SPLK-1003 Practice Test 1 — 25 Questions

Question 1

A telecom company monitors call detail records (CDR). Each call has a unique call_id, and events are generated at each network node (setup, ringing, answer, hangup) with timestamps. The events are from different sourcetypes (cdr_setup, cdr_ring, etc.) and are indexed in near real-time. The analyst needs to correlate all events for the same call_id to calculate call duration. The current search is: `index=telecom sourcetype=cdr_* | transaction call_id maxspan=2h`. This search works but sometimes produces huge transactions (100+ events) due to noisy data, causing memory errors. The analyst has identified that each call should have exactly 4 events: setup, ringing, answer, hangup. Which approach would best correlation with minimal resource usage?

Accepted Answer

Use `transaction call_id maxevents=4 maxspan=2h` to limit to exactly 4 events.. Option A is correct because `maxevents=4` directly limits the transaction to exactly four events per call_id, preventing memory errors from noisy data while ensuring each transaction contains the expected setup, ringing, answer, and hangup events. This constraint is applied during the transaction command itself, reducing resource usage by discarding oversized groups immediately rather than post-processing.

Answer

Use `transaction call_id maxspan=2h` and then filter using `where mvcount(_raw) = 4`.

Answer

Use `eventstats count by call_id` and then filter.

Answer

Use `search` with `call_id=*` and then use `streamstats` to calculate duration per call.

Question 2

Which TWO statements correctly describe the behavior of the transaction command in Splunk?

Accepted Answer

It can concatenate the raw text of all events in the transaction into a single event.. Option C is correct because the transaction command can be configured with the `mvraw` option to concatenate the raw text of all events in the transaction into a single event. This is useful when you need to preserve the full log lines of a correlated sequence, such as a multi-step user session or a series of API calls.

Answer

It is not recommended for use with large datasets because it consumes too much memory.

Answer

It merges all fields from all events into a single event, with the last event's field value taking precedence.

Answer

It automatically calculates the duration of each transaction as the difference between the first and last event timestamps.

Question 3

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Accepted Answer

It improves the ability to correlate events from different technologies.. Option A is correct because the Common Information Model (CIM) provides a standardized set of field names and event tags across different data sources, enabling correlation of events from disparate technologies (e.g., firewalls, IDS, endpoints) using common fields like 'dest_ip', 'src_ip', 'user', and 'action'. This normalization allows Splunk to join or relate events that share the same CIM-compliant fields, making it possible to build coherent security or operational stories across heterogeneous data.

Answer

It improves search performance by pre-aggregating data.

Answer

It provides built-in security monitoring use cases.

Answer

It eliminates the need for custom field extractions.

Question 4

Arrange the steps to create a new index in Splunk in the correct order.

Accepted Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Enter index name and configure settings. Step 4: Click Save.. Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Answer

Step 1: Click New Index. Step 2: Navigate to Settings > Indexes. Step 3: Enter index name and configure settings. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Enter index name and configure settings. Step 3: Click New Index. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Click Save. Step 4: Enter index name and configure settings.

Question 5

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. Option A is correct because it uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 6

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 7

An analyst wants to find the top 5 users who have the highest total bytes transferred. The data has fields 'user' and 'bytes'. Which search should be used?

Accepted Answer

| stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5. Option B is correct because it uses `stats sum(bytes) as total_bytes by user` to aggregate the total bytes transferred per user, then sorts the results in descending order with `sort - total_bytes`, and finally limits the output to the top 5 users with `head 5`. This directly answers the requirement for the highest total bytes transferred.

Answer

| stats max(bytes) as max_bytes by user | sort - max_bytes | head 5

Answer

| sort - bytes | head 5 | table user, bytes

Answer

| top limit=5 user

Question 8

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. Option B is correct because a data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 9

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. Option D is correct because the CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 10

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

Accepted Answer

The lookup definition name does not match the filename.. The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Answer

The engineer lacks permissions to read the lookup.

Answer

The lookup file is not in the correct directory.

Answer

The lookup file has a .csv extension but contains other data.

Question 11

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. Option A is correct because the `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 12

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 13

Which TWO are valid methods to join data from a CSV file in a Splunk search?

Accepted Answer

`| lookup myfile.csv`. Option C is correct because the `| lookup` command can reference a CSV file defined as a lookup table in Splunk, allowing field-based enrichment of search results. This is a standard method for joining data from a CSV file within a search, provided the lookup is properly configured in transforms.conf and props.conf.

Answer

`| append myfile.csv`

Answer

`| join myfile.csv`

Answer

`| csvlookup myfile.csv`

Question 14

A dashboard developer wants to create a single-value visualization that shows the current server status from a lookup table. Which Splunk command should be used to retrieve the lookup data in a real-time context?

Accepted Answer

lookup. Option C is correct because the `lookup` command retrieves field values from a lookup table and can be used in a real-time context to enrich events or display current status. Unlike `inputlookup`, which loads the entire lookup table as events, `lookup` works within the search pipeline, allowing it to match against live data and return the most recent lookup values for a single-value visualization.

Answer

inputlookup

Answer

outputlookup

Answer

geostats

Question 15

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 16

Which THREE of the following are best practices when using lookups in Splunk?

Accepted Answer

Use the lookup command instead of inputlookup when possible to reduce memory usage. Option A is correct because using the `lookup` command with the `local=t` argument (or when the lookup table is small enough to be loaded into memory) can reduce memory usage compared to `inputlookup`, which always loads the entire lookup file into memory. The `lookup` command can stream results and only loads necessary fields, making it more efficient for large datasets. This is a best practice to avoid out-of-memory errors in distributed search environments.

Answer

Store lookup tables in KV Store when the table has more than 1 million rows

Answer

Always use KV Store lookups for faster performance compared to CSV lookups

Question 17

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. Option B is correct because it uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10

Question 18

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

Accepted Answer

Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.. Option C is correct because the `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Answer

Increase maxspan to allow more events to complete.

Answer

Use the 'mvlist' option to list all user_uuid values.

Answer

Add 'closed_txn=1' to the transaction command to only output complete transactions.

Question 19

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Option B is correct because using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 20

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. Option B is correct because `transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`