SPLK-1002 Practice Test 35 — 15 Questions

Question 1

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Accepted Answer

Use the timechart command with a split-by field. To create a stacked bar chart over time, you need to use timechart with a split-by field to get time series and then set the stack mode to stacked in visualization options. Chart command does not inherently produce time series, and eval is not needed. Line chart is not stacked bar.

Answer

Use the eval command to create a new field

Answer

Use the chart command with a split-by field

Answer

Select the 'line' chart type

Question 2

An analyst needs to create a visualization that shows the relationship between source IP and destination port in network traffic. Which visualization type is most appropriate?

Accepted Answer

Sankey diagram. A Sankey diagram is designed to show flow relationships between sources and destinations. Choropleth maps are geographic, single values show one number, and column charts are for comparisons.

Answer

Choropleth map

Answer

Single value

Answer

Column chart

Question 3

A dashboard developer wants to display the count of errors over the last 24 hours with a line chart. Which search command should be the final command before the visualization?

Accepted Answer

timechart. timechart automatically creates a time-based chart suitable for line chart visualization without additional formatting.

Answer

chart

Answer

trendline

Answer

stats

Question 4

A SOC analyst is investigating a security incident. They use `transaction src_ip` to group firewall events. The search returns too many single-event transactions. The analyst suspects that some events should be grouped but are not because the IP address is used by different sessions. Which option can help ensure events are grouped only if they occur close in time?

Accepted Answer

maxpause=5m. The maxpause option sets the maximum time gap allowed between consecutive events in a transaction. Using a short maxpause helps ensure that events from different sessions are not incorrectly grouped.

Answer

maxspan=1h

Answer

maxevents=2

Answer

fields=src_ip

Question 5

A Splunk admin is tasked with creating a dashboard that shows the average response time per server over the last hour, updated every 60 seconds. The data comes from a sourcetype 'app_log' with fields: server, response_time. The admin wants to use a single search with a timechart and set the dashboard's time range picker to 'Last 60 minutes'. However, the chart shows only one data point (the average for the entire hour) instead of per-minute intervals. What is the most likely cause and solution?

Accepted Answer

The timechart command does not have a span specified; add | timechart span=1m avg(response_time) by server. The `timechart` command without an explicit `span` defaults to a single bucket for the entire search time range when the range is fixed (e.g., 'Last 60 minutes'). By adding `span=1m`, you force the command to create 1-minute buckets, producing a data point per minute. This is the most direct fix for the described behavior.

Answer

The dashboard uses a summary index; switch to a base search

Answer

The search is not set to real-time; change to a real-time search

Answer

The dashboard time range picker is set to 'All time'; change to 'Last 60 minutes'

Question 6

A user wants to see a single consolidated event for each user session that includes the start time, end time, and total duration. The session events have a 'action' field with values 'start' and 'end' and a common 'user_id'. Which transaction command would achieve this?

Accepted Answer

`transaction user_id startswith=action=start endswith=action=end`. Using startswith and endswith defines the boundary events, and transaction automatically calculates duration when there are start and end events.

Answer

`transaction startswith=action=start endswith=action=end`

Answer

`transaction user_id`

Answer

`stats values(action) by user_id`

Question 7

A security team needs to group all login events from the same user session. Events include 'login' and 'logout' with a common session_id field. Which command should be used to combine these events into a single event per session?

Accepted Answer

transaction session_id. The `transaction` command is designed to group related events based on common fields and time constraints, making it ideal for combining login and logout events by session_id.

Answer

join session_id

Answer

stats by session_id

Answer

append session_id

Question 8

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

Accepted Answer

`| transaction session_id maxspan=30m | search status=failure`. After transaction, you can use `where` with a subsearch or use `search` to filter based on fields within the transaction. Specifically, `search` can be used after transaction to filter events that contain a certain field-value pair.

Answer

`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`

Answer

`| transaction session_id maxspan=30m | where status=failure`

Answer

`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`

Question 9

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

Accepted Answer

index=main | transaction user_id maxpause=15m | stats avg(duration). The transaction command with maxpause=15m groups events by user_id and adds a duration field. The stats command then calculates the average duration.

Answer

index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

Answer

index=main | transaction user_id maxpause=15 | stats avg(_time)

Answer

index=main | transaction user_id maxspan=15m | stats avg(duration)

Question 10

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

Accepted Answer

The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.. Since maxpause=5m is specified, the transaction closed 5 minutes after the last event (10:03:00) at approximately 10:08:00, but because maxspan is 10m, the 2-minute duration is well under that. The close was due to the inactivity timeout.

Answer

The transaction closed because there were only 4 events.

Answer

The transaction closed because the maxopentxn limit was reached.

Answer

The maxspan of 10 minutes was reached.

Question 11

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

Accepted Answer

transaction automatically sorts by time. `transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed. Option D (timeordered) is not a valid option.

Answer

sort=_time

Answer

Use option `timeordered=true`

Answer

No sorting needed; events are indexed in order

Question 12

A security analyst runs `index=network sourcetype=firewall | stats count by src_ip | sort - count | head 10` to find the top 10 source IPs by event count. The search returns only 5 results. Which of the following is the most likely reason?

Accepted Answer

There are fewer than 10 unique source IPs in the results.. The `stats count by src_ip` command groups events by each unique source IP address and counts them. If the search returns only 5 results, it means there are only 5 unique source IPs in the dataset matching the time range and filters. The `head 10` command then limits output to 10 rows, but since only 5 groups exist, only 5 rows are returned.

Answer

The search time range is too short, so only a few events are counted.

Answer

The sort command should be `sort - count` without space.

Answer

The stats command should include a by clause with count in the field list.

Question 13

GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count > 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count > 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count>5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?

Accepted Answer

The macro 'get_failed_users' is not defined in the same app context as the saved search.. Macros are resolved in the context of the app where the saved search is defined. If the macro 'get_failed_users' is not defined in the same app context as the 'Brute Force Detection' saved search, the subsearch will fail to resolve the macro and return no results, even though the macro works when run manually in a different app context. Splunk's macro resolution depends on the app context of the search, not the user's current app.

Answer

The subsearch is not part of the data model acceleration and is limited by the time range of the main search.

Answer

The subsearch uses a macro, and macros cannot be used in subsearches.

Answer

The macro definition has a typo in the search command.

Question 14

A Splunk admin notices that a scheduled search using inputlookup is returning inconsistent results. The lookup file is stored on the search head and is updated via a script every 15 minutes. What is the most likely cause of the inconsistency?

Accepted Answer

The lookup file is cached and not automatically refreshed. The most likely cause is that the lookup file is cached by Splunk after the first read, and subsequent updates via the script do not automatically refresh the in-memory cache. By default, Splunk caches lookup files on the search head to improve performance, and changes to the file are not reflected until the cache expires or is manually cleared. This leads to inconsistent results when the scheduled search runs against a stale cached version.

Answer

The search head is not configured as a lookup server

Answer

The lookup file contains duplicate entries with different timestamps

Answer

The lookup file exceeds the maximum file size

Question 15

Refer to the exhibit. What does the final result represent?

Accepted Answer

Hours where any user's logon count is more than double the average for that hour.. The `eventstats` command calculates a per-hour average logon count across all users. The `where` clause then filters for events where a specific user's logon count for that hour is more than double that hourly average. This directly matches option C: hours where any user's logon count exceeds twice the average for that hour.

Answer

Users who log on more than twice on average.

Answer

Hours where the total logon count is more than double the average.

Answer

Users who have a logon count greater than twice their personal average.