SPLK-1002 Practice Test 32 — 15 Questions

Question 1

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Accepted Answer

Use the 'fields' command to limit fields before transaction.. Options A and C are correct. Using the 'fields' command before 'transaction' limits the data to only relevant fields, reducing memory and processing overhead. Option C is correct because the 'stats' command with functions like values() and range() can often replace 'transaction' for event correlation, avoiding the resource-intensive transaction command. Option B is incorrect because 'keepevicted' is used to retain evicted transactions but does not free memory or optimize performance. Option D is incorrect because using the 'local' parameter restricts processing to a single indexer, which can actually harm performance by eliminating parallelism. Option E is incorrect because increasing 'maxspan' expands the time window, potentially increasing the number of events per transaction and worsening performance.

Answer

Use the 'keepevicted' option to free memory.

Answer

Use the 'local' parameter to process on a single indexer.

Answer

Increase the maxspan value to reduce the number of transactions.

Question 2

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

Accepted Answer

The 'like' function requires a wildcard pattern with '%' but the field value may have leading/trailing spaces or the pattern is case-sensitive.. The 'like' function in Splunk uses SQL-style pattern matching where '%' matches any sequence of characters. If the lookup file contains 'admin1' and 'admin2', but the search uses 'like(role, "admin%")', leading/trailing spaces in the field values or case sensitivity (e.g., 'Admin1' vs 'admin1') would cause the pattern to fail, returning zero results. Option B correctly identifies this as the most likely reason because Splunk's 'like' is case-sensitive by default and does not trim spaces.

Answer

The lookup file is not in CSV format.

Answer

The stats command only counts events where role=admin, but the role field is already filtered.

Answer

The search command runs before the eval command.

Question 3

Which command adds the overall average of a field to each event in the results?

Accepted Answer

eventstats avg(latency) as avg_latency. The `eventstats` command computes aggregate statistics (like `avg(latency)`) over the entire result set and adds the result as a new field to every event, preserving all original events. This matches the requirement to add the overall average to each event. In contrast, `stats` collapses events into a single summary row, `streamstats` computes a running average per event, and `timechart` produces a time-based chart, none of which add the overall average to every original event.

Answer

streamstats avg(latency) as avg_latency

Answer

timechart avg(latency) as avg_latency

Answer

stats avg(latency) as avg_latency

Question 4

A search `index=main | eval weekday=strftime(_time,"%A") | stats count by weekday | sort - count` shows that Monday has the highest count. However, the user suspects that Monday data is double-counted due to timezone offset. What should be done to investigate?

Accepted Answer

Use `date_wday` field which is based on the local time by default if configured.. The `date_wday` field is automatically computed based on the local timezone defined in the Splunk configuration, so it reflects the correct day of the week in the user's timezone, avoiding issues with UTC-based `_time`. Option B is wrong because `strftime(_time,"%w")` returns the day of the week as a number (0=Sunday, 6=Saturday), which still depends on UTC `_time` and does not solve the timezone issue. Option C is not the most straightforward approach because manually specifying a timezone with `convert` requires knowing the correct timezone for each event, which is not practical. Option D is wrong because adding a fixed offset does not account for daylight saving time or varying timezones across events.

Answer

Use `strftime(_time,"%w")` instead of %A to avoid string comparison issues.

Answer

Apply `| convert timeformat="%A" tz=US/Mountain _time as weekday` to adjust timezone.

Answer

Use `eval weekday=strftime(_time + timezone_offset, "%A")` with a fixed offset.

Question 5

You are a Splunk power user working for a healthcare organization. You have created a visualization that shows patient wait times by department over the last 30 days. The chart uses a timechart command with a 'stacked' option. Recently, the chart started showing negative values for some departments, which is impossible because wait times cannot be negative. You have verified that the raw data is correct and contains only positive wait times. The search is: index=healthcare sourcetype=patient_wait | timechart span=1d avg(wait_time) by department. The chart is displayed as a stacked area chart. The negative values appear only for a few departments sporadically. You suspect the issue is related to how null values are handled. What could be causing the negative values?

Accepted Answer

The 'stacked' option is misinterpreting null values as negative.. In stacked area charts, when there are null values (missing data points), the stacking algorithm can misinterpret them as negative values, causing the chart to show negative areas. This is a known behavior in Splunk's stacked area visualization. Option A is wrong because 'limit=0' in timechart controls the maximum number of series displayed, not the handling of null values. Option B is wrong because overlapping time ranges from indexing delays would cause duplication, not negative values. Option C is wrong because the 'other' category aggregates low-value series and does not cause negative values; it is unrelated to null value misinterpretation.

Answer

The timechart command is using 'limit=0' which causes overcounting of series.

Answer

There is a counting error in the search due to overlapping time ranges from data indexing delays.

Answer

The use of 'other' category in stacked charts can cause negative values when there are many series.

Question 6

Arrange the steps to create a knowledge object of type 'Event Type' in Splunk.

Accepted Answer

Run a search that returns the desired events, then click 'Save As' and select 'Event Type', then enter a name and save.. Event types are created by defining a search string that matches events, then saving with a name.

Answer

Run a search that returns the desired events, then enter a name for the event type, then click 'Save As' and select 'Event Type'.

Answer

Click 'Save As' and select 'Event Type', then run a search that returns the desired events, then enter a name and save.

Answer

Enter a name for the event type, then click 'Save As' and select 'Event Type', then run a search that returns the desired events.

Question 7

Which SPL command can be used to create a new field based on a conditional evaluation, such as setting a status field to 'critical' if a numeric threshold is exceeded?

Accepted Answer

| eval status=if(value>100,"critical","normal"). The `eval` command in SPL is used to create new fields or modify existing ones by evaluating expressions. The `if()` function within `eval` allows conditional logic, making `| eval status=if(value>100,"critical","normal")` the correct syntax to create a new field 'status' that is set to 'critical' when the numeric field 'value' exceeds 100, and 'normal' otherwise.

Answer

| makemv

Answer

| rex field=_raw

Answer

| convert status=if(value>100,"critical","normal")

Question 8

A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?

Accepted Answer

maxpause=1800. (maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.

Answer

startswith=login endswith=logout

Answer

mvlist=session_id

Answer

maxspan=30m

Question 9

A team wants to create a custom visualization that requires JavaScript and CSS modifications. Which Splunk feature should be used?

Accepted Answer

Custom visualization framework. The Custom Visualization Framework (option D) is the correct choice because it is the only Splunk feature that allows developers to create entirely new visualizations using JavaScript and CSS. This framework provides the necessary APIs and hooks to register custom visualization types that can then be used in dashboards, whereas the other options either restrict customization or do not support custom JavaScript/CSS modifications.

Answer

Splunk Web Framework

Answer

Simple XML dashboard

Answer

Dashboard studio

Question 10

Which THREE of the following commands can produce a time-based chart (timechart or chart with time buckets)? (Choose three.)

Accepted Answer

`chart count over _time bins=24`. The `chart` command with `over _time bins=24` explicitly creates a time-based chart by splitting the time range into 24 equal bins, each representing a time bucket, and then counts events per bucket. This produces a chart that can be visualized over time, similar to a timechart.

Answer

`stats count by _time span=1h`

Answer

`top _time`

Question 11

The admin calls the macro as shown. What will be the expanded search string?

Accepted Answer

search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total. Macro arguments are substituted: $index$ becomes 'main', $time_range$ becomes '-1h'. The brackets define the search inside. Option B incorrectly concatenates. Option C uses single quotes. Option D swaps order.

Answer

search index='main' earliest='-1h' latest=now | stats count by sourcetype | rename count as total

Answer

search index=-1h earliest=main latest=now | stats count by sourcetype | rename count as total

Answer

search index=main|earliest=-1h latest=now | stats count by sourcetype | rename count as total

Question 12

Match each Splunk knowledge object to its purpose.

Accepted Answer

Event types: Categorize events based on search criteria.. Knowledge objects in Splunk help organize and enrich data. Event types group events by criteria, Tags label field values, Lookups add external data, and Macros store reusable search fragments. Common confusions arise between these similar but distinct objects.

Answer

Event types: Add descriptive keywords to field values.

Answer

Tags: Categorize events based on search criteria.

Answer

Lookups: Reusable search fragments.

Question 13

A search administrator wants to ensure that a scheduled search runs efficiently and does not impact other users. Which TWO practices should be implemented? (Select two.)

Accepted Answer

Set the 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range. Setting 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range limits the data scanned by the scheduled search, reducing resource consumption and preventing it from impacting other users. Option D is correct because enabling 'auto_summarize' on the search creates pre-computed summary tables that allow the scheduled search to run against summarized data rather than raw events, drastically improving efficiency and reducing system load.

Answer

Use the 'max_time' setting in the search command

Answer

Use 'collect' to index summary results

Answer

Use the 'priority' setting in savedsearches.conf

Question 14

A security analyst is trying to normalize authentication data from multiple sources using CIM. After mapping sourcetypes to the Authentication data model, the CIM acceleration dashboard shows no data. The data model acceleration is enabled and has completed building. What is the most likely cause?

Accepted Answer

The field extractions for the sourcetypes do not align with CIM field names.. The CIM data model relies on field extractions that match the CIM field names exactly. If the field extractions for the sourcetypes do not align with CIM field names, the data model will not populate with data, even if acceleration is enabled and completed. Tags (option B) are not required if sourcetypes are mapped appropriately; permissions (option D) affect visibility, not data population; and acceleration being enabled (option A) is stated as true.

Answer

The data model acceleration is not enabled.

Answer

The tags for the sourcetypes are not correctly assigned to the data model.

Answer

The permissions on the data model are incorrect.

Question 15

An organization has implemented the Splunk Common Information Model (CIM) for their security data. They have mapped several sourcetypes to the Authentication data model and enabled data model acceleration. However, the CIM dashboard shows no data even though searches against the raw data return results. The admin checks the data model acceleration settings and sees that the acceleration is enabled and has completed building. What is the most likely issue?

Accepted Answer

The field extractions for the sourcetypes do not align with CIM field names.. The Splunk Common Information Model (CIM) relies on field name alignment between the data and the CIM data model. If the field extractions for the sourcetypes do not produce the exact field names expected by the Authentication data model (e.g., 'user', 'action', 'src_ip'), the data model will not populate. Option B is incorrect because data model acceleration includes all indexes by default unless explicitly excluded. Option C is incorrect because permissions affect who can see the data model, not whether it populates with data. Option D is incorrect because tags are optional when sourcetypes are mapped directly via props.conf; CIM data models can use sourcetype mapping without tags.

Answer

The index where the data is stored is not included in the data model acceleration.

Answer

The data model has not been assigned the correct permissions.

Answer

The tags for the sourcetypes are not correctly assigned to the data model.