SPLK-1003 Practice Test 36 — 15 Questions

Question 1

You are a Splunk power user working for a healthcare organization. You have created a visualization that shows patient wait times by department over the last 30 days. The chart uses a timechart command with a 'stacked' option. Recently, the chart started showing negative values for some departments, which is impossible because wait times cannot be negative. You have verified that the raw data is correct and contains only positive wait times. The search is: index=healthcare sourcetype=patient_wait | timechart span=1d avg(wait_time) by department. The chart is displayed as a stacked area chart. The negative values appear only for a few departments sporadically. You suspect the issue is related to how null values are handled. What could be causing the negative values?

Accepted Answer

The 'stacked' option is misinterpreting null values as negative.. Option C is correct because stacked area charts can misrepresent null values as negative when there are gaps in data. Option A is wrong because timechart limit=0 does not cause negatives. Option B is wrong because overlapping time ranges would affect counts, not produce negatives. Option D is wrong because 'other' category does not cause negatives.

Answer

The timechart command is using 'limit=0' which causes overcounting of series.

Answer

There is a counting error in the search due to overlapping time ranges from data indexing delays.

Answer

The use of 'other' category in stacked charts can cause negative values when there are many series.

Question 2

A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?

Accepted Answer

The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.. Option A is correct: The alert condition is likely 'number of results > 5', but the search returns a single result with a count field. The condition should evaluate the count field value, not the number of results. Summary index not searchable by alerts is unlikely. Time range misalignment would cause mismatch but the admin confirmed counts. Throttling only applies after a trigger.

Answer

The alert is disabled due to throttling or suppression settings.

Answer

The search uses a summary index that is not searchable by the alert system.

Answer

The time range in the saved search does not align with the alert schedule.

Question 3

A Splunk admin is tasked with creating a set of macros that will be used by multiple app developers to standardize searches across the organization. The macros need to accept parameters such as index, sourcetype, and time range. Some macros will be complex and include subsearches. Which approach should the admin take to ensure maximum reusability and maintainability?

Accepted Answer

Use macro arguments with default values and include comments in the definition.. Option C is correct: Using macro arguments with default values and comments provides flexibility and clarity. Defining macros without arguments forces users to edit for each use. Separate macros for each parameter combination create unnecessary duplication. A single macro with conditionals becomes complex and hard to maintain.

Answer

Create separate macros for each combination of parameters.

Answer

Embed all logic into a single macro and use conditional statements.

Answer

Define macros with no arguments and rely on the developers to modify the macro code.

Question 4

A team wants to create a dashboard that displays daily user activity over the past 30 days. The underlying data is voluminous (hundreds of millions of events per day). They need the dashboard to load quickly. The admin considers two options: using a summary index with a scheduled search to pre-compute the daily counts, or using data model acceleration on a CIM data model. Which approach is most appropriate for this specific requirement?

Accepted Answer

Use a summary index because it allows custom summarization and reduces license usage.. Option A is correct: A summary index pre-computes exactly the needed daily counts, reducing search time and license usage. Data model acceleration still queries the full dataset and may be less efficient for custom aggregation. Using both adds complexity. Report acceleration on the dashboard search still queries the full data.

Answer

Use data model acceleration because it automatically updates and is easier to set up.

Answer

Use neither; instead, use report acceleration on the dashboard search.

Answer

Use both to ensure data availability.

Question 5

A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is:

```
[build_network_summary]
definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary
args = sourcetype, time_range
iseval = 0
```

The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

Accepted Answer

Modify the macro definition to enclose the `$sourcetype$` argument in quotation marks: `sourcetype="$sourcetype$"`. Option A is correct: the hyphens in sourcetype names are being interpreted as subtraction operators or search syntax modifiers because the macro argument is not quoted. Option B would increase load but not fix the parsing. Option C addresses time range, not sourcetype. Option D is unrelated.

Answer

Increase the summary index range to cover all sourcetypes in one pass rather than iterating.

Answer

Change the macro's time_range argument to use a static time range to avoid relative time issues.

Answer

Enable acceleration on the network_summary index to improve data completeness.

Question 6

An organization has implemented the Splunk Common Information Model (CIM) for their security data. They have mapped several sourcetypes to the Authentication data model and enabled data model acceleration. However, the CIM dashboard shows no data even though searches against the raw data return results. The admin checks the data model acceleration settings and sees that the acceleration is enabled and has completed building. What is the most likely issue?

Accepted Answer

The field extractions for the sourcetypes do not align with CIM field names.. Option D is correct because CIM requires exact field name matches; if extractions are not aligned, the data model will not populate. Permissions affect visibility, not data. Tags are optional when sourcetypes are mapped via props. The index is searched by acceleration unless explicitly excluded.

Answer

The index where the data is stored is not included in the data model acceleration.

Answer

The data model has not been assigned the correct permissions.

Answer

The tags for the sourcetypes are not correctly assigned to the data model.

Question 7

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

Accepted Answer

Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions. The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Answer

Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results

Answer

Keep the current search but increase maxspan to 30m

Answer

Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`

Question 8

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

Accepted Answer

Use `transaction user_id maxspan=5m maxevents=100`. Using `transaction user_id maxevents=100 maxspan=5m` limits the size of each transaction, preventing the large transactions. Alternatively, pre-filtering to remove noisy accounts can help, but limiting maxevents is more robust. Option C is the most direct fix.

Answer

Set `maxpause=1m` to break large transactions by gaps

Answer

Exclude service accounts using `where user_id!="svc*"` before transaction

Answer

Switch to `stats values(_raw) by user_id` to avoid transaction overhead

Question 9

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

Accepted Answer

Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.. Option B is correct because adding keepevicted=true will output incomplete transactions (those missing the logout event) as evicted transactions, allowing the analyst to see all sessions, including those where the logout was not recorded. Option A (maxevents=100) may still miss sessions if they don't have a logout. Option C (stats with bucket) does not properly group events into sessions. Option D (removing startswith/endswith) would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately.

Answer

Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.

Answer

Change to `transaction user maxspan=8h` and remove startswith/endswith.

Answer

Use `transaction user maxspan=8h maxevents=100` and filter manually.

Question 10

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

Accepted Answer

Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately. Option B is correct because reducing maxevents to a lower value (e.g., 10) will prematurely close transactions with excessive events, causing missing data. Option A (increasing maxevents) may worsen performance. Option C (removing maxpause) could cause transactions to stay open longer, not fix missing orders. Option D (using stats) is a common recommendation to replace transaction with a more efficient approach; stats with list() can group fields without holding open transactions, improving performance and avoiding evictions. However, note that missing orders are due to maxevents being reached; stats would not have that limitation and is more efficient. But the question says 'best address missing orders and performance issues.' Option D (replace transaction with stats) is the best long-term solution. Option A would still risk evictions if orders have more than 50 events, and it increases memory. Option B would worsen the problem. Option C doesn't address the root cause. So D is correct.

Answer

Increase maxevents to 200 and increase search timeout

Answer

Remove maxpause and set maxspan to 60m

Answer

Reduce maxevents to 10 to limit resource usage

Question 11

A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?

Accepted Answer

Use `transaction transaction_id maxevents=2 maxspan=30s`.. Option B is correct because setting maxevents=2 limits each transaction to exactly two events (request and response), preventing large groupings that cause memory issues and timeouts. Option A (stats values) does not maintain event order and may not clearly separate request/response. Option C (smaller time range) is already implied by the maxspan. Option D (rename) does not address the performance issue.

Answer

Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.

Answer

Use `stats values(*) as * by transaction_id` and then filter.

Answer

Use `rename component to type` and then use `transaction`.

Question 12

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

Accepted Answer

Remove endswith and add maxspan=30m. To include incomplete sessions, use `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m` without endswith. This will create a transaction starting with session_start and ending after maxspan or if another start event is encountered.

Answer

Add `maxspan=30m` and keep endswith

Answer

Change startswith to `action=session_start OR action=session_end`

Answer

Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith

Question 13

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

Accepted Answer

Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.. Option C is correct because using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of transaction. Option A (increase maxspan to 24h) would still break on multiple purchases and increase memory usage. Option B (group by user_id) loses session distinction and may merge separate sessions. Option D (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window.

Answer

Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.

Answer

Increase maxspan to 24h to capture all potential purchases.

Answer

Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.

Question 14

A security operations center (SOC) uses Splunk to correlate alerts from multiple sources. They have a rule that triggers a transaction when an IDS alert is followed within 5 minutes by a firewall deny event from the same source IP. The search is: `index=security sourcetype=ids OR sourcetype=firewall | transaction src_ip startswith="ids" endswith="firewall" maxspan=5m`. This works well when the deny event occurs after the alert. However, analysts are missing correlations where the firewall deny event occurs slightly before the IDS alert (up to 1 minute before). To capture these out-of-order events without significantly increasing resource usage, what should the analyst do?

Accepted Answer

Increase maxspan to 6 minutes and add `maxevents=2`.. Option A is correct because increasing maxspan to 6 minutes (5m + 1m buffer) and adding maxevents=2 ensures the transaction captures the pair even if the deny event comes up to 1 minute early, while limiting to exactly two events prevents large groupings. Option B (no startswith/endswith) would merge all events from the same src_ip within 6 minutes, potentially including unrelated events. Option C (reverse) does not help because transaction already sorts by time. Option D (eventstats) does not create a transaction.

Answer

Use `reverse` before transaction to process events in reverse time order.

Answer

Use `sort` with time dimension and then use `eventstats` to mark pairs.

Answer

Use `transaction src_ip maxspan=6m` without startswith/endswith and then filter for events with both sourcetypes.

Question 15

A company's security team uses Splunk to monitor firewall logs. They have a lookup file named 'threat_intel.csv' containing 10,000 IP addresses classified by threat level. The lookup is used in a dashboard that shows the number of blocked connections from high-threat IPs over the past 24 hours. Recently, the dashboard has become slow, taking over 30 seconds to load. The lookup file is updated every 15 minutes via a script that replaces the entire file. The search currently uses: `index=firewall | lookup threat_intel.csv src_ip OUTPUT threat_level | where threat_level="high" | stats count`. Which of the following is the MOST efficient way to improve dashboard performance?

Accepted Answer

Convert the lookup to a KV store collection with an index on src_ip.. Option C is correct because converting the lookup to a KV Store collection with an index on `src_ip` allows Splunk to perform efficient key-value lookups without loading the entire 10,000-row CSV into memory on every search. The KV Store uses an indexed data structure, which dramatically reduces lookup time compared to a file-based lookup that must be fully scanned each time, especially when the file is replaced every 15 minutes and the search runs over a 24-hour window.

Answer

Restrict the search to a smaller time range, such as the last hour.

Answer

Use the lookup with local=t to force it to run on the search head only.

Answer

Increase the lookup cache size in limits.conf.