SPLK-1002 Practice Questions 1 — 50 Questions

Question 1

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Accepted Answer

... | map search="search index=other $field$". The `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Answer

... | join type=inner [search index=other]

Answer

[return index=main | stats count]

Question 2

A user runs a search that returns 1,000,000 results but only sees 5,000 in the Statistics tab. What is the most likely cause?

Accepted Answer

The stats command is being used without a by clause. The stats command without a 'by' clause aggregates all events into a single row (or by whatever field specified). If no 'by' clause, it returns one row per aggregation, so a small number of rows. Option A is wrong because the search command truncates at 50,000 results by default. Option C is wrong because time range narrowness would reduce raw events, but here stats shows few rows. Option D is wrong because sampling is not a default behavior.

Answer

The results are being sampled

Answer

The time range is too narrow

Answer

The search command truncates results

Question 3

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Accepted Answer

Time-based lookup. Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Answer

File lookup

Answer

CSV lookup

Answer

External lookup

Question 4

What is the purpose of an automatic lookup?

Accepted Answer

To automatically apply a lookup to events based on a source type or index at search time.. An automatic lookup is configured in transforms.conf or props.conf to automatically apply a lookup table to events based on sourcetype or index at search time. This enriches events with additional fields without requiring the lookup command in the search. Option A is incorrect because automatic lookups do not validate field names; validation must be done separately. Option B describes the outputlookup command, which writes to a lookup file. Option C is incorrect because automatic lookups do not create tables from search results; that is done by the inputlookup or outputlookup commands. Option D correctly describes the purpose of an automatic lookup.

Answer

To automatically validate lookup field names.

Answer

To automatically update a lookup file when the CSV changes.

Answer

To automatically create a lookup table from search results.

Question 5

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. The error 'Could not find lookup table' indicates that Splunk cannot find a lookup definition named 'geo_lookup' in transforms.conf. This is the most likely cause because the lookup definition (stanza) is missing or misconfigured. If the file geo.csv were missing but the definition existed, the error would mention 'file not found'. Permission errors produce a different message, and a misspelled field would not cause this error. Therefore, option A is correct.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 6

In a dashboard panel, a table shows event counts by source. The user wants to click on a sourcetype to drill down to a new search showing all events from that source. Which token-based drilldown approach is correct?

Accepted Answer

Set a drilldown action to 'search' with a search string containing $row.sourcetype$.. Using $row.sourcetype$ in a drilldown search string passes the clicked value dynamically. Option A is wrong because custom JavaScript is unnecessary and not the recommended token-based approach. Option B is wrong because 'form' action submits form inputs, not simply a token with the clicked value. Option C is wrong because a static link URL cannot dynamically pass the clicked sourcetype.

Answer

Use a custom JavaScript to navigate.

Answer

Set a drilldown action to 'form' and submit the token.

Answer

Set a drilldown action to 'link' with a URL that includes the sourcetype.

Question 7

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

Accepted Answer

Use a subsearch with the IN operator instead. Replacing a `map` command with a subsearch using the `IN` operator allows Splunk to retrieve all matching field values in a single search pass, rather than executing a separate search for each value. The `map` command runs one search per input row, which can cause significant overhead and slow performance, especially with large result sets. Using `IN` in a subsearch collects the values first and then applies them as a filter in the outer search, reducing the number of search operations to one.

Answer

Use the sort command

Answer

Use the transaction command

Answer

Use the foreach command to loop over fields

Question 8

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 9

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Accepted Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`. It uses the `stats` command to compute the average duration and count per user in a single pass, then filters with `where` to enforce both conditions: average duration > 100 and event count > 5. This is the standard pattern for per-user aggregation followed by post-aggregation filtering in Splunk.

Answer

`... | where avg(duration)>100 | stats count by user | where count>5`

Answer

`... | top user limit=0 | where avg(duration)>100`

Answer

`... | eventstats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`

Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | having avg_dur>100 and cnt>5`

Question 10

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 11

A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?

Accepted Answer

Use the transaction command with startswith='login' and endswith='logout'.. The `transaction` command is specifically designed to group related events that share a common field (e.g., user or session ID) and occur within a defined time window. By using `startswith='login'` and `endswith='logout'`, it correctly identifies the beginning and end of a user session, grouping all intermediate events into a single transaction. This is the most direct and efficient method for correlating login and logout events in Splunk.

Answer

Use the sort command by user and time to manually identify sessions.

Answer

Use the stats command with values() and earliest().

Answer

Use the eval command to create a session ID based on time differences.

Question 12

A company uses a large Splunk environment with many users creating dashboards. They notice that some searches are slow and consume excessive resources. What is the best practice to optimize search performance?

Accepted Answer

Use the tstats command with summariesonly=t. The `tstats` command with `summariesonly=t` is the best practice because it queries accelerated data models or summary indices rather than raw event data, drastically reducing the amount of data scanned. This command leverages pre-computed statistics, which is the most efficient way to perform searches over large datasets, especially when users are building dashboards that run repeatedly.

Answer

Use the search command with a large time range

Answer

Use the eval command to create new fields

Answer

Use the stats command with by clause on high cardinality fields

Question 13

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

Accepted Answer

... | sort date | streamstats sum(sales) as running_total. It first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Answer

... | eval running_total = running_sum(sales)

Answer

... | eventstats sum(sales) as running_total

Answer

... | stats sum(sales) by date

Question 14

A user wants to create a chart showing the count of errors per hour for the last 24 hours, with time bucketed hourly. Which search is correct?

Accepted Answer

index=main error | timechart count span=1h. The `timechart` command automatically creates a time-based chart with a default count aggregation. The `span=1h` argument explicitly sets the bucket size to one hour, which groups events into hourly intervals over the last 24 hours. This produces the exact output the user needs: a count of errors per hour.

Answer

index=main error | bucket _time span=1h | stats count by _time

Answer

index=main error | chart count by _time span=1h

Answer

index=main error | timechart count by _time span=1h

Question 15

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Accepted Answer

index=web status=404 | top limit=5 user_agent. It first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.

Answer

index=web | top limit=5 user_agent status=404

Answer

index=web | top limit=5 user_agent

Answer

index=web | stats count by user_agent | where status=404 | top 5 user_agent

Question 16

What is the MOST likely reason the search returns no results?

Accepted Answer

The `inputlookup` command expects the definition name, not the filename.. The `inputlookup` command in Splunk expects the lookup definition name as its argument, not the filename of the CSV file. If a user specifies the filename (e.g., `| inputlookup myfile.csv`) instead of the lookup definition name (e.g., `| inputlookup my_lookup`), Splunk will not find the lookup and returns no results. This is a common mistake because the command syntax requires the logical name defined in the lookup table configuration, not the physical file path.

Answer

The user does not have permission to read the lookup.

Answer

The lookup definition is not configured.

Answer

The CSV file has no header row.

Question 17

To count events by host for the last hour, which search is most efficient?

Accepted Answer

index=* earliest=-1h | stats count by host. It uses `index=*` to search all indexes and `earliest=-1h` to restrict the search to the last hour at the index level, which is the most efficient way to filter time. The `stats count by host` then aggregates counts per host without needing to process events outside the time range. This approach leverages Splunk's time-based index pruning, minimizing data scanned.

Answer

index=* | stats count by host | where _time > relative_time(now(), "-1h")

Answer

search index=* | head 1000 | stats count by host

Answer

sourcetype=access_combined | timechart count by host

Question 18

Refer to the exhibit. What is the purpose of the eval command in this search?

Accepted Answer

It creates a new field 'status_category' based on the numeric status code, grouping into three categories.. The eval command creates a new field 'status_category' by evaluating a CASE expression that maps numeric HTTP status codes (e.g., 200, 404, 500) into three descriptive categories: 'OK', 'Client Error', and 'Server Error'. This is a common pattern for enriching raw data with human-readable labels without altering the original 'status' field. The correct answer is D because the search explicitly defines the new field based on the status code values.

Answer

It replaces the status field with the category.

Answer

It adds a temporary field that is not retained after stats.

Answer

It converts the status field to a string.

Question 19

Which THREE steps are necessary to create a file-based lookup?

Accepted Answer

Upload the lookup file to the correct directory.. To create a file-based lookup in Splunk, three steps are necessary: upload the lookup file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply the changes (E). The lookup definition maps the file to a lookup table name. Props.conf is not used for defining lookups; it is for field extractions and event processing. Restarting Splunk is required because changes to transforms.conf take effect only after a restart. Automatic lookups (D) are optional and defined separately if needed.

Answer

Create a lookup definition in props.conf.

Answer

Define an automatic lookup in props.conf.

Question 20

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

Accepted Answer

eval domain=mvindex(split(email,"@"),1). `split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Answer

eval domain=mvindex(split(email,"@"),0)

Answer

eval domain=replace(email,".*@(.*)","\1")

Answer

eval domain=substr(email, indexof(email,"@")+1)