SPLK-1002 Practice Test 2 — 25 Questions

Question 1

Arrange the steps to configure a lookup table file in Splunk.

Accepted Answer

Upload the lookup file to Splunk via Settings > Lookups > Lookup table files > New, then define the lookup table file by specifying the filename and options.. Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Answer

Define the lookup table file first via Settings > Lookups > Lookup table files, then upload the file.

Answer

Create a lookup definition first via Settings > Lookups > Lookup definitions, then upload the file, then define the lookup table file.

Answer

Upload the file to a custom directory, then create a lookup definition without defining the lookup table file.

Question 2

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Accepted Answer

The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.. Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Answer

The lookup file is not distributed to all indexers.

Answer

The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

Answer

The max_matches should be set to 0.

Answer

The lookup definition is missing the default_match setting, which should be set to 'no_match'.

Question 3

An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?

Accepted Answer

Splits the count by the 'method' field into separate series.. The `timechart` command with a `by` clause splits the count into separate series for each distinct value of the 'method' field, creating one line per method on the chart. Option A is incorrect because the time range is determined by the search, not necessarily per day. Option B is incorrect because the default span depends on the time range (e.g., less than 24 hours uses 1-minute bins, etc.). Option C is incorrect because `timechart` does not limit to top 10 by default.

Answer

Calculates the total count per day for each method.

Answer

Bins events into 1-hour intervals by default.

Answer

Shows only the top 10 methods.

Question 4

Which TWO of the following are valid ways to correlate events without using the transaction command?

Accepted Answer

Using eventstats to compute counts per transactionID. Options D and E are correct. Using stats ... by transactionID groups events by a common field and computes aggregate values, effectively correlating events. Using eventstats to compute counts per transactionID adds a calculated aggregate to each event, correlating events with the same transactionID. Both are valid correlation methods without using the transaction command. Options A and B (append and join) combine results from separate searches but do not correlate events in the same sense, and sort (C) merely orders events.

Answer

Using append to combine events from two searches

Answer

Using join to merge events on transactionID

Answer

Using sort to order events by transactionID

Question 5

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. The `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`

Question 6

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 7

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. The correct method is to define a macro with arguments using backticks and $arg$ syntax (Option C). Macros are designed for reusable search components that can accept parameters. Option A (saved search with tokens) is typically used in dashboards to pass values at runtime, not for creating reusable search fragments. Option B (eval statement) defines a variable but does not create a reusable search component. Option D (lookup definition) is used for enriching events with external data, not for defining search logic.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 8

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. The correct macro definition is option B because it uses a positional argument ($1$) and does not include a leading pipe. In Splunk, macros are invoked as part of a pipe chain, so the definition should not start with a pipe. Positional arguments are standard and do not require predefined argument names, whereas named arguments must be defined in the macro properties. Option A fails because it uses a named argument ($field$) without defining it, making it invalid. Options C and D incorrectly include a leading pipe at the start of the definition, which would cause a syntax error when the macro is expanded within a pipe.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 9

Which THREE are components of the Common Information Model (CIM) in Splunk?

Accepted Answer

Tags. The three components of the Common Information Model (CIM) in Splunk are Tags (A), Data Models (B), and Field Extractions (D). Tags are used to define the CIM data model's data source types and event types. Data Models provide the framework for the CIM, defining normalized fields and relationships. Field extractions are necessary to map raw data to the CIM fields. Lookup tables (C) and dashboards (E) are not part of the CIM; they may be used in conjunction with CIM but are not core components.

Answer

Lookup tables

Answer

Dashboards

Question 10

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Accepted Answer

Provides a consistent field naming convention across different data sources.. The Splunk Common Information Model (CIM) provides two key benefits: (A) It normalizes data from different sources into a consistent field naming convention, making it easier to search across diverse data sources. (E) It supports data model acceleration, which speeds up searches using the tstats command on CIM-compliant data models. Option B is incorrect because real-time correlation is not a direct feature of CIM; CIM standardizes fields but does not perform correlation. Option C is incorrect because CIM does not reduce indexing volume; indexing is independent of CIM. Option D is incorrect because CIM does not define sourcetypes; sourcetypes are defined at input time.

Answer

Enables real-time correlation of events across multiple data sources.

Answer

Reduces indexing volume by summarizing data into CIM-compliant indexes.

Answer

Defines the sourcetypes for common technologies (e.g., firewall, IDS).

Question 11

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

Accepted Answer

timechart span=5min count. The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Answer

chart count over _time span=5min

Answer

stats count by _time span=5min

Answer

streamstats count span=5min

Question 12

A data engineer has defined a CIM data model for 'Network_Traffic'. They have also created field aliases using `| fieldaliases` to map custom fields like `src_ip` and `dest_ip` to the CIM fields. When running searches against the data model, some events do not appear. The engineer verified that the tags are correctly applied. What is the most likely remaining issue?

Accepted Answer

The field aliases must be defined within the data model itself, not via `| fieldaliases`.. Field aliases defined using the `| fieldaliases` command are applied at search time but are not recognized by data model acceleration. Data models use their own field definitions and aliases must be defined within the data model itself (via the data model editor) to be included in accelerated searches. Option B is incorrect because the time range would affect all events equally and does not explain why some events are missing specifically due to field mapping. Option C is incorrect because custom fields do not need to be indexed; they can be extracted at search time, but the issue is that the aliases are not applied within the data model. Option D is incorrect because tags are correctly applied as verified, so the problem is not tag application.

Answer

The data model search is using a time range that excludes the events.

Answer

The custom fields are not indexed, so they cannot be used in data models.

Answer

The tags are applied only to a subset of events.

Question 13

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

Accepted Answer

Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.. Creating a summary index that pre-aggregates error counts by severity every 5 minutes reduces the amount of data scanned in real-time, improving performance without changing the dashboard's output. Option A is wrong because using 'bucket' and 'stats' with streaming commands still requires scanning all raw events; it does not precompute results and may not significantly reduce I/O. Option C is wrong because limiting the time range alters the dashboard's displayed data (e.g., less historical context), which violates the requirement to keep the output unchanged. Option D is wrong because search acceleration (e.g., data model acceleration) creates summaries for specific data models, not arbitrary field aggregations; it may not target the 'severity' breakdown efficiently and can consume significant resources.

Answer

Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

Answer

Limit the time range to the last 1 hour instead of 24 hours.

Answer

Enable search acceleration for the index.

Question 14

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 15

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.

Question 16

You are a Splunk administrator at a large e-commerce company with over 5,000 employees and millions of customers. The development team has created a dashboard that displays sales data by region, using a lookup table to map customer IDs to region names. The lookup file, 'customer_region.csv', is stored on the search head. Recently, the lookup table was updated with new customer IDs, but the dashboard continues to show old region names for new customers. You have verified that the lookup file contains the new mappings and that the file is correctly formatted. The dashboard uses the 'lookup' command in its base search. You have also confirmed that the lookup definition in transforms.conf points to the correct file. The lookup file is approximately 100 MB and is updated weekly. The dashboard is accessed by multiple users across the organization. The issue only affects new customers added in the latest update. Old customers still show correct regions. You have checked the file size and timestamp, and the new file is present. The Splunk version is 8.2. The search head is not clustered. No errors are appearing in the splunkd.log related to lookups. The dashboard uses a simple XML with a timechart and a lookup. The search string is: index=sales sourcetype=transactions | lookup customer_region.csv customer_id OUTPUT region | timechart count by region. You have also tried restarting the search head, but the issue persists. What is the most likely cause?

Accepted Answer

The search head is using a cached version of the lookup, and you need to clear the lookups cache.. Splunk caches lookup files on the search head to improve performance. When the lookup file is updated externally, the cache may still serve the old version until it is explicitly cleared or the search head is restarted. In this scenario, the file is correctly formatted and the definition points to the correct file, but the cache still holds the previous version. Clearing the lookup cache forces Splunk to reload the file from disk, resolving the issue. Option A is incorrect because 'batch_index_query' is not related to lookup caching. Option B is incorrect because the dashboard uses the correct lookup name. Option C is incorrect because restarting the search head may not clear the cache; the cache must be cleared explicitly.

Answer

The lookup definition has 'batch_index_query=True' and is not refreshing.

Answer

The dashboard is using the wrong lookup name.

Answer

The lookup file is cached and needs to be reloaded by restarting Splunk.

Question 17

A user wants to find the top 5 sourcetypes by event count over the last 24 hours. Which search is correct?

Accepted Answer

index=* | stats count by sourcetype | sort -count | head 5. Option C correctly uses stats to count events by sourcetype, then sorts in descending order and limits to top 5 with head. Option A contains the invalid command 'eventcount', not a real Splunk command. Option B uses invalid syntax 'top 5 sourcetype'; the correct syntax is 'top limit=5 sourcetype'. Option D returns the top 10 sourcetypes by default, not the top 5.

Answer

index=* | eventcount | top sourcetype

Answer

index=* | stats count by sourcetype | top 5 sourcetype

Answer

index=* | top sourcetype

Question 18

Refer to the exhibit. What is the purpose of this configuration?

Accepted Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.. This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters (maxpause, maxevents).

Answer

It creates a search-time field extraction for clientip and userid.

Answer

It configures the transaction command to run automatically on all data.

Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.

Question 19

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

Accepted Answer

... | transaction user maxspan=600. 'maxspan=600' limits the transaction time window to 600 seconds (10 minutes), which meets the requirement of grouping events within 10 minutes for each user. There's no need for startswith/endswith as all authentication events should be included. Option A is incorrect because 'maxevents=100' may truncate transactions with more than 100 events. Option B is incorrect because 'maxpause=120' only sets a pause threshold but does not enforce a total time limit; transactions could exceed 10 minutes if events continue with short pauses. Option C is incorrect because using startswith and endswith restricts the transaction to only those that begin with 'login' and end with 'logout', potentially excluding other authentication events like failures.

Answer

... | transaction user maxspan=600 maxevents=100

Answer

... | transaction user maxpause=120

Answer

... | transaction user maxspan=600 startswith="login" endswith="logout"

Question 20

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

Accepted Answer

Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.. Using stats and where is more efficient than transaction. Transaction holds all events in memory until the transaction is closed, which is memory-intensive when dealing with many events like 500 servers. The stats command can group events by src_ip, then the where command can filter for pairs of EventCode 4625 and 4624 within the same group. This approach leverages streaming capabilities and reduces memory overhead. Option A is incorrect because the append command does not correlate events by source IP; it merely concatenates results from two separate searches. Option B is incorrect because adding maxevents=1000 (already default) limits the number of events per transaction but does not address the underlying memory consumption issue of transaction. Option C is incorrect because increasing maxpause to 10 minutes would allow more events per transaction, making the search even slower and more prone to timeout.

Answer

Use the append command to combine the two event types after separate searches.

Answer

Add maxevents=1000 to the transaction command to limit event count.

Answer

Increase maxpause to 10 minutes to allow more events per transaction.