SPLK-1002 Practice Test 4 — 10 Questions

Question 1

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 2

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. The correct method is to define a macro with arguments using backticks and $arg$ syntax (Option C). Macros are designed for reusable search components that can accept parameters. Option A (saved search with tokens) is typically used in dashboards to pass values at runtime, not for creating reusable search fragments. Option B (eval statement) defines a variable but does not create a reusable search component. Option D (lookup definition) is used for enriching events with external data, not for defining search logic.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 3

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. The correct macro definition is option B because it uses a positional argument ($1$) and does not include a leading pipe. In Splunk, macros are invoked as part of a pipe chain, so the definition should not start with a pipe. Positional arguments are standard and do not require predefined argument names, whereas named arguments must be defined in the macro properties. Option A fails because it uses a named argument ($field$) without defining it, making it invalid. Options C and D incorrectly include a leading pipe at the start of the definition, which would cause a syntax error when the macro is expanded within a pipe.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 4

Which THREE are components of the Common Information Model (CIM) in Splunk?

Accepted Answer

Tags. The three components of the Common Information Model (CIM) in Splunk are Tags (A), Data Models (B), and Field Extractions (D). Tags are used to define the CIM data model's data source types and event types. Data Models provide the framework for the CIM, defining normalized fields and relationships. Field extractions are necessary to map raw data to the CIM fields. Lookup tables (C) and dashboards (E) are not part of the CIM; they may be used in conjunction with CIM but are not core components.

Answer

Lookup tables

Answer

Dashboards

Question 5

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Accepted Answer

Provides a consistent field naming convention across different data sources.. The Splunk Common Information Model (CIM) provides two key benefits: (A) It normalizes data from different sources into a consistent field naming convention, making it easier to search across diverse data sources. (E) It supports data model acceleration, which speeds up searches using the tstats command on CIM-compliant data models. Option B is incorrect because real-time correlation is not a direct feature of CIM; CIM standardizes fields but does not perform correlation. Option C is incorrect because CIM does not reduce indexing volume; indexing is independent of CIM. Option D is incorrect because CIM does not define sourcetypes; sourcetypes are defined at input time.

Answer

Enables real-time correlation of events across multiple data sources.

Answer

Reduces indexing volume by summarizing data into CIM-compliant indexes.

Answer

Defines the sourcetypes for common technologies (e.g., firewall, IDS).

Question 6

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

Accepted Answer

timechart span=5min count. The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Answer

chart count over _time span=5min

Answer

stats count by _time span=5min

Answer

streamstats count span=5min

Question 7

A data engineer has defined a CIM data model for 'Network_Traffic'. They have also created field aliases using `| fieldaliases` to map custom fields like `src_ip` and `dest_ip` to the CIM fields. When running searches against the data model, some events do not appear. The engineer verified that the tags are correctly applied. What is the most likely remaining issue?

Accepted Answer

The field aliases must be defined within the data model itself, not via `| fieldaliases`.. Field aliases defined using the `| fieldaliases` command are applied at search time but are not recognized by data model acceleration. Data models use their own field definitions and aliases must be defined within the data model itself (via the data model editor) to be included in accelerated searches. Option B is incorrect because the time range would affect all events equally and does not explain why some events are missing specifically due to field mapping. Option C is incorrect because custom fields do not need to be indexed; they can be extracted at search time, but the issue is that the aliases are not applied within the data model. Option D is incorrect because tags are correctly applied as verified, so the problem is not tag application.

Answer

The data model search is using a time range that excludes the events.

Answer

The custom fields are not indexed, so they cannot be used in data models.

Answer

The tags are applied only to a subset of events.

Question 8

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

Accepted Answer

Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.. Creating a summary index that pre-aggregates error counts by severity every 5 minutes reduces the amount of data scanned in real-time, improving performance without changing the dashboard's output. Option A is wrong because using 'bucket' and 'stats' with streaming commands still requires scanning all raw events; it does not precompute results and may not significantly reduce I/O. Option C is wrong because limiting the time range alters the dashboard's displayed data (e.g., less historical context), which violates the requirement to keep the output unchanged. Option D is wrong because search acceleration (e.g., data model acceleration) creates summaries for specific data models, not arbitrary field aggregations; it may not target the 'severity' breakdown efficiently and can consume significant resources.

Answer

Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

Answer

Limit the time range to the last 1 hour instead of 24 hours.

Answer

Enable search acceleration for the index.

Question 9

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 10

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.