SPLK-1002 Practice Test 3 — 10 Questions

Question 1

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 2

Order the steps to create a dashboard panel using the XML source editor in Splunk.

Accepted Answer

Open the dashboard in Edit mode, then click Source to open the XML editor, then add a panel element containing a search query and visualization, then save the XML.. Dashboard panels are defined in XML by adding a panel with a search query and visualization.

Answer

Click Source to open the XML editor, then open the dashboard in Edit mode, then add a panel element, then save.

Answer

Add a panel element, then open the dashboard in Edit mode, then click Source, then save.

Answer

Open the dashboard in Edit mode, then add a panel element, then click Source to open the XML editor, then save.

Question 3

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

Accepted Answer

Increase maxpause to 2 minutes. Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Answer

Decrease maxspan to 30 seconds

Answer

Remove maxpause and use only maxspan

Answer

Group by destination IP instead of source IP

Question 4

A user wants to find the number of unique users who logged in each day over the past week. Which SPL search should be used?

Accepted Answer

index=auth action=login | timechart span=1d dc(user) AS unique_users. The timechart command is designed to create time-based charts. Specifying span=1d ensures daily intervals, and dc(user) calculates the distinct count of users. This combination correctly produces the number of unique users per day over the past week.

Answer

index=auth action=login | timechart dc(user) AS unique_users

Answer

index=auth action=login | stats dc(user) AS unique_users BY date

Answer

index=auth action=login | chart dc(user) AS unique_users OVER _time BY date

Question 5

An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?

Accepted Answer

Splits the count by the 'method' field into separate series.. The timechart command in Splunk creates a time-series chart by aggregating data over time intervals. When you use 'timechart count by method', it splits the count into separate series for each value of the 'method' field, plotting them over time. This allows you to see trends for each HTTP method.

Answer

Calculates the total count per day for each method.

Answer

Bins events into 1-hour intervals by default.

Answer

Shows only the top 10 methods.

Question 6

A large CSV lookup file (over 10 million rows) is causing search performance degradation. Which solution best improves performance without sacrificing accuracy?

Accepted Answer

Convert to a KV Store lookup and update the collection as needed. Converting the large CSV lookup to a KV Store lookup improves performance because KV Store uses an indexed, persistent database (backed by MongoDB) that supports efficient key-based lookups, unlike CSV lookups which are loaded into memory and linearly scanned. KV Store lookups can handle large datasets without the memory pressure and replication overhead that CSV files impose on search heads. Accuracy is preserved because the full dataset remains available and queryable.

Answer

Increase the max_memory setting in transforms.conf

Answer

Convert to an index-time lookup with automatic re-indexing

Answer

Reduce the CSV file to only the most common lookup keys

Question 7

A user runs a search that includes `| bucket span=1h _time | stats count BY _time, host`. The results show only a few rows, but the user expected one row per hour per host. What is the most likely cause?

Accepted Answer

The search time range is shorter than one hour, so all events fall into a single bucket per host.. The bucket command groups _time into discrete intervals. If the overall search time range is less than the span, every event falls into the same bucket, so stats BY _time, host yields one row per host. Extending the time range or reducing the span would produce more rows.

Answer

The _time field is not present in the raw events, so bucket cannot group by time.

Answer

The bucket command was applied after stats, so the time grouping was lost.

Answer

The span=1h argument is invalid because bucket requires a numeric span without a time unit.

Question 8

A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?

Accepted Answer

maxpause=30m. The maxpause option defines the maximum time gap between events in a transaction; setting maxpause=30m ends the transaction when 30 minutes of inactivity occurs between events. This directly matches the requirement to group events from the same user session and close it after 30 minutes of inactivity.

Answer

keepevicted=true

Answer

maxspan=30m

Answer

maxevents=100

Question 9

An analyst notices that a timechart command with 'by host' shows only 10 hosts even though there are 50 distinct hosts. What could be the reason?

Accepted Answer

The 'limit' parameter is set to 10 by default.. The timechart command has a default 'limit' parameter of 10, which controls the maximum number of series (e.g., hosts) displayed when using a 'by' clause. With 50 distinct hosts, only the top 10 by the aggregated value are shown by default. To display more, you must explicitly set 'limit' to a higher value (e.g., limit=50) or use 'limit=0' for no limit.

Answer

The visualization is set to 'Pie' which only shows top 10.

Answer

The search is using 'join' to combine data.

Answer

The 'useother' parameter is set to false.

Question 10

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

Accepted Answer

There is only one event per client_ip in the time range. The transaction command groups events that share the same client_ip value. If each client_ip appears only once in the searched time range, each transaction will contain a single event, resulting in a duration of 0 because there is no time difference between events. The duration is calculated as the time difference between the first and last event in the transaction. With only one event, the duration is zero.

Answer

The client_ip field contains duplicates

Answer

The transaction option maxspan is set too high

Answer

The events are not time-stamped properly