SPLK-1002 Practice Test 30 — 15 Questions

Question 1

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

Accepted Answer

It limits the number of transactions that can be open simultaneously in memory.. The `maxopentxn` parameter in the `transaction` command limits the number of transactions that can be open at the same time in memory. Once this limit is reached, the transaction with the longest idle time is closed forcefully. This prevents excessive memory usage when many transactions are in progress. It does not directly limit the total number of transactions in the final results, nor does it limit events per transaction or time span of open transactions.

Answer

It limits the total number of transactions in the search results.

Answer

It limits the number of events per transaction.

Answer

It limits the time span of open transactions.

Question 2

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

Accepted Answer

keepevicted=true. The keepevicted=true option retains transactions that are closed due to maxpause (i.e., evicted transactions). This ensures that partial but potentially relevant transactions are not discarded and appear in the results. The closed=true option is not a valid parameter for the transaction command.

Answer

keepopen=true

Answer

closed=true

Answer

partial=true

Question 3

A security analyst wants to create a macro that extracts IP addresses from a field named `src_ip` and returns a count of unique IPs per source. Which macro definition accomplishes this?

Accepted Answer

| stats dc(src_ip) as unique_ips. `dc(src_ip)` is the Splunk command for distinct count, which returns the number of unique IP addresses in the `src_ip` field. This macro definition directly fulfills the requirement to count unique IPs per source, as `dc` is the standard abbreviation for distinct count in Splunk's `stats` command.

Answer

| stats count(src_ip) as unique_ips

Answer

| stats distinct_count(src_ip) as unique_ips

Answer

| stats unique(src_ip) as unique_ips

Question 4

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

Accepted Answer

`index=main | stats perc95(response_time) by service`. `stats perc95(response_time) by service` directly calculates the 95th percentile for each service across all events in one efficient pass. It is the simplest and most efficient way. Option C, while producing the same result, is less efficient because it first appends the percentile to every event using `eventstats` and then collapses with `stats values()`, adding unnecessary overhead. Option B uses time-based bucketing and option D uses a running calculation, both of which do not produce the desired overall percentile.

Answer

`index=main | timechart perc95(response_time) by service`

Answer

`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

Answer

`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

Question 5

A search produces a field 'count'. You need to find the event with the maximum count. Which approach is correct?

Accepted Answer

| eventstats max(count) as maxcount | where count = maxcount. Both options A and C are valid approaches to find the event with the maximum count. Option A uses `eventstats` to compute the maximum count and adds it to each event, then filters events where the count equals the maximum. This returns all events that share the maximum count, preserving full event data. Option C sorts events in descending order by count and takes the first event with `head 1`, returning one event with the maximum count. If multiple events tie for the maximum, `head 1` returns only one, but it still correctly identifies an event with the maximum count. Option D (`stats max(count) as maxcount`) returns only the maximum value, not the event details, so it is incorrect. Option B is not a valid search command; it is a self-referential statement, and thus incorrect.

Answer

Both B and C work.

Answer

| stats max(count) as maxcount

Question 6

A search using `tstats` to query a data model returns results but is slow. Which of the following is the most likely cause?

Accepted Answer

The data model is not accelerated.. When a data model is accelerated, Splink pre-computes and stores summaries of the data in a TSIDX index, allowing `tstats` to query these summaries very quickly. If the data model is not accelerated, `tstats` must scan the raw data in the index, which is significantly slower. Therefore, the most likely cause of slow `tstats` performance is that the data model lacks acceleration.

Answer

The data model contains too many fields.

Answer

The search includes a `where` clause on a non-indexed field.

Answer

The search uses `from` instead of `index`.

Question 7

A Splunk admin has created several macros to simplify complex search commands. One macro, named `time_filter`, is defined as `earliest=-7d@d latest=@d`. The admin also has a saved search that uses this macro. Recently, users have complained that the saved search reports data from the wrong time range: it appears to be showing data from the last 24 hours instead of the last 7 days. The admin inspects the saved search and finds that the search string is:

`index=main | eval days=now() | where days > relative_time(now(), "-7d@d") | `time_filter``

The admin suspects the macro is not being expanded correctly. Which of the following is the most likely cause of the issue?

Accepted Answer

The macro is disabled; the admin needs to enable it in the macros list.. The macro `time_filter` is defined as `earliest=-7d@d latest=@d`, but if it is disabled, it will not be expanded when invoked with backticks. Consequently, the search runs without the specified time range, defaulting to the last 24 hours, which explains the user reports. The admin should verify and enable the macro in the settings.

Answer

The macro definition includes arguments (`$earliest$`, `$latest$`), but the invocation does not pass any arguments; thus, the macro expands to nothing.

Answer

The saved search permissions are set to 'Private', so the macro does not apply.

Answer

The macro should be invoked with a pipe, like `| time_filter` instead of backticks.

Question 8

A security analyst needs to correlate authentication events from multiple Windows domain controllers to identify failed logon attempts from a specific user account, and then enrich the results with the user's department and manager from an HR database. Which TWO Splunk features should the analyst use?

Accepted Answer

Data model acceleration. Data model acceleration (B) is correct because it pre-computes and indexes authentication event data from multiple Windows domain controllers, enabling fast, efficient correlation of failed logon attempts for a specific user. Lookup definition (D) is correct because it allows the analyst to define a lookup that enriches the authentication events with the user's department and manager from an external HR database, mapping fields like username to the HR data.

Answer

Time-based lookup

Answer

Subsearch

Answer

Calculated field

Question 9

A search includes `... | eval day=strftime(_time, "%A") | stats count by day | sort count`. The results show Monday has the highest count. The analyst wants to confirm that the timezone is correctly applied. Which command should be added before the eval to ensure the day calculation uses the local timezone?

Accepted Answer

`... | eval _time=_time + (your_tz_offset*3600) | eval day=strftime(_time, "%A") ...`. The `strftime` function uses the server's timezone by default, which may not match the local timezone. By manually adding the timezone offset (in seconds) to `_time` before the `eval`, you shift the epoch timestamp to reflect the local time, ensuring that `strftime` calculates the correct day of the week. This is a common workaround when the search head's timezone differs from the user's local timezone.

Answer

`... | eval day=strptime(_time, "%A") | ...`

Answer

`... | fields + _time, day | ...`

Answer

`... | convert ctime(_time) | eval day=strftime(_time, "%A") ...`

Answer

`... | eval _time=relative_time(_time, "-0@d") | eval day=strftime(_time, "%A") ...`

Question 10

The following search is executed:
index=web
| rex "GET (?<url>.*)"
| eval category=case(url="/api/v1/data","API", url="/login","Login",1=1,"Other")
| stats count by category

But it returns unexpected results: the count for 'API' is much lower than expected. What is the most likely cause?

Accepted Answer

The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'.. The most likely cause is that the regex pattern used to extract the URL does not account for the HTTP version string that often appears after the URL, such as 'HTTP/1.1'. This causes the captured URL field to include extra characters like 'HTTP/1.1', which then fails to match the expected patterns in the subsequent eval and stats commands. Option A is incorrect because 'category' is defined in the eval statement using the extracted fields, so it is available after the eval. Option C is incorrect because the case function with a default condition '1==1' is valid and only acts as a catch-all; it would not override earlier conditions if they are true.

Answer

The stats command should use 'count by category' but category is not a field until after eval.

Answer

The case function has a default condition '1==1' that overrides all other conditions.

Question 11

A security analyst wants to visualize the count of login failures per hour, grouped by source IP. Which SPL command should they use?

Accepted Answer

timechart count by src_ip. Timechart automatically creates a time-based chart and can split by a field using 'by src_ip'. Option B is incorrect because stats produces a table, not a time-based chart, and does not automatically bin by time. Option C is incorrect because chart requires an explicit 'span' to create time-based bins, unlike timechart. Option D is incorrect because eventstats adds a new field but does not produce a visualization.

Answer

stats count by _time, src_ip

Answer

chart count by src_ip over _time

Answer

eventstats count by src_ip

Question 12

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Accepted Answer

`index=main | stats count by user, action`. The macro invocation `| `mysearch(user, action)` expands by replacing `$1$` with `user` and `$2$` with `action` in the definition `stats count by $1$, $2$`, resulting in `| stats count by user, action`. Option A incorrectly leaves the placeholders unreplaced. Option B has an extra pipe symbol, which would cause a syntax error. Option C does not expand the macro; it just references the macro name literally.

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Question 13

Match each Splunk role to its typical permission level.

Accepted Answer

admin: Full access to all Splunk features. Splunk roles determine user permissions: admin grants full access, power allows most features except administrative functions, and user restricts to own data and basic searches.

Answer

admin: Access to only search and reports

Answer

power: Full access to all Splunk features

Question 14

Which TWO of the following are valid ways to calculate the median of a numeric field?

Accepted Answer

stats p50(field). Options B, D, and E are all valid ways to calculate the median. Option B uses `eventstats median(field)` which adds the median as a new field to each event. Option D uses `stats p50(field)` which is a valid alias for `perc50` and computes the 50th percentile (median). Option E uses `stats median(field)` directly. Options A and C are invalid because `eval` cannot use `percentile` directly and `perc` is not a valid function.

Answer

eval median = percentile(field, 50)

Answer

eventstats median(field)

Answer

stats perc(field, 50)

Question 15

A company has over 2000 saved searches that are used across multiple teams. Each team has its own app, and many searches share common logic, such as filtering by a specific index or time range. The system is experiencing slow search performance and difficulty in managing changes. The administrator wants to improve maintainability and performance. Which action would best address these issues?

Accepted Answer

Create macros for common search fragments and update saved searches to use them.. Macros reduce duplication, simplify updates, and can improve performance by reducing parsing time. Consolidating into a single app does not reduce logic duplication. Increasing memory is a temporary fix. Acceleration on all searches may consume resources and does not address logic duplication.

Answer

Increase the search head's memory allocation.

Answer

Enable acceleration on all saved searches.

Answer

Consolidate all saved searches into a single app and use role-based access.