SPLK-1002 Practice Test 27 — 15 Questions

Question 1

Match each Splunk report type to its description.

Accepted Answer

Table Report: Displays raw or transformed data in a tabular format with rows and columns.. In Splunk, report types define how data is presented. Table Reports show raw data in rows/columns, Chart Reports use graphs, Single Value Reports show one key metric, and Statistics Reports summarize data. Common confusions arise between Table/Statistics and Chart/Single Value.

Answer

Table Report: Displays summary statistics with counts and averages.

Answer

Chart Report: Displays a single numerical value with a sparkline.

Question 2

An analyst runs a search that includes a subsearch: `index=web [search index=web status=500 | fields url | dedup url | limit 5]`. The main search returns no results even though the subsearch returns 5 URLs. What is the most likely issue?

Accepted Answer

The subsearch returns multiple values but the main search does not properly use them as a filter.. The subsearch returns a list of 5 URLs, but the main search `index=web [subsearch]` uses these results as a filter. By default, a subsearch returns its results as a single string (or multiple values) that are passed to the main search's `search` command. If the subsearch returns multiple values (e.g., `/page1 /page2 ...`), the main search interprets them as a single search string unless properly formatted with quotes or an `OR` operator. Since the subsearch does not use `format` or `return` to structure the output, the main search likely receives an invalid or empty filter, yielding no results.

Answer

The `limit 5` should be inside the subsearch command, not after dedup.

Answer

The main search index should be different from the subsearch index.

Answer

The subsearch should not use `fields url` because that causes loss of the search command.

Question 3

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

Accepted Answer

where mvindex(action,0)="login" AND mvindex(action,-1)="logout". The correct filter uses mvindex to access the first and last values of the multivalue 'action' field created by the transaction command. Option A uses invalid array indexing (action[0] is not valid in Splunk). Option B uses nonexistent functions first() and last(). Option C would require a single event to have both values simultaneously, which is impossible. Option D correctly uses mvindex(action,0) for the first event and mvindex(action,-1) for the last event, ensuring the transaction starts with 'login' and ends with 'logout'.

Answer

where action[0]="login" AND action[-1]="logout"

Answer

where first(action)="login" AND last(action)="logout"

Answer

where action="login" AND action="logout"

Question 4

Which TWO of the following statements about the 'stats' command are true?

Accepted Answer

It can be used with a BY clause to group results.. The 'stats' command in Splunk supports a BY clause that allows you to group results by one or more fields, similar to a SQL GROUP BY. This enables you to compute aggregate statistics (e.g., count, sum, avg) for each distinct value of the specified field(s), which is a core feature for summarizing event data.

Answer

The count() function must always include a field argument.

Answer

It creates one event per input event by default.

Answer

It can be used to modify individual field values in raw events.

Question 5

Which THREE of the following are true considerations when using CIM data model acceleration? (Select exactly 3.)

Accepted Answer

When acceleration is built, searches using the data model may use the `tstats` command for faster retrieval.. Options B, C, and D are correct. Option A is false: acceleration works on both indexed and extracted fields, but constraints do not require field aliases; they can use field names directly. Option E is false: acceleration uses tsidx files (time-series indexes), not summary indexes, to store precomputed results.

Answer

Acceleration only works on indexed fields; extracted fields are not accelerated.

Answer

Acceleration uses summary indexes to store precomputed results.

Answer

Acceleration requires that all data model constraints be defined with field aliases.

Question 6

Refer to the exhibit. What is the purpose of this search?

Accepted Answer

To enrich the server list with current status from the main index.. The search uses `inputlookup` to load a lookup file (server_list), then pipes it into `eval` to create a `status` field set to 'missing'. The `append` command adds all events from the main index (source=main sourcetype=access_combined) that match the server names in the lookup. The `stats values(*) as * by server` merges the two datasets per server, so if a server from the lookup has matching events in the main index, its `status` field will be overwritten with the actual status from the main index (e.g., '200'). Servers with no matching events retain 'missing'. This enriches the lookup data with current status from the main index.

Answer

To compare two datasets and show only matching server names.

Answer

To update the lookup file with current status.

Answer

To find servers that are missing from the lookup.

Question 7

A search uses eventstats to add the average response time per server to each event. Which of the following correctly describes the output?

Accepted Answer

Each event retains its original fields and gains the average response time for its server.. The `eventstats` command in Splunk computes aggregate statistics (like average) over a specified field grouping and then appends the result to every original event, not just one per group. In this case, it calculates the average response time per server and adds that value as a new field to each event that belongs to that server, preserving all original fields and events.

Answer

Only one event per server is returned, showing the average response time.

Answer

A running average is calculated across all events.

Answer

Events are grouped by server and the top values are listed.

Question 8

Which THREE are best practices for creating lookups in Splunk?

Accepted Answer

Use case-insensitive matching by default for user-facing lookups.. Using case-insensitive matching by default in user-facing lookups ensures that users do not need to worry about the case of the lookup key, which improves usability and reduces errors. In Splunk, this is configured via the `LOOKUP` command or in transforms.conf with the `case_sensitive_match = false` setting, which is the default behavior for most lookup types. This best practice avoids confusion when users query data with varying case formats, such as user names or hostnames.

Answer

Use wildcard matching in lookups for better performance.

Answer

Use a time-based lookup for static reference data.

Question 9

An analyst runs `index=web status=500 | top 10 uri` and gets results. Which statement is true about the 'top' command's behavior?

Accepted Answer

It counts the number of events per URI and displays the 10 with the highest count.. The `top` command in Splunk counts the occurrences of each distinct value of a specified field (here, `uri`) and returns the values with the highest counts. By default, it returns the top 10 results, so option E correctly describes that it counts events per URI and displays the 10 with the highest count.

Answer

It returns the 10 URIs that appeared most recently.

Answer

It computes the average latency per URI and shows the top 10.

Answer

It sums a numeric field per URI and shows the top 10 sums.

Answer

It requires a 'by' clause to specify the field to group by.

Question 10

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. B is correct because `timechart` is the primary command for creating time-series aggregations, allowing you to split data into time buckets and apply statistical functions. D is correct because `timewrap` is specifically designed to compare time periods (e.g., current week vs. previous week) by wrapping the time-series data into separate series for each period, enabling side-by-side visualization.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 11

An analyst needs to calculate the average response time for each web server, but only for requests that returned status code 200. The field 'response_time' is numeric. Which search correctly achieves this?

Accepted Answer

index=web status=200 | stats avg(response_time) by server. It first filters the data to only include events with status=200 using a search-time field filter, then uses the `stats` command with `avg(response_time) by server` to compute the average response time per server. This ensures that only successful requests are included in the aggregation, and the `by server` clause correctly groups the results by each web server.

Answer

index=web | transaction server maxspan=1m | stats avg(response_time) by server

Answer

index=web status=200 | eventstats avg(response_time) as avg_time by server

Answer

index=web | eval avg_time = avg(response_time) by server | search status=200

Question 12

A search uses a subsearch to filter events, but the subsearch returns more than 50,000 results, causing the search to fail. Which approach can avoid this limit while still achieving the goal?

Accepted Answer

Use a nested subsearch with stats to aggregate results first.. Using a nested subsearch with `stats` to aggregate results first reduces the number of events returned by the subsearch, allowing it to stay under the default 50,000-result limit. This approach pre-processes the subsearch output (e.g., by counting or grouping) so that the outer search receives a manageable set of values, effectively bypassing the limit without altering system configuration.

Answer

Increase the limit in limits.conf.

Answer

Use a join command instead.

Answer

Use the format command with AND.

Question 13

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 14

A search includes `... | transaction 1,2,3` but returns unexpected results. What does the `1,2,3` represent in this context?

Accepted Answer

maxspan=1s, maxpause=2s, maxevents=3. When the `transaction` command is given three numeric arguments without field names, they are interpreted as `maxspan`, `maxpause`, and `maxevents` respectively. Therefore, `1,2,3` means maxspan=1 second, maxpause=2 seconds, and maxevents=3. Option A is wrong because these are not field names; transaction keys are specified by providing field names as arguments. Option B is wrong because transaction does not correlate across indexes; it groups events based on fields or time. Option C is wrong because these are not status codes; transaction uses temporal settings and event count limits.

Answer

Field names to use as transaction keys

Answer

Three index names to correlate across indexes

Answer

Status codes for transactions (1=open, 2=pending, 3=closed)

Question 15

Which THREE of the following are valid Splunk search commands?

Accepted Answer

regex. The `regex` command is a valid Splunk search command that filters search results by applying a Perl-compatible regular expression (PCRE) to raw events or specific fields. It is commonly used to extract or match patterns within event data, such as IP addresses or error codes, and is distinct from the `rex` command which extracts fields.

Answer

filter

Answer

parse