SPLK-1003 Practice Test 28 — 15 Questions

Question 1

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

Accepted Answer

`transaction session_id maxspan=30m`. The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. By default, `transaction` requires at least one event from each sourcetype present in the search, which satisfies the requirement that each transaction contains at least one event from both `web_access` and `app_log`. This is the correct construct for correlating events across sourcetypes with a time-bound grouping.

Answer

`append [search sourcetype=app_log]` then sort by session_id

Answer

`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`

Answer

`join type=inner session_id [search sourcetype=app_log]` after a search on web_access

Question 2

A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?

Accepted Answer

Use the transaction command with startswith='login' and endswith='logout'.. The `transaction` command is specifically designed to group related events that share a common field (e.g., user or session ID) and occur within a defined time window. By using `startswith='login'` and `endswith='logout'`, it correctly identifies the beginning and end of a user session, grouping all intermediate events into a single transaction. This is the most direct and efficient method for correlating login and logout events in Splunk.

Answer

Use the sort command by user and time to manually identify sessions.

Answer

Use the stats command with values() and earliest().

Answer

Use the eval command to create a session ID based on time differences.

Question 3

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

Accepted Answer

The 'like' function requires a wildcard pattern with '%' but the field value may have leading/trailing spaces or the pattern is case-sensitive.. The 'like' function in Splunk uses SQL-style pattern matching where '%' matches any sequence of characters. If the lookup file contains 'admin1' and 'admin2', but the search uses 'like(role, "admin%")', leading/trailing spaces in the field values or case sensitivity (e.g., 'Admin1' vs 'admin1') would cause the pattern to fail, returning zero results. Option B correctly identifies this as the most likely reason because Splunk's 'like' is case-sensitive by default and does not trim spaces.

Answer

The lookup file is not in CSV format.

Answer

The stats command only counts events where role=admin, but the role field is already filtered.

Answer

The search command runs before the eval command.

Question 4

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Option B is correct because replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 5

A security analyst needs to find all events where the field 'status' is either 'error' or 'critical', and then count the number of events per source IP. Which search is correct?

Accepted Answer

index=security (status=error OR status=critical) | stats count by src_ip. Option A is correct because it uses the proper syntax to filter events where the 'status' field is either 'error' or 'critical' within the index, and then pipes the results into the stats command to count events by 'src_ip'. The parentheses around the OR condition ensure correct evaluation order, and the stats count by src_ip accurately aggregates the count per source IP.

Answer

index=security status=error AND status=critical | stats count by src_ip

Answer

index=security | where status=error OR status=critical | stats count by src_ip

Answer

index=security status=error OR status=critical | stats count by src_ip

Question 6

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. Option E is correct because the original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.

Question 7

A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?

Accepted Answer

user IN ("admin", "root"). Option C is correct because the `IN` operator in Splunk's Search Processing Language (SPL) performs an exact match against a list of values, ensuring that only events where the `user` field is exactly 'admin' or 'root' are returned. This is the most precise and efficient way to filter for multiple exact values without introducing wildcard behavior or relying on implicit field-value parsing that may include surrounding whitespace or punctuation.

Answer

user="admin" OR user="root"

Answer

user=*admin* OR user=*root*

Answer

user=admin OR user=root

Question 8

Which TWO of the following statements about the 'stats' command are true?

Accepted Answer

It can be used with a BY clause to group results.. Option A is correct because the 'stats' command in Splunk supports a BY clause that allows you to group results by one or more fields, similar to a SQL GROUP BY. This enables you to compute aggregate statistics (e.g., count, sum, avg) for each distinct value of the specified field(s), which is a core feature for summarizing event data.

Answer

The count() function must always include a field argument.

Answer

It creates one event per input event by default.

Answer

It can be used to modify individual field values in raw events.

Question 9

A search returns events with a field 'response_time' in milliseconds. The analyst wants to categorize response times into three buckets: 'fast' (< 100), 'medium' (100-500), 'slow' (> 500). Which search correctly creates this categorization?

Accepted Answer

| eval bucket=case(response_time<100,"fast", response_time>=100 AND response_time<=500,"medium", response_time>500,"slow"). Option A is correct because it uses the `case` function to evaluate multiple conditions in order, assigning 'fast' for response_time < 100, 'medium' for values between 100 and 500 inclusive, and 'slow' for values > 500. The `case` function returns the result of the first true condition, making it ideal for mutually exclusive buckets without overlapping logic.

Answer

| eval bucket=if(response_time<100,"fast",response_time<500,"medium","slow")

Answer

| eval bucket=if(response_time<100,"fast",if(response_time<=500,"medium","slow"))

Answer

| where response_time<100 | eval bucket="fast" | append [search where response_time>=100 AND response_time<=500 | eval bucket="medium"]

Question 10

The search returns unexpected results, including IP addresses that are not in the expected format (e.g., '127.0.0.1' appears as '27.0.0.1'). What is the most likely cause?

Accepted Answer

The rex command extracts the first match only; some events may have multiple IPs and the first one is not the full IP.. Option D is correct because the `rex` command, by default, extracts only the first match of a regex pattern from each event. If an event contains multiple IP addresses, `rex` captures the first occurrence, which may be truncated if the regex pattern is not anchored properly or if the IP appears in a context where leading digits are separated (e.g., '127.0.0.1' might be preceded by a character that causes the regex to match starting at '27.0.0.1'). This is a common behavior in Splunk when using `rex` without the `max_match` parameter.

Answer

The regex pattern is incorrect; it should use \b for word boundaries.

Answer

The top command is modifying the extracted ip field.

Answer

The rex command must be placed before the index search.

Question 11

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Option B is correct because setting an appropriate time range in a saved search limits the volume of data that Splunk must scan, reducing resource consumption and improving search performance. Without a bounded time range, the search may scan all available data, which can lead to excessive CPU and memory usage, especially in large deployments.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 12

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. Option D is correct because `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 13

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. Option B is correct because if the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 14

A security analyst creates a timechart of login failures by source IP. The chart shows expected spikes, but the top 5 IPs account for <10% of all failures. The analyst suspects a DDoS attack using spoofed IPs. Which visualization type would BEST highlight the distribution of failures across all IPs?

Accepted Answer

Treemap. A treemap is the best choice because it uses nested rectangles to represent the proportional contribution of each source IP to the total login failures, making it easy to visually identify the distribution across all IPs, even when no single IP dominates. Unlike other chart types, a treemap can efficiently display hundreds of IPs without cluttering the view, which is critical when the top 5 IPs account for less than 10% of failures, indicating a highly distributed attack pattern.

Answer

Pie chart

Answer

Scatter plot

Answer

Stacked column chart

Question 15

What is the MOST likely cause of this error?

Accepted Answer

The CSV file has a trailing space in the column header 'asset_type'.. The error is most likely caused by a trailing space in the CSV column header 'asset_type'. When `inputlookup` reads a CSV file, it treats column headers as literal strings; a trailing space makes the field name 'asset_type ' (with a space) instead of 'asset_type'. This mismatch causes the `where` command to fail because it references 'asset_type' without the space, leading to a field-not-found error.

Answer

The lookup is not configured to output all fields.

Answer

The lookup definition filename is incorrect.

Answer

The `where` command cannot be used after `inputlookup`.