SPLK-1002 Practice Test 4 — 25 Questions

Question 1

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.. The correct optimization is Option C: replacing the transaction command with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'. The transaction command is inefficient because it groups all session events in memory and calculates duration, which consumes significant resources on 20 indexers with 2 TB/day. The stats approach is streaming and reduces data to one row per session before the eval and avg, drastically lowering memory and CPU usage. Option A (reducing time range to 1 hour) might help but doesn't address the core inefficiency and could miss sessions spanning longer than an hour. Option B (adding eventstats before transaction) adds extra processing without removing the bottleneck, still using transaction. Option D (removing maxspan) would allow sessions to remain open indefinitely, increasing memory consumption and potentially causing timeouts. Therefore, Option C is the most effective optimization.

Answer

Reduce the time range to 1 hour.

Answer

Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

Answer

Remove the maxspan parameter from the transaction command to allow longer sessions.

Question 2

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 3

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

Accepted Answer

maxpause=2m. Maxpause=2m (Option C). This option specifies the maximum period of inactivity between events in a transaction. When no events matching the transaction are received for 2 minutes, the transaction closes. This is ideal for correlating events with variable delays because it waits for activity and closes after a quiet period. In contrast, maxspan (option B) sets a total time window from the first event, which would close the transaction regardless of activity after 2 minutes from the start. Options A and D (startswith/endswith) define specific start and end events rather than a timeout. Thus, maxpause ensures the transaction remains open as long as events arrive within 2 minutes of each other.

Answer

endswith="end"

Answer

maxspan=2m

Answer

startswith="start"

Question 4

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 5

Which THREE of the following are correct about the transaction command's default behavior?

Accepted Answer

Transaction groups events by host, source, and sourcetype by default.. Options A, B, and C are correct. By default, the transaction command groups events by host, source, and sourcetype (A). It does not require startswith or endswith to be specified; you can use fields or other options (B). Transactions can evict partial transactions if maxpause is exceeded, meaning if no new events arrive within the maxpause period, the transaction is considered complete and evicted (C). Option D is false because transaction does not require all events to come from the same host; by default it uses host, source, sourcetype but you can override with fields. Option E is false because evicted transactions are not included in the results unless you use the keepevicted=true option.

Answer

Transaction requires all events to come from the same host.

Answer

Transaction always includes all evicted events in the results.

Question 6

Which TWO of the following searches are syntactically valid uses of the eventstats command? (Assume all referenced fields exist.)

Accepted Answer

| eventstats sum(bytes) as total_bytes by src_ip | eval pct = bytes/total_bytes*100. The `eventstats` command calculates aggregate statistics (here, `sum(bytes)`) over the entire result set or by group (here, `by src_ip`), and it adds the result as a new field (`total_bytes`) to every event. This allows the subsequent `eval` to compute a per-event percentage using that new field. Option C is correct because `eventstats` without a `by` clause computes the aggregate over all events and adds the result (here, `avg`) to each event, enabling the `eval` to calculate the difference from the global average.

Answer

| eventstats perc95(response_time) by host | eval p95 = perc95

Answer

| eventstats values(user) as users by session_id | eval num_users = len(users)

Answer

| eventstats max(_time)last_time by user | table last_time

Question 7

A Splunk administrator is troubleshooting a search that uses the transaction command to group login and logout events. The search runs but returns no results even though both types of events exist. The events are separated by at most 5 minutes. The current transaction command is:

`index=auth (action=login OR action=logout) | transaction action maxspan=10m maxpause=2s`

What is the most likely cause?

Accepted Answer

The maxpause value is too small; events may be more than 2 seconds apart.. The maxpause=2s parameter defines the maximum allowed gap between consecutive events in a transaction. If the actual time between a login and its corresponding logout event exceeds 2 seconds, the transaction command will close the transaction prematurely, treating the logout as the start of a new transaction. Since the events are separated by at most 5 minutes but could be more than 2 seconds apart, the maxpause value is too restrictive, causing the transaction to never complete with both events.

Answer

The maxspan value is too large, causing events to be grouped incorrectly.

Answer

The transaction command requires the connected=true argument to group events.

Answer

The transaction command requires keepevents=true to retain all events.

Question 8

Which THREE of the following are valid uses of the stats command? (Select three.)

Accepted Answer

Calculating the average of a field across all events.. The `stats` command in Splunk is used to perform statistical aggregations on search results. Option A is correct because `stats avg(field)` calculates the arithmetic mean of a specified field across all events in the result set. Option B is correct because `stats earliest(_time) by category` returns the minimum timestamp for each distinct value of the category field, which is a standard use of the `earliest()` function. Option C is correct because `stats count by category` groups events by the categorical field and returns the number of events in each group, a fundamental aggregation pattern.

Answer

Creating a time-based chart with multiple series.

Answer

Enriching events with fields from an external lookup.

Question 9

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. The 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 10

A Splunk environment ingests 10 TB per day. A user runs a search to count events per sourcetype over the last 7 days: `index=* earliest=-7d | timechart count by sourcetype`. The search returns partial results and eventually times out. The user needs to obtain the complete results efficiently. What is the best course of action?

Accepted Answer

Use `| tstats count where index=* earliest=-7d by _time span=1d, sourcetype` and then format as needed.. `tstats` runs on indexed metadata (tsidx files) rather than raw events, making it far more efficient for counting events over large time ranges. By specifying `by _time span=1d, sourcetype`, you get daily counts per sourcetype without scanning the entire event data, avoiding the timeout that occurs with a raw search over 10 TB/day for 7 days.

Answer

Use `| bucket span=1d | stats count by _time sourcetype` then `| xyseries` to format.

Answer

Use `| sitime` to sample the data and approximate counts.

Answer

Break the search into 1-day intervals and use `append` to combine results.

Question 11

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. The CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 12

The exhibit shows a search that reads a lookup file. Which of the following must be true for this search to work correctly?

Accepted Answer

The lookup must be defined in transforms.conf. For a lookup to work in a Splunk search, it must be defined in transforms.conf. This configuration file specifies the lookup type (e.g., file-based, KV-store, external), the filename, the field mapping, and other parameters. Without this definition, Splunk cannot resolve the lookup command or the lookup table reference in the search string, even if the file exists on disk.

Answer

The lookup file must be stored on the indexer

Answer

The file must be in the default lookup directory

Answer

The file server_status.csv must be in the $SPLUNK_HOME/etc/apps/search/lookups directory

Question 13

Refer to the exhibit. Which statement about this search is true?

Accepted Answer

It adds geographical info based on src_ip and then aggregates bytes by dest_ip and country.. The search uses `iplocation` to add geographical fields (like Country, City) based on the `src_ip` field, then renames `src_ip` to `src` and uses `stats` to aggregate bytes by `dest_ip` and the newly added `Country` field. This matches option D exactly.

Answer

It fails because iplocation requires a lookup table to be defined.

Answer

It uses iplocation to add geographical information about the destination IP.

Answer

It only includes events where src_ip is a valid IP address.

Question 14

A network operations team uses Splunk to analyze firewall logs. They need to identify top talkers (source IPs with highest total bytes) over the last hour. The current search: 'index=firewall | stats sum(bytes) as totalBytes by src_ip | sort -totalBytes | head 10' takes 5 minutes to complete. They want to make it faster. The environment has 5 indexers with default configurations. The data volume is 100 GB/day. Which action will most improve search performance?

Accepted Answer

Add 'earliest=-1h' to the search to restrict the time range explicitly.. Explicitly adding 'earliest=-1h' restricts the search to the last hour at the search head level, allowing Splunk to use time-based index metadata to skip irrelevant buckets entirely. Without an explicit time range, Splunk may scan all available data, dramatically increasing I/O and search time. This is the most impactful optimization for time-bound searches over large datasets.

Answer

Replace head 10 with limit 10 at the end of the pipeline.

Answer

Use map to run the search per indexer.

Answer

Set the search's parallelism to 'auto' in the commands.

Question 15

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 16

A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?

Accepted Answer

Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.. 'Alert suppression' with the setting 'Suppress if results are the same as the previous search' directly addresses the requirement to avoid alert fatigue when the number of failed logins is unchanged. Option A, 'Alert throttling', limits the frequency of alerts based on a time interval or field values, not comparison of result sets. Option C's throttle field is typically for throttling per field value, not condition-based suppression. Option D's severity and delay do not suppress based on result comparison.

Answer

Enable 'Alert throttling' based on the 'src' field.

Answer

Set the 'Throttle' field to suppress alerts for a specified time window.

Answer

Configure 'Alert severity' to low and set a delay.

Question 17

Match each Splunk search command to its primary function.

Accepted Answer

eval: Evaluate expressions and assign to new fields. These are common Splunk search commands used for data manipulation and enrichment.

Answer

eval: Extract fields using regular expressions

Answer

stats: Enrich events with data from external sources

Question 18

A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?

Accepted Answer

user=admin OR user=root. Using unquoted field comparisons with the OR operator performs an exact match for simple values like 'admin' and 'root'. In Splunk, when field values do not contain spaces or special characters, unquoted values are treated as exact match tokens. Therefore, `user=admin OR user=root` will retrieve events where the user field is exactly 'admin' or 'root'. Option A is also valid but less concise. Option B uses wildcards, matching any occurrence, not exact. Option C uses the IN operator, which is another exact match method, but option D is equally correct and often considered more straightforward for this simple case.

Answer

user="admin" OR user="root"

Answer

user=*admin* OR user=*root*

Answer

user IN ("admin", "root")

Question 19

A user needs to identify the top 3 error types by count, but only for the current month, and exclude results with fewer than 100 occurrences. Which TWO steps are necessary? (Select two.)

Accepted Answer

Use the where command to filter count>=100. The `where` command in Splunk is used to filter results based on a condition, and here it is needed to exclude error types with fewer than 100 occurrences after counting. Option D is correct because the `top` command with `limit=3` returns the top 3 values of a field by count, which directly satisfies the requirement to identify the top 3 error types.

Answer

Use the time range picker to set 'Current Month'

Answer

Use the search command with earliest and latest

Answer

Use the time command with relative time modifiers

Question 20

A user has created a dashboard panel using a 'chart' command with 'datacount by host'. The chart shows counts per host, but the hosts appear in alphabetical order. The user wants to sort the chart by count descending, so that the host with the most events appears first. The search is: index=main sourcetype=access | chart count by host. The dashboard is built using Simple XML. Which approach should be used to achieve the desired sorting?

Accepted Answer

Add '| sort -count' after the chart command in the search.. Adding '| sort -count' after the chart command sorts the results by count in descending order, making the host with the most events appear first. Option A is incorrect because the 'top' command produces a different table format (with count and percent fields) and is not appropriate if the desired output is a chart. Option B is incorrect because 'eventstats' adds a statistical field to events but does not replace the chart command or sort the results; it would require additional steps. Option D is incorrect because the Simple XML chart properties panel does not include a sorting option for chart data; sorting must be performed within the search itself.

Answer

Use the 'top' command instead of 'chart' to automatically sort by count.

Answer

Use 'eventstats' to compute counts and then sort by count.

Answer

Use the chart properties panel in the dashboard editor to set sorting by count descending.