SPLK-1002 Practice Test 34 — 15 Questions

Question 1

Refer to the exhibit. What will this search return?

Accepted Answer

A time-based chart with a line for each host showing count of 404 events per time period.. The search uses `timechart` with `by host`, which produces a time-based chart where each host is a separate series (line) showing the count of events where `status=404` over each time bucket. The `count` function aggregates the number of 404 events per time period, and the `by host` clause splits the results into separate lines per host. Option B correctly describes this output.

Answer

A list of events with status 404.

Answer

A table with columns for each host and a row for each time bucket showing count of 404 errors.

Answer

A bar chart of total 404 errors per host.

Question 2

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

Accepted Answer

Remove the final search command and instead filter on closed_txn=0.. The original search includes a final search command that filters for successful logins. To see all failed login attempts that did not lead to a success, you need to capture evicted transactions (those that closed without success). The most efficient way is to remove the final search command and filter on closed_txn=0. Option A is incorrect because replacing the search with where closed_txn=0 without removing the final filter would still filter out evicted transactions. Option B is incorrect because increasing maxpause may still not capture all failures and could delay results. Option D is incorrect because removing keepevicted=true would discard the evicted transactions, which are exactly the failures you want to see.

Answer

Replace the search with | where closed_txn=0.

Answer

Increase maxpause to 30m.

Answer

Remove the keepevicted=true option.

Question 3

A search returns duplicate events for the same user. The analyst wants to keep only the first occurrence of each user based on timestamp. Which sequence of commands is best?

Accepted Answer

sort _time | dedup user. It first sorts events by timestamp in ascending order (oldest first), then applies `dedup user` to keep only the first occurrence of each user. Since `dedup` retains the first event it encounters for each field value, sorting by `_time` ensures that the earliest event for each user is kept, satisfying the requirement to keep only the first occurrence based on timestamp.

Answer

sort -_time | dedup user

Answer

dedup user

Answer

dedup user | sort _time

Question 4

A dashboard developer wants to create a single-value visualization that shows the current server status from a lookup table. Which Splunk command should be used to retrieve the lookup data in a real-time context?

Accepted Answer

lookup. The `lookup` command retrieves field values from a lookup table and can be used in a real-time context to enrich events or display current status. Unlike `inputlookup`, which loads the entire lookup table as events, `lookup` works within the search pipeline, allowing it to match against live data and return the most recent lookup values for a single-value visualization.

Answer

inputlookup

Answer

outputlookup

Answer

geostats

Question 5

A security analyst creates a timechart of login failures by source IP. The chart shows expected spikes, but the top 5 IPs account for <10% of all failures. The analyst suspects a DDoS attack using spoofed IPs. Which visualization type would BEST highlight the distribution of failures across all IPs?

Accepted Answer

Treemap. A treemap is the best choice because it uses nested rectangles to represent the proportional contribution of each source IP to the total login failures, making it easy to visually identify the distribution across all IPs, even when no single IP dominates. Unlike other chart types, a treemap can efficiently display hundreds of IPs without cluttering the view, which is critical when the top 5 IPs account for less than 10% of failures, indicating a highly distributed attack pattern.

Answer

Pie chart

Answer

Scatter plot

Answer

Stacked column chart

Question 6

An analyst wants to find the top 5 users who have the highest total bytes transferred. The data has fields 'user' and 'bytes'. Which search should be used?

Accepted Answer

| stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5. It uses `stats sum(bytes) as total_bytes by user` to aggregate the total bytes transferred per user, then sorts the results in descending order with `sort - total_bytes`, and finally limits the output to the top 5 users with `head 5`. This directly answers the requirement for the highest total bytes transferred.

Answer

| stats max(bytes) as max_bytes by user | sort - max_bytes | head 5

Answer

| sort - bytes | head 5 | table user, bytes

Answer

| top limit=5 user

Question 7

A Splunk administrator notices that a `transaction` command used for correlating VPN login and logout events is consuming excessive memory and causing search timeouts. The transaction groups events by `user` with `maxspan=12h` and `maxpause=30m`. The VPN logs contain millions of events per day. Which design change would most effectively reduce resource consumption while maintaining the ability to correlate logins and logouts within the same session?

Accepted Answer

Replace the transaction command with a stats command using earliest and latest functions on the event type.. Replacing `transaction` with `stats` using `earliest` and `latest` eliminates the in-memory event buffering that causes memory exhaustion. `transaction` holds all events in memory until the transaction boundary (maxspan/maxpause) is reached, which is extremely expensive for millions of VPN events. `stats` processes events in a streaming fashion, computing the first and last timestamps per user without storing the full event list, drastically reducing memory and avoiding timeouts.

Answer

Remove the maxpause option from the transaction command to simplify grouping.

Answer

Reduce maxspan to 4h to limit the time window for grouping events.

Answer

Add maxevents=2 to the transaction command to limit each transaction to exactly two events.

Question 8

Order the steps to create a workflow action in Splunk.

Accepted Answer

Navigate to Settings > Fields > Workflow actions, click New, specify Label, Action type, and URI with field references, then click Save.. Workflow actions are created by specifying a label, action type, and URI with field references.

Answer

Click New, then navigate to Settings > Fields > Workflow actions, specify Label, Action type, and URI with field references, then click Save.

Answer

Navigate to Settings > Fields > Workflow actions, specify Label, Action type, and URI with field references, then click New, then click Save.

Answer

Navigate to Settings > Fields > Workflow actions, click New, click Save, then specify Label, Action type, and URI with field references.

Question 9

Match each Splunk license violation type to its consequence.

Accepted Answer

Warning: Splunk continues to function normally but license warnings appear in the Monitoring Console.. Splunk license violations have two states: Warning (grace period with alerts) and Violation (search restricted for non-admins). Common mistakes include confusing the two or expecting immediate indexing stoppage.

Answer

Warning: Search is disabled for all users until license is renewed.

Answer

Violation: Splunk continues to function normally with no visible changes.

Answer

Warning: Indexing stops and all data ingestion is paused.

Answer

Violation: License warnings appear only in the Monitoring Console, no other impact.

Question 10

Match each Splunk search mode to its behavior.

Accepted Answer

Fast: Optimized for speed and returns only aggregate data.. Search modes control Splunk's behavior: Fast for speed (summary data), Verbose for completeness (all data), Smart as default balance. Common confusions involve swapping these definitions.

Answer

Fast: Returns all fields and all events.

Answer

Verbose: Optimized for speed.

Answer

Smart: Returns only summary data.

Question 11

Match each Splunk search operator to its behavior.

Accepted Answer

AND: Returns results that match both terms. The correct matches are: AND combines with both, OR with either, NOT excludes. Common confusion is swapping AND and OR.

Answer

AND: Returns results that match either term

Answer

OR: Returns results that match both terms

Question 12

An analyst needs to add a field called 'Region' to events based on a lookup table that maps 'StoreID' to 'Region'. The lookup table is defined in transforms.conf as a CSV lookup. Which command should be used in the search to perform this enrichment?

Accepted Answer

lookup. The lookup command enriches events with fields from a lookup table. inputlookp reads a lookup as results, outputlookp writes events to a lookup, others are irrelevant.

Answer

inputlookp

Answer

outputlookp

Answer

table

Question 13

Which two methods can reduce the resource consumption of a large CSV lookup in Splunk? (Choose 2)

Accepted Answer

Use the lookup command to only return required fields. Using the `lookup` command with a field list (e.g., `| lookup mylookup.csv field1 OUTPUT field2 field3`) reduces resource consumption by only loading the specified output fields into memory, rather than the entire CSV lookup. This minimizes memory usage and I/O overhead, especially for large CSV files with many columns.

Answer

Convert the CSV to a gzip file and reference it

Answer

Increase the max_match parameter

Answer

Use a time-based lookup to limit matches by time

Question 14

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

Accepted Answer

`transaction session_id maxspan=30m`. The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. However, `transaction` does not automatically require events from both sourcetypes; grouping is based solely on the session_id field. To ensure each transaction contains at least one event from both `web_access` and `app_log`, you would need to add a subsequent filter, such as `| where mvcount(sourcetype) > 1`. Nevertheless, option B is the correct construct because it groups events by session_id within the time window, and the additional requirement can be applied afterward. The other options fail to enforce the 30-minute window or the presence of both sourcetypes.

Answer

`append [search sourcetype=app_log]` then sort by session_id

Answer

`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`

Answer

`join type=inner session_id [search sourcetype=app_log]` after a search on web_access

Question 15

An administrator is designing a dashboard with multiple panels that share a common time picker. Which THREE dashboard features can be used to synchronize time across panels?

Accepted Answer

Use the $time_token$ variable in panel searches. Using a single time input with a token, referencing the token in panel searches, and using earliest/latest fields with the token are standard methods. Setting each panel independently does not synchronize, and 'link time' is not a standard feature.

Answer

Use the 'link time' option in dashboard editor

Answer

Set each panel's time range independently