SPLK-1002 Practice Test 4 — 10 Questions

Question 1

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Accepted Answer

The maximum time gap between events in the transaction.. The maxpause parameter in the transaction command specifies the maximum time gap allowed between consecutive events in a transaction. If the time between two events exceeds maxpause, the transaction is closed and a new one begins.

Answer

The maximum number of transactions allowed.

Answer

The maximum number of events in the transaction.

Answer

The maximum total time span of the transaction.

Question 2

Which transaction option should be used to ensure that a transaction does not exceed a total duration of 10 minutes?

Accepted Answer

maxspan=10m. The maxspan option in the transaction command defines the maximum total duration of a transaction, measured from the first event to the last event. Setting maxspan=10m ensures that no transaction spans more than 10 minutes, regardless of event count or pauses. This directly satisfies the requirement to limit total transaction duration.

Answer

endswith="end"

Answer

maxpause=10m

Answer

startswith="start"

Question 3

A team develops multiple dashboards that share common search logic. What is the best practice for managing these searches?

Accepted Answer

Use macros to define reusable search fragments.. Macros allow reusable search fragments that can be used across multiple dashboards, reducing duplication and simplifying maintenance. Embedding search strings directly in each dashboard (option C) causes duplication and is hard to maintain. Creating a saved search for each dashboard (option A) still duplicates logic. Using a single saved search that all dashboards reference (option B) may not be flexible enough for different dashboard requirements. Therefore, macros are the best practice.

Answer

Create a saved search for each dashboard.

Answer

Use a single saved search that all dashboards reference.

Answer

Embed the search strings directly in each dashboard.

Question 4

Match each Splunk search command to its primary function.

Accepted Answer

eval: Evaluate expressions and assign to new fields. These are common Splunk search commands used for data manipulation and enrichment.

Answer

eval: Extract fields using regular expressions

Answer

stats: Enrich events with data from external sources

Question 5

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

Accepted Answer

Add `| where count > 100` after the stats command.. The `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Answer

Use `| top limit=100 user` to get the top 100 users.

Answer

Add `| where count > 100` before the stats command.

Answer

Use `| filter count > 100` after the stats command.

Question 6

A company needs to enrich events with lookup data that changes over time, such as daily exchange rates. Which lookup method is most appropriate?

Accepted Answer

Use a time-based lookup with a time_field parameter. A time-based lookup with a time_field parameter allows the lookup to return different values based on the event timestamp. Option A is incorrect because a KV Store lookup is not time-aware by default and would require additional logic. Option B is incorrect because a file lookup without time context cannot handle time-varying data. Option D is incorrect because index-time lookups are static and require reindexing to reflect changes.

Answer

Use a KV Store lookup with a time-range filter in the search

Answer

Use a file lookup without time context

Answer

Use an index-time lookup

Question 7

Which command creates a time-based chart showing a count of events over time?

Accepted Answer

| timechart count. `timechart count` is the correct command for a time-based chart of event count. The `timechart` command automatically buckets by `_time`, so `by _time` is unnecessary and invalid as a timechart split-by field. `chart count over _time` is not a timechart command, and `timecount` is not a valid Splunk command.

Answer

| timecount

Answer

| timechart count by _time

Answer

| chart count over _time

Question 8

A security analyst wants to correlate login events from multiple sources to identify a single user session. The data includes source IP, username, and timestamp. Which Splunk command is most appropriate to group these events into a single transaction based on a common field and a maximum time window?

Accepted Answer

transaction username maxspan=30m. The transaction command is purpose-built to group related events into a single transaction based on a common field (like username) and a maximum time span between events (maxspan). It preserves the raw events and adds duration and event count, making it ideal for sessionization. The maxspan=30m parameter ensures events more than 30 minutes apart are not grouped into the same transaction, which matches the requirement for a maximum time window.

Answer

eventstats max(_time) by username

Answer

timechart count by username

Answer

stats values(username) by sourceip

Question 9

An organization is implementing the Splunk Common Information Model (CIM) to normalize data. They have a source that provides event data with field names `src_ip` and `dst_ip`. To map these to CIM fields, which knowledge object should be created?

Accepted Answer

A field alias to create `src` from `src_ip` and `dest` from `dst_ip`. The CIM requires normalized field names such as src and dest for the Network Traffic data model. A field alias in Splunk creates a new field name that points to an existing field's value without re-extracting or duplicating data, making it the correct knowledge object to map src_ip→src and dst_ip→dest. Field aliases are search-time, lightweight, and specifically designed for CIM compliance.

Answer

A tag to tag events with `src_ip` and `dst_ip` as network traffic

Answer

A field extraction to rename `src_ip` to `src` and `dst_ip` to `dest`

Answer

A calculated field to set `src=src_ip` and `dest=dst_ip`

Question 10

An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?

Accepted Answer

endswith. The endswith parameter tells the transaction command which event marks the end of a transaction, so a transaction is only closed when an event matching that value is found. In the login/logout example, endswith="LOGOUT" ensures the transaction is not considered complete until a LOGOUT event arrives. This is the correct parameter for defining the terminating event.

Answer

startswith

Answer

maxpause

Answer

maxspan