SPLK-1003 Practice Test 3 — 25 Questions

Question 1

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Answer

External lookup

Answer

KV Store lookup

Answer

Geospatial lookup

Question 2

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. Option C is correct because it first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 3

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

Accepted Answer

A lookup definition must be added to transforms.conf. When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Answer

The lookup file must be uploaded via the UI instead of placed manually

Answer

The search head must be configured as a lookup server

Answer

The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory

Question 4

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Accepted Answer

transaction by transaction_id. The correct answer is intended to be A, but note that in Splunk, the `transaction` command does not use a `by` clause; the correct syntax is `transaction transaction_id`. However, among the given options, option A is the only one that groups by `transaction_id` without imposing any time constraints (like `maxspan`) or marker arguments (`startswith`/`endswith`). Option B incorrectly includes `sourcetype` in the grouping, which would split events across sourcetypes. Option C adds a time constraint (`maxspan=1d`) which is not required. Option D adds marker arguments that are not needed. Therefore, despite the syntactical inaccuracy, option A is the most appropriate choice.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 5

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

Accepted Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h. Option C is correct because the `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h

Answer

index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time

Answer

index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h

Question 6

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. Option A is correct because the 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 7

A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?

Accepted Answer

maxpause=1800. Option D (maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.

Answer

startswith=login endswith=logout

Answer

mvlist=session_id

Answer

maxspan=30m

Question 8

Which THREE of the following are valid use cases for the `transaction` command in Splunk?

Accepted Answer

Identifying a sequence of events that indicate a brute-force attack (multiple failed logins followed by a success).. Option A is correct because the `transaction` command groups related events into a single transaction based on common fields and temporal constraints. In this case, it can group multiple failed login events followed by a successful login for the same user, which is a classic indicator of a brute-force attack. The command allows you to set `maxspan` and `maxpause` to define the time window and gap between events, making it ideal for detecting such sequences.

Answer

Generating an alert when a transaction contains more than five events.

Answer

Enriching events with external data from a CSV file based on a common key.

Question 9

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. Option D is correct because the `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 10

A Splunk administrator notices that a `transaction` command used for correlating VPN login and logout events is consuming excessive memory and causing search timeouts. The transaction groups events by `user` with `maxspan=12h` and `maxpause=30m`. The VPN logs contain millions of events per day. Which design change would most effectively reduce resource consumption while maintaining the ability to correlate logins and logouts within the same session?

Accepted Answer

Replace the transaction command with a stats command using earliest and latest functions on the event type.. Option C is correct because replacing `transaction` with `stats` using `earliest` and `latest` eliminates the in-memory event buffering that causes memory exhaustion. `transaction` holds all events in memory until the transaction boundary (maxspan/maxpause) is reached, which is extremely expensive for millions of VPN events. `stats` processes events in a streaming fashion, computing the first and last timestamps per user without storing the full event list, drastically reducing memory and avoiding timeouts.

Answer

Remove the maxpause option from the transaction command to simplify grouping.

Answer

Reduce maxspan to 4h to limit the time window for grouping events.

Answer

Add maxevents=2 to the transaction command to limit each transaction to exactly two events.

Question 11

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

Accepted Answer

The same clientip can appear in multiple transactions, causing overcounting.. The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.

Answer

The sourcetype does not contain enough methods to satisfy the condition.

Answer

The stats command should use `dc(clientip)` instead of `count by clientip`.

Answer

The mvcount function counts the number of unique methods, not events.

Question 12

A security analyst is writing a search to detect lateral movement across servers by correlating authentication events from multiple domain controllers. Each event has a `user`, `src_ip`, and `dest_ip`. The analyst wants to group events where the same user authenticates from at least 3 different source IPs within 10 minutes. Which THREE components must be part of the search to achieve this? (Choose THREE.)

Accepted Answer

Use `transaction user` to group events by user.. Options A and C are correct. The `transaction user` command groups events by user, and `maxspan=10m` limits the grouping window. Option B is incorrect because `mvcount(src_ip)>=3` counts all occurrences of `src_ip`, not distinct IPs, so it does not guarantee that the user authenticated from at least 3 different source IPs. The correct approach would involve using a different method to ensure distinct IPs, such as removing duplicates within the transaction before counting.

Answer

After the transaction, use `where mvcount(src_ip)>=3` to filter transactions with at least 3 distinct source IPs.

Answer

Use `maxevents=3` to ensure at least three events per transaction.

Answer

Use `dedup user` before the transaction to reduce events.

Question 13

A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?

Accepted Answer

index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip). Option A is correct because it uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.

Answer

index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8

Question 14

Match each Splunk role to its typical permission level.

Accepted Answer

admin: Full access to all Splunk features. Splunk roles determine user permissions: admin grants full access, power allows most features except administrative functions, and user restricts to own data and basic searches.

Answer

admin: Access to only search and reports

Answer

power: Full access to all Splunk features

Question 15

Match each Splunk search command to its primary function.

Accepted Answer

eval: Evaluate expressions and assign to new fields. These are common Splunk search commands used for data manipulation and enrichment.

Answer

eval: Extract fields using regular expressions

Answer

stats: Enrich events with data from external sources

Question 16

A team wants to create a custom visualization that requires JavaScript and CSS modifications. Which Splunk feature should be used?

Accepted Answer

Custom visualization framework. The Custom Visualization Framework (option D) is the correct choice because it is the only Splunk feature that allows developers to create entirely new visualizations using JavaScript and CSS. This framework provides the necessary APIs and hooks to register custom visualization types that can then be used in dashboards, whereas the other options either restrict customization or do not support custom JavaScript/CSS modifications.

Answer

Splunk Web Framework

Answer

Simple XML dashboard

Answer

Dashboard studio

Question 17

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Accepted Answer

Time-based lookup. Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Answer

File lookup

Answer

CSV lookup

Answer

External lookup

Question 18

Which two methods can reduce the resource consumption of a large CSV lookup in Splunk? (Choose 2)

Accepted Answer

Use the lookup command to only return required fields. Option D is correct because using the `lookup` command with a field list (e.g., `| lookup mylookup.csv field1 OUTPUT field2 field3`) reduces resource consumption by only loading the specified output fields into memory, rather than the entire CSV lookup. This minimizes memory usage and I/O overhead, especially for large CSV files with many columns.

Answer

Convert the CSV to a gzip file and reference it

Answer

Increase the max_match parameter

Answer

Use a time-based lookup to limit matches by time

Question 19

A user reports that a macro named `my_macro` is not expanding in a search. The macro is defined in a private app called 'App_A'. The user is running the search in a different app called 'App_B'. What is the most likely cause of the issue?

Accepted Answer

The macro is not shared to the global context.. Macros are confined to the app where they are defined unless they are shared to the global context. Since my_macro is defined in App_A but the user is searching from App_B, and the macro is not shared globally, it will not expand in App_B. Thus, option D is correct. Option A is incorrect because a syntax error would typically produce a specific error message, not just fail to expand. Option B is incorrect because permission to view the macro does not affect cross-app expansion; sharing to global context is required. Option C is incorrect because Splunk macro names are case-insensitive.

Answer

The macro has a syntax error that prevents expansion.

Answer

The user does not have permission to view the macro.

Answer

The macro name is case-sensitive and the user used wrong case.

Question 20

Refer to the exhibit. An admin configures acceleration for the Network_Traffic data model as shown. A user runs a search using the data model over the last 60 days. Why might the search be slower for data older than 7 days?

Accepted Answer

The earliest_time is set to -7d@d, so the acceleration index only covers the last 7 days. Option C is correct: The `earliest_time` parameter in the acceleration configuration is set to -7d@d, meaning the acceleration summary is built only for data from the last 7 days. Searches querying older data must scan raw events, which is slower. Option A is incorrect because summary_range controls how long to keep accelerated data, not the time range covered. Option B misstates the summary_range: it is set to 30d, not that data within 30 days is accelerated. Option D is incorrect; the datamodel command is not required to use acceleration; acceleration is transparently applied when using the data model.

Answer

The data model is not compatible with acceleration

Answer

The summary_range is set to 30d, so only data within 30 days is accelerated

Answer

The search must use the `| datamodel` command to benefit from acceleration