SPLK-1002 Practice Test 25 — 15 Questions

Question 1

A user needs a report showing the number of distinct source IPs per sourcetype over the last hour. They run: `index=* earliest=-1h | stats dc(src_ip) by sourcetype`. The search runs slowly (2 minutes) and they want to speed it up. Which optimization is most effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use `| tstats dc(src_ip) where index=* earliest=-1h by sourcetype`.. tstats reads from the tsidx files (index time summaries) which is much faster than scanning raw data. Option A uses `top` which returns top sourcetypes by count, not distinct IPs. Option B uses nested stats which still processes all raw events. Option C uses chart which also scans raw data and produces a table that does not directly give distinct IPs per sourcetype. Option D correctly uses tstats with dc(src_ip) to get distinct counts by sourcetype, leveraging accelerated data structures.

Answer

Use `| top limit=100 sourcetype` to get top sourcetypes.

Answer

Use `| stats count by sourcetype, src_ip | stats count by sourcetype`.

Answer

Use `| chart count over sourcetype by src_ip`.

Question 2

A user needs to find events where a user had a failed login followed by a successful login within 10 minutes, and then list the total number of such occurrences per user. Which THREE steps are necessary? (Select three.)

Accepted Answer

Use the stats command to count by user. To find events where a failed login is followed by a successful login within 10 minutes, and count such occurrences per user, the necessary steps are: use the transaction command with maxspan=10m to group events in a 10-minute window (D), use startswith and endswith to define the transaction boundaries (e.g., startswith='failed login' and endswith='successful login') (E), and then use stats count by user to tally the number of completed transactions per user (B). Options A and C are incorrect because inline eval is not needed to mark failure status, and using where after transaction would filter transactions but the counting is done by stats; also, using where alone without transaction would not capture the paired events.

Answer

Use the eval command to set a field for failure status

Answer

Use the where command to filter transactions with both failure and success

Question 3

A dashboard developer wants to color-code the bars in a column chart based on a severity field (critical=red, high=orange, medium=yellow, low=green). How can this be achieved?

Accepted Answer

Use the chart command with 'useColors=true' and specify a color palette or use Eval to create a color field. In Splunk, to color-code a chart based on a field like severity, you can use the `eval` command to create a color field that maps severity values to color names (e.g., `| eval color=case(severity="critical","red", severity="high","orange", ...)`), and then use that field in the chart's visualization options for color. The `chart` command itself does not have a `useColors=true` parameter; the phrase refers to a conceptual use of color palettes or visualization settings. Option A is incorrect because drilldown is for navigation, not coloring. Option C is incorrect because the `overlay` option overlays a second chart, not for color coding. Option D is incorrect because CSS is not the standard method for dynamic field-based coloring in Simple XML dashboards.

Answer

Configure drilldown to change colors when clicked

Answer

Use the 'overlay' option in the chart command

Answer

Add CSS styling to the Simple XML dashboard

Question 4

Which THREE of the following are valid ways to count the number of events per minute for a given sourcetype?

Accepted Answer

index=main sourcetype=web | eval minute = strftime(_time, "%Y-%m-%d %H:%M") | stats count by minute. Options C, D, and E correctly count events per minute. C uses eval to create a full timestamp string (year-month-day hour:minute) and then stats count by that string groups events by each minute. D uses bucket _time span=1m to create 1-minute time buckets, then stats count by _time gives per-minute event counts. E uses timechart count span=1m, which automatically bins events into 1-minute intervals and displays the count. Option A is incorrect because date_minute only extracts the minute portion (0-59), so it groups events from different hours and days together, not per-minute across the full timeline. Option B is incorrect because streamstats count window=1m calculates a running count over the last minute, not a per-minute event count.

Answer

index=main sourcetype=web | stats count by date_minute

Answer

index=main sourcetype=web | streamstats count window=1m | where count>0

Question 5

An analyst runs `transaction user_id` to correlate events from a web server. The resulting transaction events have a field 'duration' that shows the time between the first and last event. However, some transactions span over 30 minutes. What transaction option should be added to limit the maximum time between the first and last event?

Accepted Answer

maxspan=30m. The maxspan option sets the maximum time span from the first event to the last event in a transaction.

Answer

maxpause=30m

Answer

maxevents=30

Answer

contime=30m

Question 6

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

Accepted Answer

Remove endswith and add maxspan=30m. To include incomplete sessions without an 'session_end' event, remove the `endswith` clause and add a `maxspan` time limit. This ensures that transactions are automatically closed after the specified time (30 minutes) if no end event is encountered. The `startswith` clause remains to initiate transactions only on 'session_start' events. Option B correctly implements this: `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m`. This way, sessions that timeout are still captured as transactions.

Answer

Add `maxspan=30m` and keep endswith

Answer

Change startswith to `action=session_start OR action=session_end`

Answer

Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith

Question 7

An administrator defines a macro that calls another macro. Both macros are defined in the same app. The first macro works correctly, but when executed, it triggers an error: 'Recursive macro call detected'. What is the most likely cause?

Accepted Answer

The second macro calls the first macro, creating a circular reference.. Splunk detects and prevents recursive macro calls (a macro that directly or indirectly calls itself). The error indicates that the two macros form a circular reference. Option B is correct. Option A (argument mismatch) would give a different error. Option C (permissions) is not relevant. Option D (syntax error) would also give a different error.

Answer

The second macro is not shared to the global context.

Answer

The first macro has a syntax error that only appears when combined.

Answer

The first macro passes incorrect arguments to the second macro.

Question 8

Which TWO of the following commands are useful for reducing the number of events before a `stats` command to improve performance? (Choose 2)

Accepted Answer

head. The `head` command limits the number of events processed by returning only the first N events from the search results. By reducing the event volume early in the pipeline, it significantly decreases the workload on the subsequent `stats` command, improving performance when only a sample or the most recent events are needed.

Answer

transaction

Answer

sort

Answer

eval

Question 9

A large e-commerce company uses Splunk to monitor its web application performance. The application logs every HTTP request with fields: `transaction_id`, `url`, `response_time_ms`, `status`. Currently, the team uses the following search to identify slow page loads:

`index=web sourcetype=access_combined | transaction transaction_id maxspan=60s | eval total_time = sum(response_time_ms) | where total_time > 5000`

However, the search returns no results even though there are known slow pages. The team verified that logs contain `transaction_id` values and that some pages take over 10 seconds. What is the most likely reason the search fails to identify slow pages?

Accepted Answer

The `eval total_time = sum(response_time_ms)` is incorrect because after `transaction`, `response_time_ms` is a multivalue field, and `sum()` does not automatically calculate the sum of multivalue fields.. After the `transaction` command, `response_time_ms` becomes a multivalue field containing all the individual response times from the events in the transaction. The `sum()` function in `eval` does not automatically aggregate multivalue fields; it requires explicit use of the `mvsum()` function or a `stats sum()` approach. Without this, `total_time` is not calculated correctly, so the `where` clause never matches, returning no results despite slow pages existing.

Answer

The `maxspan=60s` is too short; some page loads may take longer than 60 seconds, causing incomplete transactions.

Answer

The `transaction` command is grouping by `transaction_id`, but the events might have different transaction_id values for the same page load.

Answer

The field name is misspelled; it should be `response_time` not `response_time_ms`.

Question 10

A Splunk administrator is creating a dashboard to visualize real-time network traffic data. The dashboard must include a lookup to enrich source IPs with location data. The lookup file contains 500,000 entries and is updated hourly. Which TWO optimization techniques should the administrator apply to ensure dashboard performance?

Accepted Answer

Use a KV store lookup instead of a CSV lookup.. KV Store lookups are optimized for large, frequently updated datasets (like 500,000 entries updated hourly) by storing data in-memory and supporting indexed lookups, which significantly reduces search-time overhead compared to CSV lookups that require file parsing and scanning. This makes KV Store ideal for real-time dashboards where low latency is critical.

Answer

Use the append command instead of lookup to add fields.

Answer

Set the lookup to batch_index_query=true in transforms.conf.

Answer

Use a subsearch to filter the lookup file before joining.

Question 11

An analyst wants to create a time series chart showing the count of errors per hour over the last 24 hours. The errors are logged with sourcetype=error_log. Which search achieves this?

Accepted Answer

index=main sourcetype=error_log | timechart count span=1h. `timechart count span=1h` automatically creates a time series chart with one-hour buckets over the last 24 hours, grouping events by `_time` and counting them per bucket. The `timechart` command is specifically designed for time-based aggregation and produces a chart with `_time` on the x-axis, which is exactly what the analyst needs. Options A and C incorrectly use the `chart` command which treats time as a categorical field, and Option B uses `bin` and `stats` but does not produce a time series chart directly; it only produces a table. Only `timechart` yields the desired visualization.

Answer

index=main sourcetype=error_log | chart count over _time by hour

Answer

index=main sourcetype=error_log | bin _time span=1h | stats count by _time

Answer

index=main sourcetype=error_log | chart count by _time

Question 12

A transaction is created using the command: 'index=web status=200 OR status=404 | transaction sessionid'. The user wants to include transactions only if they contain both a 200 and a 404 status. Which additional step achieves this?

Accepted Answer

| where mvcount(mvdedup(status))>=2. `| where mvcount(mvdedup(status))>=2`. After the initial `transaction` command, each event in a transaction has a multivalue field `status` containing the status codes from all events in that transaction. The goal is to include only transactions that have both a 200 and a 404 status. Using `mvdedup(status)` removes duplicate status values, then `mvcount()` counts the distinct values. If the count is >=2, it means both statuses are present. Option A uses `keepevicted=true` which is irrelevant; option C is just a search that doesn't filter by transaction; option D counts all occurrences (including duplicates), which could be 2 even if only one status appears twice.

Answer

| transaction sessionid keepevicted=true | where mvcount(status)>=2

Answer

| search status="200" OR status="404"

Answer

| where mvcount(status)==2

Question 13

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 14

Which THREE of the following are valid Splunk search commands for determining the number of distinct values of a field?

Accepted Answer

| stats dc(field). `| stats dc(field)` uses the `dc` (distinct count) function to return the exact number of unique values for the specified field. This is the direct and most efficient command for counting distinct values in Splunk.

Answer

| stats count(field)

Answer

| stats distinct_count(field)

Question 15

Which TWO of the following are best practices when creating lookup table files?

Accepted Answer

Ensure the lookup file is in CSV format with the .csv extension.. Options B and D are correct best practices when creating lookup table files. B is correct because lookup files should be in CSV format with a .csv extension for proper parsing. D is correct because placing the lookup file in the $SPLUNK_HOME/etc/apps/search/lookups directory ensures it is accessible within the app. A is incorrect because header rows with spaces in field names can cause issues; use underscores instead. C is incorrect because automatic lookup refresh is not a best practice for the creation of lookup files; it is configured separately and not related to file creation. E is incorrect because using full paths in the lookup definition is not recommended; relative paths within the app directory are preferred.

Answer

Use header rows with spaces in field names for readability.

Answer

Enable automatic lookup refresh for frequently updated files.

Answer

Use full paths in the lookup definition.