SPLK-1002 Practice Test 5 — 10 Questions

Question 1

You are a Splunk administrator at a large e-commerce company with over 5,000 employees and millions of customers. The development team has created a dashboard that displays sales data by region, using a lookup table to map customer IDs to region names. The lookup file, 'customer_region.csv', is stored on the search head. Recently, the lookup table was updated with new customer IDs, but the dashboard continues to show old region names for new customers. You have verified that the lookup file contains the new mappings and that the file is correctly formatted. The dashboard uses the 'lookup' command in its base search. You have also confirmed that the lookup definition in transforms.conf points to the correct file. The lookup file is approximately 100 MB and is updated weekly. The dashboard is accessed by multiple users across the organization. The issue only affects new customers added in the latest update. Old customers still show correct regions. You have checked the file size and timestamp, and the new file is present. The Splunk version is 8.2. The search head is not clustered. No errors are appearing in the splunkd.log related to lookups. The dashboard uses a simple XML with a timechart and a lookup. The search string is: index=sales sourcetype=transactions | lookup customer_region.csv customer_id OUTPUT region | timechart count by region. You have also tried restarting the search head, but the issue persists. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The search head is using a cached version of the lookup, and you need to clear the lookups cache.. Splunk caches lookup files on the search head to improve performance. When the lookup file is updated externally, the cache may still serve the old version until it is explicitly cleared or the search head is restarted. In this scenario, the file is correctly formatted and the definition points to the correct file, but the cache still holds the previous version. Clearing the lookup cache forces Splunk to reload the file from disk, resolving the issue. Option A is incorrect because 'batch_index_query' is not related to lookup caching. Option B is incorrect because the dashboard uses the correct lookup name. Option C is incorrect because restarting the search head may not clear the cache; the cache must be cleared explicitly.

Answer

The lookup definition has 'batch_index_query=True' and is not refreshing.

Answer

The dashboard is using the wrong lookup name.

Answer

The lookup file is cached and needs to be reloaded by restarting Splunk.

Question 2

A user wants to find the top 5 sourcetypes by event count over the last 24 hours. Which search is correct?

Accepted Answer

index=* | stats count by sourcetype | sort -count | head 5. Option C correctly uses stats to count events by sourcetype, then sorts in descending order and limits to top 5 with head. Option A contains the invalid command 'eventcount', not a real Splunk command. Option B uses invalid syntax 'top 5 sourcetype'; the correct syntax is 'top limit=5 sourcetype'. Option D returns the top 10 sourcetypes by default, not the top 5.

Answer

index=* | eventcount | top sourcetype

Answer

index=* | stats count by sourcetype | top 5 sourcetype

Answer

index=* | top sourcetype

Question 3

Refer to the exhibit. What is the purpose of this configuration?

Accepted Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.. This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters (maxpause, maxevents).

Answer

It creates a search-time field extraction for clientip and userid.

Answer

It configures the transaction command to run automatically on all data.

Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.

Question 4

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

Accepted Answer

... | transaction user maxspan=600. 'maxspan=600' limits the transaction time window to 600 seconds (10 minutes), which meets the requirement of grouping events within 10 minutes for each user. There's no need for startswith/endswith as all authentication events should be included. Option A is incorrect because 'maxevents=100' may truncate transactions with more than 100 events. Option B is incorrect because 'maxpause=120' only sets a pause threshold but does not enforce a total time limit; transactions could exceed 10 minutes if events continue with short pauses. Option C is incorrect because using startswith and endswith restricts the transaction to only those that begin with 'login' and end with 'logout', potentially excluding other authentication events like failures.

Answer

... | transaction user maxspan=600 maxevents=100

Answer

... | transaction user maxpause=120

Answer

... | transaction user maxspan=600 startswith="login" endswith="logout"

Question 5

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

Accepted Answer

Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.. Using stats and where is more efficient than transaction. Transaction holds all events in memory until the transaction is closed, which is memory-intensive when dealing with many events like 500 servers. The stats command can group events by src_ip, then the where command can filter for pairs of EventCode 4625 and 4624 within the same group. This approach leverages streaming capabilities and reduces memory overhead. Option A is incorrect because the append command does not correlate events by source IP; it merely concatenates results from two separate searches. Option B is incorrect because adding maxevents=1000 (already default) limits the number of events per transaction but does not address the underlying memory consumption issue of transaction. Option C is incorrect because increasing maxpause to 10 minutes would allow more events per transaction, making the search even slower and more prone to timeout.

Answer

Use the append command to combine the two event types after separate searches.

Answer

Add maxevents=1000 to the transaction command to limit event count.

Answer

Increase maxpause to 10 minutes to allow more events per transaction.

Question 6

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

Accepted Answer

Events from the two sourcetypes are not in chronological order.. The most likely cause is that events from the two sourcetypes are not in chronological order. The transaction command, by default, requires events to be processed in time order, and if events from different sourcetypes are interleaved or out of sequence, the transaction may fail to match a complete sequence. Option A is incorrect because a high maxpause would make the transaction more likely to match, not less. Option C is incorrect because the fields option is not required for the transaction to work; it is used to identify the transaction. Option D is incorrect because overly broad patterns would cause too many matches, not too few.

Answer

The maxpause value is too high.

Answer

The fields option is missing.

Answer

The startswith and endswith patterns are too broad.

Question 7

A user wants to create a report that shows the top 5 sources of errors, excluding a specific source 'host1'. Which SPL is correct?

Accepted Answer

index=main sourcetype=access_combined status>400 NOT host="host1" | top limit=5 source. It filters out 'host1' before the `top` command runs, ensuring that the top 5 sources of errors are calculated from the remaining data. The `NOT host="host1"` clause is placed in the base search, which is the most efficient approach and guarantees that 'host1' is excluded from the statistical aggregation.

Answer

index=main sourcetype=access_combined status>400 | top limit=5 source | where source!="host1"

Answer

index=main sourcetype=access_combined status>400 | top limit=5 source | search source!="host1"

Answer

index=main sourcetype=access_combined status>400 | search NOT host=host1 | top limit=5 source

Question 8

A user reports that a macro named `my_macro` is not expanding in a search. The macro is defined in a private app called 'App_A'. The user is running the search in a different app called 'App_B'. What is the most likely cause of the issue?

Accepted Answer

The macro is not shared to the global context.. Macros are confined to the app where they are defined unless they are shared to the global context. Since my_macro is defined in App_A but the user is searching from App_B, and the macro is not shared globally, it will not expand in App_B. Thus, option D is correct. Option A is incorrect because a syntax error would typically produce a specific error message, not just fail to expand. Option B is incorrect because permission to view the macro does not affect cross-app expansion; sharing to global context is required. Option C is incorrect because Splunk macro names are case-insensitive.

Answer

The macro has a syntax error that prevents expansion.

Answer

The user does not have permission to view the macro.

Answer

The macro name is case-sensitive and the user used wrong case.

Question 9

The security operations center (SOC) team at a medium-sized enterprise uses Splunk to investigate potential threats. They maintain a CSV lookup file named 'threat_intel.csv' that contains a list of known malicious IP addresses along with a threat score. The lookup is configured in transforms.conf as:

[threat_intel]
filename = threat_intel.csv
match_type = WILDCARD(ip)

They frequently run the following search to enrich firewall events with threat scores:

index=firewall sourcetype=firewall_logs | lookup threat_intel src_ip OUTPUT threat_score | where threat_score > 5

Recently, analysts noticed that some IP addresses known to be present in the lookup file are not being matched in search results. They have verified that the lookup file is correctly formatted and contains those IPs, and the transforms.conf has not been altered. They also confirmed that the events contain the field src_ip with the correct IP addresses. Which of the following is the most likely cause of the missing matches?

Accepted Answer

The IP addresses in the lookup file are stored in a different case (e.g., uppercase) than in the events (lowercase).. The most likely cause is that the IP addresses in the lookup file and the events have different cases (e.g., uppercase vs. lowercase). Splunk lookups are case-sensitive by default unless the match_type is set to ignore case. Since the match_type is WILDCARD (which is still case-sensitive), case differences will prevent matching. Option A is correct.

Answer

The search is limited to a time range that excludes events with those IP addresses.

Answer

The lookup file contains duplicate entries for some IPs, causing conflicts.

Answer

The lookup command requires the input_fields parameter to specify which field to use for matching.

Question 10

Which command creates a new field that contains the string 'high' if a numeric field exceeds 100, otherwise 'low'?

Accepted Answer

eval status=if(value>100,"high","low"). The `eval` command with the `if` function correctly checks if the numeric field `value` exceeds 100 and returns the string 'high' or 'low'. In Splunk's `eval`, the `if` function requires the true and false results to be quoted strings when they are literal text, as shown in option A.

Answer

eval status=case(value>100,"high",true(),"low")

Answer

eval status=if(value>100,high,low)

Answer

None of the above