because the visualization type (Pie) does not change the number of series shown by `timechart`; the limit is set in the `timechart` command itself. Option B is incorrect because `join` is not related to limiting the number of hosts. Option C is incorrect because the `useother` parameter, when set to `false`, suppresses the 'OTHER' series but does not change how many top series are shown — that is still controlled by `limit` (default 10). The default for `useother` is `true`, so the absence of an 'OTHER' series alone might suggest a non‑default setting, but the underlying reason only 10 hosts appear is the `limit` value.

Answer

The visualization is set to 'Pie' which only shows top 10.

Answer

The search is using 'join' to combine data.

Answer

The 'useother' parameter is set to false.

Question 11

Which THREE are valid uses of macros in Splunk? (Choose three.)

Accepted Answer

Enforce security by hiding sensitive parts of the search from users.. Options B, D, and E are correct. Macros can encapsulate complex SPL, accept arguments, and be used to enforce security policies by restricting access to parts of searches. Option A is incorrect because while macros can accept arguments to change the index, dynamically switching indexes is not a recommended use and is discouraged due to performance implications; it is not considered a primary valid use of macros. Option C is incorrect because macros are not designed to modify search results; they generate SPL that runs against events, not post-processing results.

Answer

Dynamically switch between different indexes at search time based on user input.

Answer

Modify the results of a search after the search completes (post-processing).

Question 12

Which THREE factors should be considered when deciding between using a lookup table and a KV store for enriching data?

Accepted Answer

KV store collections can be updated in real-time via REST API.. The correct factors are B, C, and D. B is correct because KV stores can be updated in real-time via REST API, while lookup tables are typically static files. C is correct because KV store collections can be used with the 'kv' command for search-time operations, whereas lookup tables use 'inputlookup' or 'lookup'. D is correct because lookup tables can support time-based lookups using time fields, which is a feature not available in KV stores. A is incorrect because 'inputlookup' is for file-based lookups, not KV stores; KV store collections are typically accessed with the 'kv' command. E is incorrect because KV stores are generally faster and more scalable for large datasets due to their database-backed storage and indexing, while CSV lookup files can become slow when dealing with very large data sets.

Answer

KV store collections can be used with the 'inputlookup' command.

Answer

Lookup tables are faster for large datasets.

Question 13

A search uses 'transaction' to group events by session, but the results show too many transactions with only one event. What is the best way to filter out single-event transactions?

Accepted Answer

| transaction ... | where eventcount > 1. The `transaction` command groups events into transactions, and appending `| where eventcount > 1` filters out any transaction that consists of only a single event. This directly addresses the requirement to remove single-event transactions, as `eventcount` is a default field added by `transaction` that counts the number of events in each transaction.

Answer

Add maxspan=5m to the transaction command

Answer

| transaction maxevents=2 ...

Answer

| transaction ... | where eventcount=2

Question 14

When using the stats command with multiple BY fields, the results show many rows with null values. What is the most likely cause and how can it be reduced?

Accepted Answer

Use | stats ... by ... usenull=f. The `stats` command includes null values in BY fields by default, which can produce many rows with nulls. Using `usenull=f` explicitly tells `stats` to ignore null values in the BY clause, reducing those rows. This parameter is specific to the `stats` command and directly addresses the root cause.

Answer

Use | where command to filter out null values

Answer

Use | eval to replace nulls before stats

Answer

Use | fillnull value=0 outputfield=count after stats

Question 15

Which THREE of the following are correct characteristics of the transaction command? (Choose three.)

Accepted Answer

It groups related events based on common field values.. The transaction command groups related events that share common field values, such as a session ID or user ID, to form a single transaction. This is a core function of the command, allowing you to correlate events across a dataset based on matching field content.

Answer

It can group events from different indexes.

Answer

By default, it retains all original fields from all events in the transaction.