SPLK-1002 Practice Test 33 — 15 Questions

Question 1

Which command returns the list of all sourcetypes in a specific index?

Accepted Answer

| metadata type=sourcetypes index=main. The `| metadata` command with `type=sourcetypes` retrieves a list of all sourcetypes present in a specified index, along with their earliest and latest timestamps. This command queries the index metadata directly, making it the appropriate tool for listing sourcetypes within a given index.

Answer

| sourcetype count index=main

Answer

| eventtype count index=main

Answer

| metasearch index=main sourcetype=*

Question 2

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

Accepted Answer

Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately. The `transaction` command is resource-intensive and can cause timeouts and missing data when `maxevents` is exceeded. Increasing `maxevents` (A) would worsen performance. Removing `maxpause` and increasing `maxspan` (B) does not address the `maxevents` limit and may keep transactions open longer. Reducing `maxevents` (C) would exacerbate missing orders. Replacing `transaction` with `stats ... list() by order_id` groups fields without holding open transactions, avoiding the `maxevents` constraint and reducing resource usage, thus addressing both missing orders and performance issues.

Answer

Increase maxevents to 200 and increase search timeout

Answer

Remove maxpause and set maxspan to 60m

Answer

Reduce maxevents to 10 to limit resource usage

Question 3

A security operations center (SOC) uses Splunk to correlate alerts from multiple sources. They have a rule that triggers a transaction when an IDS alert is followed within 5 minutes by a firewall deny event from the same source IP. The search is: `index=security sourcetype=ids OR sourcetype=firewall | transaction src_ip startswith="ids" endswith="firewall" maxspan=5m`. This works well when the deny event occurs after the alert. However, analysts are missing correlations where the firewall deny event occurs slightly before the IDS alert (up to 1 minute before). To capture these out-of-order events without significantly increasing resource usage, what should the analyst do?

Accepted Answer

Use `transaction src_ip maxspan=6m` without startswith/endswith and then filter for events with both sourcetypes.. Using `transaction src_ip maxspan=6m` without `startswith` and `endswith` groups all events from the same source IP within 6 minutes. This captures the pair regardless of order (IDS alert before firewall or firewall before IDS). A subsequent filter for events with both sourcetypes isolates the desired pair. This approach does not significantly increase resource usage because the `maxspan` limits the time window. Option B fails because `transaction` still requires the `startswith` event to occur before the `endswith` event; if the firewall deny comes first, the IDS alert is not the start, so no transaction is created. Option A (`reverse`) has no effect as `transaction` internally sorts events by time. Option C (`sort` and `eventstats`) does not group events into transactions, making it unsuitable for correlation.

Answer

Use `reverse` before transaction to process events in reverse time order.

Answer

Increase maxspan to 6 minutes and add `maxevents=2`.

Answer

Use `sort` with time dimension and then use `eventstats` to mark pairs.

Question 4

You are a Splunk administrator for a multi-site deployment with two data centers: primary and remote. Users on the remote site report that a lookup used in a dashboard returns no results for data from their site, but the same lookup works perfectly on the primary site. The lookup is defined with 'local=true' in the transforms.conf. The lookup file is stored on the primary search head. The remote site has its own search head that queries data from both sites. The dashboard search is: index=main | lookup site_mapping.csv site_id OUTPUT location | stats count by location. Users on the remote site see rows with location=null for their data. What is the most likely cause?

Accepted Answer

The lookup file is not replicated to the remote search head, so it cannot be accessed when local=true.. When 'local=true' is set in transforms.conf, the lookup is only available on the search head where the lookup file resides. Since the remote search head does not have the file, the lookup fails for data processed there, resulting in null values. Option A is incorrect because the lookup is not tied to indexers but to the search head that executes the search. Option B is incorrect because while 'local=false' would make the lookup available across search heads, the issue is that the current setting prevents access from the remote search head. Option D is incorrect because a firewall blocking access would likely cause a timeout or error, not null values, and would not be specific to a single lookup.

Answer

The lookup is configured to only run on the search head that indexes the data, which is the primary site.

Answer

The lookup definition needs 'local=false' to be available to remote search heads for distributed searches.

Answer

The remote site has a firewall blocking access to the lookup file on the primary search head.

Question 5

A security analyst notices that a timechart command is returning too many data points on the x-axis, making the chart unreadable. Which command modification should be used to reduce the number of data points?

Accepted Answer

| timechart span=1h count by host. The `timechart` command automatically bins events into time buckets based on the time range. By default, Splunk chooses a span that can result in many data points. Adding `span=1h` explicitly sets the bucket size to one hour, reducing the number of data points on the x-axis and making the chart readable.

Answer

| timechart partial=f count by host

Answer

| timechart useother=f count by host

Answer

| timechart limit=5 count by host

Question 6

The exhibit shows a search that categorizes HTTP status codes and counts them. If the search returns only three categories, what is the most likely reason?

Accepted Answer

Some categories have zero events and are not displayed by default.. The `stats` command in Splunk, by default, only returns results for categories that have at least one event. If a category (e.g., a specific HTTP status code range) has zero matching events, it will not appear in the output. This is a common behavior in aggregation commands, where null or zero-count results are suppressed unless explicitly requested with the `usenull=f` or `fillnull` options.

Answer

The stats command is filtering out events with null category.

Answer

The case function has a syntax error that truncates results.

Answer

The case statement does not cover status codes above 599.

Question 7

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

Accepted Answer

Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.. Adding keepevicted=true to the transaction command causes Splunk to output incomplete transactions (those missing the logout event) as evicted transactions. This allows the analyst to see all sessions, including those where the logout was not recorded, preventing missing data. Option A uses stats with time buckets, which does not properly group events into sessions. Option B removes startswith and endswith, so it would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately. Option D uses maxevents=100, which may still drop sessions if they have many events, and manual filtering is inefficient.

Answer

Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.

Answer

Change to `transaction user maxspan=8h` and remove startswith/endswith.

Answer

Use `transaction user maxspan=8h maxevents=100` and filter manually.

Question 8

A Splunk user wants to group web server logs into transactions representing a single user visit, where a visit starts with a 'GET' request and ends with a 'POST' request. Which transaction command syntax correctly implements this logic?

Accepted Answer

transaction startswith="GET" endswith="POST". The `transaction` command with `startswith="GET"` and `endswith="POST"` correctly groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit. Options A and D add unnecessary constraints (`maxevents=2` or `by src_ip`) that alter the intended grouping logic, and option B reverses the start and end events, which does not match the specified visit flow.

Answer

transaction startswith="GET" endswith="POST" maxevents=2

Answer

transaction startswith="POST" endswith="GET"

Answer

transaction by src_ip startswith="GET" endswith="POST"

Question 9

An analyst wants to calculate the average response time for each web server, but only for requests that returned status code 200. Which search accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(response_time) by host. It first filters events with `status=200` (only successful requests), then uses `stats avg(response_time) by host` to compute the average response time per web server. This ensures the aggregation is performed only on the relevant subset of data, matching the requirement precisely.

Answer

index=web sourcetype=access status=200 | sort host | stats avg(response_time)

Answer

index=web sourcetype=access | eval avg_time=avg(response_time) by host | where status=200

Answer

index=web sourcetype=access | stats avg(response_time) by host | search status=200

Question 10

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. A data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 11

Refer to the exhibit. The search results show a large number of hosts, but the `limit=5` only shows the top 5. The eval statement fails with an error. Why?

Accepted Answer

The field names created by timechart are based on the host names, not `count_1`, etc.. The `timechart` command in Splunk dynamically creates field names based on the values of the split-by field (in this case, `host`). When you use `timechart count by host limit=5`, the resulting fields are named after the actual host names (e.g., `host1`, `host2`), not generic names like `count_1`. The subsequent `eval` statement fails because it references `count_1`, which does not exist as a field in the results.

Answer

The timechart span should be smaller to avoid too many fields.

Answer

Eval cannot be used after timechart.

Answer

The eval statement must use aggregation functions.

Question 12

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. In Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 13

An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?

Accepted Answer

Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds. The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.

Answer

Use `append` to combine the two sourcetypes and then `search` for the pattern

Answer

Use `eventstats` to compute counts by sessionID and then filter

Answer

Use `stats` with values() and a by clause on sessionID

Question 14

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

Accepted Answer

fields user_id, _time. The 'fields' command with a positive list (without '+' or '-') sets the field list to exactly those specified, keeping only user_id and _time. This reduces memory usage significantly before the transaction command, which typically needs _time and a grouping field like user_id. Option A is incorrect because removing _raw and _time but keeping other fields does not sufficiently reduce fields; transaction requires _time. Option B is incorrect because 'fields +' adds fields to the existing set, not replacing them, so it does not reduce memory. Option C is incorrect because 'fields - * except user_id' removes all fields except user_id, but also removes _time, which is essential for the transaction command to correlate events based on time.

Answer

fields - _raw, _time

Answer

fields + user_id, _time

Answer

fields - * except user_id

Question 15

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

Accepted Answer

It closes the transaction if there is no new event from the same clientip within 5 minutes.. maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Answer

It limits the number of events in a transaction to 5.

Answer

It limits the total time span of each transaction to 5 minutes.

Answer

It pauses the search for 5 minutes between transactions.