SPLK-1002 Practice Test 31 — 15 Questions

Question 1

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 2

A search returns 50,000 events. The analyst wants to sample 1% evenly across time. Which sampling command should be used?

Accepted Answer

sample method=random ratio=0.01. The `sample` command with `method=random` and `ratio=0.01` performs a random sampling of exactly 1% of events, and when used without a `by` clause, it distributes the sampling evenly across time by default. This ensures a statistically representative subset of the 50,000 events, preserving temporal distribution.

Answer

sample 0.01

Answer

sample method=block ratio=0.01

Answer

sample ratio=0.01

Question 3

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

Accepted Answer

Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes. The transaction command groups events by src_ip=10.0.0.1 with startswith='allow' and endswith='deny' and a maxspan of 5 minutes. This forms transactions that begin with an 'allow' event and end with a 'deny' event within a 5-minute window for that source IP. Option A is incorrect because the search filters events for src_ip 10.0.0.1 only, not all source IPs. Option B is incorrect because it describes transactions of all firewall events, but the start and end conditions restrict the events filtered. Option C is incorrect because it reverses the start and end conditions (start with deny, end with allow) whereas the search specifies start with allow and end with deny.

Answer

Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table

Answer

Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes

Answer

Transactions of src_ip 10.0.0.1 that start with deny and end with allow

Question 4

Which TWO of the following are limitations of the transaction command in Splunk?

Accepted Answer

It defaults to a maximum of 1000 events per transaction.. The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.

Answer

It cannot be used inside an eval statement.

Answer

It only works with indexed fields.

Answer

It cannot correlate events from multiple sourcetypes.

Question 5

A security analyst needs to find the top 10 users with the most failed login attempts from the linux_secure sourcetype. Which SPL command is most efficient for this task?

Accepted Answer

index=main sourcetype=linux_secure "Failed password" | top limit=10 user. The `top` command in SPL is specifically designed to return the most frequent values of a field, and the `limit=10` parameter directly restricts the output to the top 10 results. This approach is more efficient than using `stats count` followed by `sort` and `head` because `top` performs the aggregation and ranking in a single operation, reducing processing overhead. The search also correctly filters for 'Failed password' events within the `linux_secure` sourcetype, ensuring only failed login attempts are considered.

Answer

index=main sourcetype=linux_secure "Failed password" | stats count by user | sort 10 -count

Answer

index=main sourcetype=linux_secure "Failed password" | stats count by user | sort -count | head 10

Answer

index=main sourcetype=linux_secure | regex _raw="Failed password" | stats count by user | top limit=10

Question 6

Which TWO statements correctly describe the behavior of the transaction command in Splunk?

Accepted Answer

It can concatenate the raw text of all events in the transaction into a single event.. The transaction command can be configured with the `mvraw` option to concatenate the raw text of all events in the transaction into a single event. This is useful when you need to preserve the full log lines of a correlated sequence, such as a multi-step user session or a series of API calls.

Answer

It is not recommended for use with large datasets because it consumes too much memory.

Answer

It merges all fields from all events into a single event, with the last event's field value taking precedence.

Answer

It automatically calculates the duration of each transaction as the difference between the first and last event timestamps.

Question 7

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. `transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 8

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 9

The search returns unexpected results, including IP addresses that are not in the expected format (e.g., '127.0.0.1' appears as '27.0.0.1'). What is the most likely cause?

Accepted Answer

The rex command extracts the first match only; some events may have multiple IPs and the first one is not the full IP.. The `rex` command, by default, extracts only the first match of a regex pattern from each event. If an event contains multiple IP addresses, `rex` captures the first occurrence, which may be truncated if the regex pattern is not anchored properly or if the IP appears in a context where leading digits are separated (e.g., '127.0.0.1' might be preceded by a character that causes the regex to match starting at '27.0.0.1'). This is a common behavior in Splunk when using `rex` without the `max_match` parameter.

Answer

The regex pattern is incorrect; it should use \b for word boundaries.

Answer

The top command is modifying the extracted ip field.

Answer

The rex command must be placed before the index search.

Question 10

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

Accepted Answer

A lookup definition must be added to transforms.conf. When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Answer

The lookup file must be uploaded via the UI instead of placed manually

Answer

The search head must be configured as a lookup server

Answer

The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory

Question 11

A search uses a subsearch to retrieve a list of user IDs, and then the main search uses IN operator to filter events. The subsearch is expected to return up to 10,000 values. What is a potential limitation and how can it be addressed?

Accepted Answer

The subsearch default limit is 10,000; to include more, use the | fields values command in the subsearch to return all values.. The default limit for results returned by a subsearch in Splunk is 10,000. When using the `IN` operator in the main search, the subsearch must provide all necessary values; if more than 10,000 values are expected, the `| fields values` command can be used in the subsearch to override this limit and return all distinct values, as it bypasses the default result count restriction.

Answer

The subsearch returns only 10,000 results by default; use | head 50000 in subsearch.

Answer

The subsearch default limit is 50,000; no change needed.

Answer

The subsearch default limit is 100,000; no change needed.

Question 12

A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?

Accepted Answer

The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.. The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D). Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.

Answer

The alert is disabled due to throttling or suppression settings.

Answer

The search uses a summary index that is not searchable by the alert system.

Answer

The time range in the saved search does not align with the alert schedule.

Question 13

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Accepted Answer

Navigate to Settings > Advanced search > Search macros and click 'New'.. Splunk provides a GUI-based method to create macros via Settings > Advanced search > Search macros, which is a standard and supported approach. Option D is correct because manually creating a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid configuration method that Splunk reads at startup to define macros.

Answer

Add a macro definition to props.conf under a [source] stanza.

Answer

Use the CLI command `splunk add macro` with the macro definition.

Answer

Edit the macros.conf file in the app's default directory.

Question 14

A large e-commerce company uses Splunk to monitor their web application. They have a query that uses the transaction command to group related events into transactions based on session ID and a 30-minute max pause. The query runs slowly and often times out. The environment has 10 indexers with 4 CPU cores each. The search is run over the last 7 days. Which of the following is the best course of action to improve performance?

Accepted Answer

Replace the transaction command with a combination of stats and streamstats commands.. The `transaction` command is resource-intensive because it groups events by a field (session ID) and a max pause, requiring significant memory and processing to correlate events across the entire search time range. Replacing it with `stats` and `streamstats` is more efficient because `stats` can aggregate events by session ID without the overhead of transaction boundaries, and `streamstats` can compute running totals or windows within each session, leveraging distributed processing across indexers. This approach reduces memory pressure and avoids the timeout issue by using streaming operations that scale better with large datasets.

Answer

Use the eval command to create a transaction ID field and then use stats to group events.

Answer

Reduce the max pause to 15 minutes to limit the number of events in each transaction.

Answer

Increase the number of indexers to 20 to distribute the load.

Question 15

Refer to the exhibit. A security analyst runs this search to group SSH login events into sessions based on a session_id that is extracted only from 'Accepted publickey' events. However, the resulting transactions contain only the 'Accepted publickey' event and none of the subsequent commands or logouts. What is the most likely cause?

Accepted Answer

The session_id field is only populated for the 'Accepted publickey' event, so other events have a different or null session_id and do not join the transaction.. The `transaction` command groups events by the `session_id` field. If `session_id` is only extracted from 'Accepted publickey' events (e.g., via a `rex` or `eval` command), subsequent commands and logout events will have a null or different `session_id`. Since `transaction` requires all events in the group to share the same `session_id` value, those other events cannot join the transaction, resulting in a transaction containing only the single 'Accepted publickey' event.

Answer

The maxpause=5m is too short, causing the transaction to close before other events occur.

Answer

The transaction command requires that all events have a non-null session_id to be grouped.

Answer

The sourcetype filter is too restrictive.