SPLK-1002 Practice Test 24 — 15 Questions

Question 1

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The lookup definition name does not match the filename.. The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Answer

The engineer lacks permissions to read the lookup.

Answer

The lookup file is not in the correct directory.

Answer

The lookup file has a .csv extension but contains other data.

Question 2

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. The CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 3

A security analyst is investigating a potential breach. They have a search that uses the transaction command to group events by session_id and calculates the total bytes transferred per session. However, the search takes over 30 minutes to complete on a 24-hour time range. The environment has 10 indexers with default settings. The analyst needs to reduce search time while preserving the ability to group by session_id. Which course of action should they take?

Accepted Answer

Pre-aggregate events by session_id using 'stats values(*) as * sum(bytes) as total_bytes by session_id' before the transaction command.. Pre-aggregating events by session_id using stats with values(*) and sum(bytes) before the transaction command reduces the number of events the transaction command must process. The transaction command is resource-intensive as it correlates events across time; fewer input events significantly decrease execution time. The stats command runs in parallel across indexers, maintaining distributed processing. Other options: B adds overhead via subsearch, C (streamstats) does not group events like transaction, and D forces single-indexer processing, slowing performance.

Answer

Use an append command to add a subsearch that pre-filters events.

Answer

Replace transaction with the 'streamstats' command to compute running totals.

Answer

Add the 'local' keyword to the transaction command to force it to run on a single indexer.

Question 4

A search includes a subsearch that returns 100,000 results, causing performance issues. Which optimization is best?

Accepted Answer

Use limit in the subsearch to return fewer results. Using the `limit` command in a subsearch restricts the number of results returned to the primary search, directly reducing the data volume that must be processed and joined. This is the most effective optimization when a subsearch returns a large result set (e.g., 100,000 events), as it minimizes memory and CPU overhead in the search head.

Answer

Use the fields command inside the subsearch

Answer

Use the format command inside the subsearch

Answer

Use the search command with index=* inside the subsearch

Question 5

In a Splunk environment, an analyst is using the transaction command to group events from different sources. Which THREE factors are most important to consider when designing the transaction search for optimal performance? (Choose three.)

Accepted Answer

Apply efficient search-time field extractions to avoid using the transaction command across unindexed fields.. Options C, D, and E are correct. Efficient search-time field extractions (C) reduce the overhead of the transaction command by avoiding unindexed field lookups. Limiting the time range with maxspan (D) narrows the search window, reducing the number of events to process. Using fields with low cardinality for grouping (E) minimizes the number of open transactions and memory usage. Option A (mvlist) is not a standard transaction option and does not improve performance; Option B (large maxevents) can degrade performance by consuming excessive memory.

Answer

Use the 'mvlist' option to store multiple values.

Answer

Use a large maxevents value to ensure all events are captured.

Question 6

Consider the following search: 'index=web | transaction sessionid maxspan=30m | where eventcount > 5 | stats avg(duration)'. An analyst notices that the search takes a long time and uses excessive memory. Which change would most likely improve performance?

Accepted Answer

Use the stats command with values(sessionid) instead of transaction.. Using the stats command with values(sessionid) replaces the resource-intensive transaction command. The transaction command buffers all events belonging to the same session within the maxspan window, consuming memory and CPU. The stats command processes events in a more efficient streaming manner, reducing resource usage. Moreover, by using stats, the search can directly aggregate events by sessionid without requiring a maxspan window or a subsequent where clause, thereby improving performance.

Answer

Change maxspan to 1h to allow more events.

Answer

Remove the where clause and use stats after transaction.

Answer

Add a filter before transaction to reduce events.

Question 7

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

Accepted Answer

Replace transaction with streamstats to create a session ID, then use stats to aggregate. The transaction command is memory-intensive, especially with a large dataset (10 million events per hour) and generous limits (maxspan=1h, maxpause=30m). To improve performance, a more efficient approach is to use streamstats to generate a session ID based on a timeout (e.g., using the time difference between events) and then use stats to group by that ID. This avoids holding all events in memory and processes events in a streaming manner. Option A correctly suggests this method. Option B (maxevents=100) still uses transaction and may truncate valid sessions. Option C reduces limits but may miss legitimate sessions and still uses transaction. Option D increases search job concurrency but does not address the underlying memory issue.

Answer

Add `maxevents=100` to limit events per transaction

Answer

Reduce maxspan to 15m and maxpause to 5m

Answer

Increase the search job concurrency

Question 8

Which THREE of the following are valid use cases for the `transaction` command in Splunk?

Accepted Answer

Identifying a sequence of events that indicate a brute-force attack (multiple failed logins followed by a success).. The `transaction` command groups related events into a single transaction based on common fields and temporal constraints. In this case, it can group multiple failed login events followed by a successful login for the same user, which is a classic indicator of a brute-force attack. The command allows you to set `maxspan` and `maxpause` to define the time window and gap between events, making it ideal for detecting such sequences.

Answer

Generating an alert when a transaction contains more than five events.

Answer

Enriching events with external data from a CSV file based on a common key.

Question 9

A Splunk search uses a subsearch to find the top 10 client IPs and then retrieve all events from those IPs. The subsearch is:

`index=web sourcetype=access | search [ top clientip | fields clientip ]`

What does this search return?

Accepted Answer

All events from the top 10 most common client IPs.. The subsearch `[ top clientip | fields clientip ]` returns the top 10 most common client IPs as a list of values. The outer search then uses this list as a filter, effectively running `index=web sourcetype=access clientip= OR clientip= ...`. This retrieves all events from those IPs, not just the top 10 events. Option D correctly describes this behavior.

Answer

The top 10 client IPs in a table.

Answer

Only the top 10 events based on some field.

Answer

All events where the client IP appears more than once.

Question 10

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

Accepted Answer

`stats avg($field$) as avg_response`. In Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro. Option C is wrong because although it uses valid syntax with `$field$`, it creates a dynamic alias (`avg_$field$`) which is not appropriate for a macro that needs to return a fixed field name for the average. The requirement is to return the average, so a static alias like `avg_response` is correct.

Answer

`stats avg($field$) | eval avg_response=$result$`

Answer

"stats avg($field$) as avg_response"

Answer

`stats avg($field$) as avg_$field$`

Question 11

An analyst wants to see the count of distinct users for each department over the last week. The data contains fields: user, department, date. Which search is correct?

Accepted Answer

... | stats dc(user) by department. The `dc()` function in Splunk's `stats` command calculates the distinct count of values in a field, which is exactly what the analyst needs: the count of distinct users per department over the last week. The `by department` clause groups the results by department, and the implicit time range (last week) is applied via the search time picker or an explicit time filter in the query.

Answer

... | stats distinct_count(user) by department

Answer

... | eval distinct_count=dc(user) | stats sum(distinct_count) by department

Answer

... | stats count(user) by department

Question 12

A user reports that a macro named `my_macro` is not working in a search. The macro is defined with no arguments and uses a simple search string. What is the most likely issue?

Accepted Answer

The macro permissions are not shared to the user's role.. Macros are by default only editable by the creator, and permissions must be set to allow other roles to use them. A misspelling would cause an error message, not silent failure. Wrong arguments would cause an error if used with arguments. A subsearch failure would also produce an error.

Answer

The macro is defined with wrong arguments.

Answer

The macro name is misspelled in the search.

Answer

The macro contains a subsearch that fails.

Question 13

A security analyst needs to correlate login events with subsequent actions from the same user within 30 minutes. They need to ensure that only one login per user session is considered, and actions after login are attached. Which command is most appropriate?

Accepted Answer

transaction user maxspan=30m. The 'transaction' command (Option B) groups events based on a common field (user) within a time constraint (maxspan=30m). It groups all events from the same user within 30 minutes into a single transaction, ensuring one login per session and attaching subsequent actions. Options A, C, and D do not properly group events for this correlation. Option A uses 'stats values(user) by _time' which does not group by user properly; Option C uses 'append' which is inefficient; Option D uses 'join' which is also inefficient for this purpose.

Answer

stats values(user) by _time

Answer

append [search action] | sort user _time

Answer

join user [search login] | timechart

Question 14

Which THREE of the following are best practices when using lookups in Splunk?

Accepted Answer

Use the lookup command instead of inputlookup when possible to reduce memory usage. Using the `lookup` command with the `local=t` argument (or when the lookup table is small enough to be loaded into memory) can reduce memory usage compared to `inputlookup`, which always loads the entire lookup file into memory. The `lookup` command can stream results and only loads necessary fields, making it more efficient for large datasets. This is a best practice to avoid out-of-memory errors in distributed search environments.

Answer

Store lookup tables in KV Store when the table has more than 1 million rows

Answer

Always use KV Store lookups for faster performance compared to CSV lookups

Question 15

A Splunk admin created a macro named `filter_by_region` that takes one argument: the region code. The macro definition is: `index=main sourcetype=web region=$region$`. When a user runs the search `| `filter_by_region US`` they get no results, but when they replace the macro with the actual string `index=main sourcetype=web region=US`, they get results. What is the problem?

Accepted Answer

The macro definition does not specify an argument list.. The macro definition does not include an argument list, so `$region$` is treated as literal text. The correct definition should be `filter_by_region(region)` in the definition name. Double dollar signs are correct for variable expansion. Quotation marks are not an issue here. Permissions would cause an error message.

Answer

The macro argument is not passed correctly because of quotation marks.

Answer

The user does not have execute permissions for the macro.

Answer

The macro uses double dollar signs incorrectly; it should be `$region$`.