SPLK-1002 Practice Test 3 — 10 Questions

Question 1

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 2

A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?

Accepted Answer

Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`. Macro arguments must be referenced with $arg$ syntax and when the value contains spaces, it must be quoted. Option A defines the argument numerically (1) and uses $1$ without quotes, which fails for spaces. Option B defines the argument with $app$ (invalid syntax for definition) and uses $app$ without quotes. Option D defines 'app' without dollar signs, so the usage treats 'app' as literal text, not a variable. Option E uses $1 without a trailing dollar sign, which is invalid.

Answer

Definition: `filter_by_app(1)` and usage: `index=main app=$1$`

Answer

Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`

Answer

Definition: `filter_by_app(app)` and usage: `index=main app=app`

Answer

Definition: `filter_by_app($1)` and usage: `index=main app=$1`

Question 3

Which of the following is true about the sort command?

Accepted Answer

All of the above. The sort command in Splunk can sort in ascending order by default, can sort by multiple fields, and can use the limit parameter to restrict the number of results. All three statements (B, C, and D) are true, making 'All of the above' the correct choice.

Answer

It only sorts in ascending order by default

Answer

It can sort by multiple fields

Answer

It can use the limit parameter to limit results

Question 4

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]

Question 5

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

Accepted Answer

Add `| where count > 100` after the stats command.. The `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Answer

Use `| top limit=100 user` to get the top 100 users.

Answer

Add `| where count > 100` before the stats command.

Answer

Use `| filter count > 100` after the stats command.

Question 6

Arrange the steps to configure a lookup table file in Splunk.

Accepted Answer

Upload the lookup file to Splunk via Settings > Lookups > Lookup table files > New, then define the lookup table file by specifying the filename and options.. Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Answer

Define the lookup table file first via Settings > Lookups > Lookup table files, then upload the file.

Answer

Create a lookup definition first via Settings > Lookups > Lookup definitions, then upload the file, then define the lookup table file.

Answer

Upload the file to a custom directory, then create a lookup definition without defining the lookup table file.

Question 7

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Accepted Answer

The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.. Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Answer

The lookup file is not distributed to all indexers.

Answer

The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

Answer

The max_matches should be set to 0.

Answer

The lookup definition is missing the default_match setting, which should be set to 'no_match'.

Question 8

An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?

Accepted Answer

Splits the count by the 'method' field into separate series.. The `timechart` command with a `by` clause splits the count into separate series for each distinct value of the 'method' field, creating one line per method on the chart. Option A is incorrect because the time range is determined by the search, not necessarily per day. Option B is incorrect because the default span depends on the time range (e.g., less than 24 hours uses 1-minute bins, etc.). Option C is incorrect because `timechart` does not limit to top 10 by default.

Answer

Calculates the total count per day for each method.

Answer

Bins events into 1-hour intervals by default.

Answer

Shows only the top 10 methods.

Question 9

Which TWO of the following are valid ways to correlate events without using the transaction command?

Accepted Answer

Using eventstats to compute counts per transactionID. Options D and E are correct. Using stats ... by transactionID groups events by a common field and computes aggregate values, effectively correlating events. Using eventstats to compute counts per transactionID adds a calculated aggregate to each event, correlating events with the same transactionID. Both are valid correlation methods without using the transaction command. Options A and B (append and join) combine results from separate searches but do not correlate events in the same sense, and sort (C) merely orders events.

Answer

Using append to combine events from two searches

Answer

Using join to merge events on transactionID

Answer

Using sort to order events by transactionID

Question 10

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. The `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`