SPLK-1002 Practice Test 26 — 15 Questions

Question 1

A security analyst wants to create a comparison report showing the count of login failures by user for today versus yesterday. They run: `index=security action=failure | timechart count by user`. This produces a chart of counts over time, but they want separate columns for today and yesterday. How can they achieve this comparison efficiently?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use `| eval day=if(_time>=relative_time(now(),"@d"),"today","yesterday") | timechart count by user by day`.. The correct approach is to use eval to create a day label (today vs yesterday) based on _time, then use timechart with the user and day fields to produce separate columns for each period. Option B does exactly that. Option A is incorrect because it uses append to combine two searches, but timechart with by period would not produce the desired side-by-side columns and is inefficient. Option C uses stats and xyseries, which can create a table but is less efficient and does not automatically limit to today and yesterday. Option D is incorrect because timechart with useother=t only groups low-count results into 'OTHER' and does not create separate columns for today and yesterday.

Answer

Use `| append [search index=security action=failure earliest=-2d@d latest=-1d@d | eval period="yesterday"] | timechart count by user by period`.

Answer

Use `| stats count by user _time | xyseries _time user count`.

Answer

Use `| timechart count by user useother=t` with the time range set to 'Yesterday' and 'Today' in the time picker.

Question 2

A large e-commerce company uses Splunk to monitor transactions. They have a CSV lookup file named 'customer_lookup.csv' containing 5 million rows of customer data (customer_id, name, address, tier). The lookup is used in a search that runs every hour to generate a report of sales by customer tier:

index=transactions sourcetype=transaction_logs | lookup customer_lookup customer_id OUTPUT name, address, tier | timechart count by tier

The search often times out or takes too long to complete, impacting operational dashboards. The team is considering optimization strategies. The lookup file is updated daily and stored in a custom app directory. The Splunk environment is distributed with a single search head and multiple indexers. Which of the following recommendations would most effectively improve the search performance?

Accepted Answer

Convert the CSV lookup to a KV Store lookup by defining a collection and populating it from the CSV.. The most effective optimization is to convert the CSV lookup to a KV Store lookup (Option B). KV Store lookups are designed for high-performance key-value operations and scale better than CSV lookups for millions of rows, significantly reducing search time. Option A (subsearch) would actually degrade performance. Option C (partial=true) only affects timechart display, not lookup speed. Option D (removing output fields) improves only slightly and may lose useful data.

Answer

Use a subsearch to first find matching customer IDs and then join with the lookup.

Answer

Use the `timechart` command with `partial=true` to allow the search to return intermediate results.

Answer

Remove the OUTPUT fields name and address from the lookup, keeping only the tier field.

Question 3

A team wants to create a dashboard that displays daily user activity over the past 30 days. The underlying data is voluminous (hundreds of millions of events per day). They need the dashboard to load quickly. The admin considers two options: using a summary index with a scheduled search to pre-compute the daily counts, or using data model acceleration on a CIM data model. Which approach is most appropriate for this specific requirement?

Accepted Answer

Use a summary index because it allows custom summarization and reduces license usage.. A summary index pre-computes exactly the needed daily counts, reducing search time and license usage. Data model acceleration still queries the full dataset and may be less efficient for custom aggregation. Using both adds complexity. Report acceleration on the dashboard search still queries the full data.

Answer

Use data model acceleration because it automatically updates and is easier to set up.

Answer

Use neither; instead, use report acceleration on the dashboard search.

Answer

Use both to ensure data availability.

Question 4

A Splunk admin is tasked with creating a set of macros that will be used by multiple app developers to standardize searches across the organization. The macros need to accept parameters such as index, sourcetype, and time range. Some macros will be complex and include subsearches. Which approach should the admin take to ensure maximum reusability and maintainability?

Accepted Answer

Use macro arguments with default values and include comments in the definition.. Using macro arguments with default values and comments provides flexibility and clarity. Defining macros without arguments forces users to edit for each use. Separate macros for each parameter combination create unnecessary duplication. A single macro with conditionals becomes complex and hard to maintain.

Answer

Create separate macros for each combination of parameters.

Answer

Embed all logic into a single macro and use conditional statements.

Answer

Define macros with no arguments and rely on the developers to modify the macro code.

Question 5

A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?

Accepted Answer

Use `transaction transaction_id maxevents=2 maxspan=30s`.. Adding `maxevents=2` limits each transaction to exactly two events (a request and a response), preventing large groupings that cause memory issues and timeouts. The `maxspan=30s` already sets a time window. Option A (using a time range picker) does not address the internal grouping inefficiency. Option B (`stats values(*) as * by transaction_id`) does not maintain event order and can mix fields, failing to properly correlate request-response pairs. Option C (renaming component to type) does not improve performance.

Answer

Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.

Answer

Use `stats values(*) as * by transaction_id` and then filter.

Answer

Use `rename component to type` and then use `transaction`.

Question 6

A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?

Accepted Answer

maxpause=30m. Maxpause=30m. The maxpause option specifies the maximum time between events in a transaction; if the pause exceeds this value, the transaction ends. This is ideal for grouping events by user session with a 30-minute inactivity timeout. Option B (keepevicted=true) retains partial transactions that were evicted from memory, not ending criteria. Option C (maxspan=30m) limits the total time span from the first to the last event, not inactivity. Option D (maxevents=100) limits the number of events in a transaction.

Answer

keepevicted=true

Answer

maxspan=30m

Answer

maxevents=100

Question 7

An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?

Accepted Answer

The lookup definition is not configured as a CIDR type. The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet. Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.

Answer

The IP addresses in the events are in lowercase

Answer

The lookup file is not in CSV format

Answer

The lookup file is compressed and not being read correctly

Question 8

A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search:

`index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200`

This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?

Accepted Answer

The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.. The `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.

Answer

The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.

Answer

The search lacks a `fields` command to include `user_id`, so the transaction fails.

Answer

The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.

Question 9

Which TWO search commands can be used to calculate a running total (cumulative sum) of a field over time?

Accepted Answer

accum. B is correct because the `accum` command calculates a cumulative sum of a specified numeric field across all events in the search result order, adding each event's value to the running total. This directly implements a running total without requiring any additional options.

Answer

delta

Answer

transaction

Answer

eventstats

Question 10

Order the steps to create a data model in Splunk in the correct order.

Accepted Answer

Step 1: Create a new data model. Step 2: Add a root event type. Step 3: Define constraints for the event type. Step 4: Add fields to the event type.. Data models are created by defining hierarchical objects with constraints and fields.

Answer

Step 1: Add a root event type. Step 2: Create a new data model. Step 3: Define constraints. Step 4: Add fields.

Answer

Step 1: Create a new data model. Step 2: Define constraints. Step 3: Add a root event type. Step 4: Add fields.

Answer

Step 1: Create a new data model. Step 2: Add a root event type. Step 3: Add fields. Step 4: Define constraints.

Question 11

Which TWO of the following statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

It can add a 'duration' field to the result events.. The 'transaction' command automatically adds a 'duration' field to the result events, which represents the time difference between the first and last event in the transaction. This is a built-in behavior of the command, not an optional setting.

Answer

It requires events to be sorted by _time in descending order.

Answer

It can only be used with 'startswith' and 'endswith' options.

Answer

It requires at least one field in the 'by' clause.

Question 12

Which TWO of the following eval functions can be used to convert a string to a numeric value?

Accepted Answer

int(). The `int()` function (option C) converts a string representation of an integer into a numeric integer value, and `tonumber()` (option E) converts a string to a floating-point or integer number, making both valid for converting strings to numeric values in Splunk's eval command.

Answer

tostring()

Answer

number()

Answer

str()

Question 13

A team develops multiple dashboards that share common search logic. What is the best practice for managing these searches?

Accepted Answer

Use macros to define reusable search fragments.. Macros allow reusable search fragments that can be used across multiple dashboards, reducing duplication and simplifying maintenance. Embedding search strings directly in each dashboard (option C) causes duplication and is hard to maintain. Creating a saved search for each dashboard (option A) still duplicates logic. Using a single saved search that all dashboards reference (option B) may not be flexible enough for different dashboard requirements. Therefore, macros are the best practice.

Answer

Create a saved search for each dashboard.

Answer

Use a single saved search that all dashboards reference.

Answer

Embed the search strings directly in each dashboard.

Question 14

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

Accepted Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h. The `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h

Answer

index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time

Answer

index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h

Question 15

A search is used to calculate the 95th percentile of response times for each application, and then to find applications where the 95th percentile exceeds 5000 ms. The current search is:

`index=perf sourcetype=app_response | stats perc95(response_time) by app | where perc95(response_time) > 5000`

This search fails with an error. What is the most likely reason?

Accepted Answer

The field name in the where clause must match exactly, including parentheses. Use `where 'perc95(response_time)' > 5000`. The `where` clause in SPL treats field names containing special characters (like parentheses) as literal strings. Without quoting, `perc95(response_time)` is parsed as a function call rather than a field name, causing a syntax error. Wrapping the field name in single quotes (`'perc95(response_time)'`) tells Splunk to treat it as a literal field reference.

Answer

The stats command cannot use perc95 with a by clause.

Answer

The stats command requires a rename of the output field.

Answer

The perc95 function is not a valid stats function.