SPLK-1002 Practice Test 29 — 15 Questions

Question 1

A Splunk administrator notices that a transaction command is consuming excessive memory and taking too long to complete. The transaction is defined on a field with high cardinality. Which of the following would most effectively reduce memory usage and improve performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a different field with lower cardinality for grouping. The transaction command groups events based on field values, and high cardinality fields create many unique groups, each requiring memory for state tracking. Using a lower-cardinality field reduces the number of concurrent groups, directly lowering memory consumption and processing time. This addresses the root cause rather than adjusting timeouts or eviction policies.

Answer

Increase the maxspan value

Answer

Remove the maxspan constraint

Answer

Set keepevicted=false

Question 2

You are a Splunk power user at a manufacturing company. You have created a timechart that shows machine temperature readings over time. The data is indexed with timestamps every minute, but the timechart shows gaps where no data exists because some machines may not report at all times. You want to fill the gaps with 0 values to avoid misleading visualizations. The current search is: index=manufacturing sourcetype=temperature | timechart span=1h avg(temp) by machine. Which modification to the timechart command will fill the gaps with 0?

Accepted Answer

timechart span=1h usenull=t. Usenull=t fills null values with 0. Option A is incorrect because cont=t ensures continuous time buckets but does not fill nulls with 0. Option B is incorrect because limit=0 does not affect null filling. Option D is incorrect because usenull=f leaves gaps, and useother=f is irrelevant.

Answer

timechart span=1h cont=t

Answer

timechart span=1h limit=0

Answer

timechart span=1h usenull=f useother=f

Question 3

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

Accepted Answer

There is only one event per client_ip in the time range. A duration of 0 often occurs when there is only one event in the transaction. This can happen if the events do not meet the criteria for starting or ending a transaction, or if the maxpause is too short.

Answer

The client_ip field contains duplicates

Answer

The transaction option maxspan is set too high

Answer

The events are not time-stamped properly

Question 4

A saved search is configured to run every 5 minutes and send an alert when the count of failures exceeds 10. After several days, users report they are not receiving alerts even though failures are occurring. The saved search runs successfully and produces results. What is the most likely cause?

Accepted Answer

Alert throttling is enabled and suppressing subsequent alerts.. Alert throttling is designed to suppress duplicate alerts within a specified time period. If throttling is enabled, even though the saved search runs every 5 minutes and the condition (count of failures > 10) is met, only the first alert is sent. Subsequent alerts are suppressed until the throttle window resets, explaining why users stop receiving alerts despite ongoing failures. The search runs successfully, so permissions and alert action configuration are not the issue, and the condition is correctly set to exceed 10, not less than 10.

Answer

The saved search owner does not have permission to send alerts.

Answer

The alert action is not configured to send to the intended recipients.

Answer

The alert condition is set to trigger when count is less than 10.

Question 5

A dashboard panel uses a timechart to show error counts over time. Users report that the time range picker does not affect the panel. What is the most likely cause?

Accepted Answer

The search uses a fixed earliest and latest time.. If the search uses fixed earliest/latest times (e.g., via `earliest=-30d@d` or a set time range in the search string), the time range picker has no effect. Option A is incorrect because sharing the dashboard does not affect time range behavior. Option B is incorrect because 'stats' can still respect the time range if used correctly, but the issue here is fixed time bounds, not the command. Option C is incorrect because an index that is not time-based would prevent any time-based search from working, but the panel would show no data or an error, not simply ignore the time picker.

Answer

The dashboard is not shared.

Answer

The panel uses 'stats' instead of 'timechart'.

Answer

The index is not time-based.

Question 6

An analyst wants to remove events that contain the string 'debug' from a log. Which command should be used?

Accepted Answer

| search NOT debug. The `| search NOT debug` command filters out all events containing the string 'debug' from the result set. In Splunk, the `NOT` operator before a search term excludes events that match that term, effectively removing them from the output. This is the standard way to exclude a specific string from search results.

Answer

| where NOT match(_raw,"debug")

Answer

| search debug | reverse

Answer

| search "debug" NOT

Question 7

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

Accepted Answer

Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.. When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.

Answer

The transaction command failed to group events properly and returned only the login event.

Answer

The transaction command is processing events out of order, causing login and logout timestamps to be the same.

Answer

The maxevents=5 limitation causes the transaction to close early, but the logged duration is still calculated correctly from the first event timestamp.

Question 8

A network engineer wants to add geographic location (city, country) to firewall logs based on source IP. Which lookup type is most appropriate?

Accepted Answer

File-based lookup (CSV). File-based lookup (CSV). A CSV file containing IP-to-location mappings is simple, efficient, and well-suited for static geographic data. Option A (KV Store lookup) is designed for dynamic, frequently updated data, not static IP-to-location mappings. Option B (Scripted lookup) is for complex external data sources requiring external commands or scripts. Option C (Automatic lookup configured in props.conf) is a method to apply lookups automatically at search time, but it requires a lookup definition file (like CSV) first; it is not a lookup type. Therefore, the most appropriate lookup type for this use case is a file-based CSV lookup.

Answer

KV Store lookup

Answer

Scripted lookup

Answer

Automatic lookup configured in props.conf

Question 9

A search is producing results that include both internal and external traffic. The analyst wants to approximate the number of distinct destination IPs for internal traffic only, where internal IPs fall within the 10.0.0.0/8 range. Which approach is most efficient?

Accepted Answer

Use | where cidrmatch("10.0.0.0/8", src_ip) | stats dc(dest_ip). It uses `where cidrmatch("10.0.0.0/8", src_ip)` to efficiently filter events to only those with source IPs in the 10.0.0.0/8 range before passing them to `stats dc(dest_ip)`. This approach leverages Splunk's built-in CIDR matching function, which performs a bitwise comparison on the IP address, and applies the filter early in the pipeline, reducing the dataset for the distinct count operation. It is the most efficient as it avoids unnecessary evaluations or string operations on non-matching events.

Answer

Use | search src_ip=10.* | stats dc(dest_ip)

Answer

Use | rex field=src_ip to extract first octet and then filter

Answer

Use | eval internal=if(cidrmatch("10.0.0.0/8", src_ip),1,0) | stats dc(dest_ip) by internal

Question 10

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 11

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

Accepted Answer

`... | timechart span=1h dc(user)`. `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Answer

`... | stats dc(user) by _time span=1h`

Answer

`... | timechart span=1h dc(by user)`

Answer

`... | eval user=user | timechart span=1h count by user`

Answer

`... | timechart span=1h sum(count) by user`

Question 12

Which THREE of the following are components of the Splunk Common Information Model (CIM)? (choose three)

Accepted Answer

Endpoint. (Endpoint) is correct because the Splunk Common Information Model (CIM) includes the Endpoint data model, which normalizes data from endpoint security solutions such as antivirus, EDR, and host-based intrusion detection. This data model covers processes, file system changes, registry modifications, and other host-level activities, making it a core component of the CIM.

Answer

Application State

Answer

Change Analysis

Question 13

Which TWO of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Upload a CSV file through the Splunk Web interface. Splunk Web provides a direct interface to upload a CSV file and define it as a lookup table, automatically creating the lookup definition and file. Option D is correct because the `outputlookup` command in a search writes search results to a CSV file in the lookups directory, effectively creating a lookup table from dynamic data.

Answer

Use the eval command to create a lookup definition

Answer

Use the stats command to aggregate data into a lookup

Answer

Use the inputlookup command in a search

Question 14

An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?

Accepted Answer

transaction. (transaction). The transaction command groups events from multiple sourcetypes based on a common field (user) and can correlate them into a single event per session, preserving all fields. Options A (append) simply adds events from one search to another without correlation, B (union) combines results from multiple searches without grouping, and D (join) merges events from two datasets based on a common field but does not handle sessionization or multiple sourcetypes as effectively as transaction.

Answer

append

Answer

union

Answer

join

Question 15

A user wants to add a field showing the average value of a numeric field `latency` for each host, without reducing the number of events. Which command should be used?

Accepted Answer

eventstats. The `eventstats` command is correct because it calculates aggregate statistics (like average) over a field and appends the result as a new field to every event, preserving the original event count. Unlike `stats`, which reduces the dataset to one row per group, `eventstats` enriches each event with the computed value without removing any events.

Answer

eval

Answer

stats

Answer

streamstats