SPLK-1002 Practice Questions 2 — 50 Questions

Question 1

You are a Splunk consultant for a financial services firm. They have a large lookup table containing customer account numbers and risk scores. This lookup is used in a critical compliance search that runs every hour. The search is failing with a memory error 'The search coordinator stopped the search due to memory usage'. You have already tried increasing the memory limit for the search via limits.conf, but the error persists. The lookup file is a CSV file of 2GB, with approximately 20 million rows. The search is: index=compliance sourcetype=transactions | lookup risk_scores.csv account_id OUTPUT risk_score | stats avg(risk_score) by transaction_type. The search runs on a single search head with 16GB RAM. The lookup is defined as static. What is the most effective optimization to resolve the memory error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the lookup to a KV store collection and use the 'kv' command in the search.. Converting the static CSV lookup to a KV store collection allows the lookup data to be stored in memory as a key-value store, which is optimized for high-performance lookups and can handle large datasets more efficiently than loading the entire CSV into memory. The KV store uses indexing and can serve lookups without loading the whole file, resolving the memory error. Option A is wrong because using 'inputlookup' with a 'where' clause still loads the entire CSV into memory before filtering, so the memory error persists. Option B is wrong because splitting the lookup into multiple files does not reduce the total memory required; the search still needs to load all files. Option D is wrong because 'lookup local=false' distributes the lookup to indexers, but the indexers would still need to load the CSV into memory, and the search head coordinates the search, which may still cause memory issues. Converting to KV store is the most effective optimization for this scenario.

Answer

Use 'inputlookup' with a 'where' clause to filter the lookup to only relevant account IDs before joining.

Answer

Split the lookup into multiple smaller files and use multiple lookups in the search.

Answer

Use 'lookup local=false' in the search to distribute the lookup to indexers.

Question 2

A large e-commerce company runs Splunk Enterprise on a single indexer cluster with four indexers. They have been experiencing slow search performance during peak hours, especially for searches that cover the last 24 hours. The environment uses a default search time range of 'Last 30 days'. The team has noticed that searches often time out or return partial results. They have also observed high CPU usage on the search head during peak times. The company's data volume is approximately 500 GB per day across various sources. They have implemented some search acceleration for data models, but the issue persists. The security team needs to run ad-hoc searches for threat hunting that cover multiple sourcetypes over the last 7 days. Additionally, the search head has a memory limit that is sometimes reached. The security team's searches are complex and involve joins and subsearches. The existing acceleration only covers a few data models. The team is looking for a quick win that does not require significant infrastructure changes. Which course of action would most effectively improve search performance without compromising data completeness?

Accepted Answer

Reduce the default time range to 'Last 7 days' and encourage users to specify shorter time ranges. Reducing the default time range from 'Last 30 days' to 'Last 7 days' directly reduces the data scanned by searches, which is the most effective quick win without infrastructure changes. Since the environment has high CPU usage on the search head and searches often time out, limiting the default time range reduces the load on the indexers and search head, improving performance for the majority of searches. This change does not compromise data completeness because users can still specify longer time ranges when needed.

Answer

Implement a data model for all sourcetypes and enforce using tstats for all searches

Answer

Increase the number of indexers to distribute the load

Answer

Use the search head clustering feature to distribute search load across multiple search heads

Question 3

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Accepted Answer

The original number of events is preserved.. `eventstats` adds aggregate statistics (like sums or averages) to each original event without reducing the total number of events. Unlike `stats`, which collapses events into a single summary row per group, `eventstats` appends the aggregated value to every matching event, preserving the original event count and structure.

Answer

It uses less memory than stats.

Answer

It is always faster than stats.

Question 4

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

Accepted Answer

Use the fields option to include only necessary fields.. Using the fields option with the transaction command limits the fields carried in each event, reducing memory usage. Option A (increasing maxeventtokens) would increase memory consumption. Option C (replacing with stats) changes the correlation approach and may not preserve transaction logic. Option D (timeline) is not relevant to memory reduction.

Answer

Increase the maxeventtokens setting.

Answer

Replace transaction with stats to aggregate.

Answer

Use timeline to store transactions.

Question 5

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Accepted Answer

The macro definition contains unescaped commas. In macro definitions, commas that are part of the code need to be escaped with a backslash because commas are used to separate macro arguments. The `if` function in the macro definition uses commas, and they are not escaped, so the macro expansion is broken. Option A is incorrect; the invocation with `field=` is a valid way to pass named arguments. Option C is incorrect; named arguments are allowed and not the issue. Option D is incorrect; a leading pipe is not needed inside the macro definition because the invocation already provides a pipe before the macro name.

Answer

The macro argument should be passed without the `field=` prefix

Answer

The macro definition should use positional arguments instead of named

Answer

The macro definition should include a pipe before `eval`

Question 6

Which command is used to convert a multi-value field into individual events?

Accepted Answer

mvexpand. Mvexpand expands multi-value fields into separate events. Option B (makemv) creates multi-value fields. Option C (eval split) also creates multi-value fields. Option D (fields) selects fields.

Answer

eval split

Answer

makemv

Answer

fields

Question 7

An analyst runs this search and gets no results. The lookup file server_list.csv exists and contains data. What is the most likely issue?

Accepted Answer

The field names in the CSV do not match the search fields.. The search likely uses fields (e.g., status, hostname, ip_address) that do not match the column headers in server_list.csv. The inputlookup command returns results only if field names align; a mismatch leads to no output. Other options are less likely: the file exists so it is in the correct directory (A); index specification is irrelevant for lookups (C); inputlookup is appropriate for inline lookups (D).

Answer

The lookup file is not in the correct lookup directory.

Answer

The search should include an index specification.

Answer

The search should use 'lookup' instead of 'inputlookup'.

Question 8

To find users who logged in from more than 3 different IP addresses, which search is correct?

Accepted Answer

index=auth | stats dc(IP) by user | where dc(IP) > 3. It uses `stats dc(IP) by user` to count distinct IP addresses per user, then filters with `where dc(IP) > 3` to return only users who logged in from more than 3 different IPs. The `dc()` function calculates distinct count, which is exactly what the question requires.

Answer

index=auth | top limit=3 IP by user

Answer

index=auth | eval user, IP | dedup user, IP | stats count by user | where count > 3

Answer

index=auth | stats distinct_count(IP) by user | where distinct_count(IP) > 3

Question 9

A developer wants to debug a slow Splunk search that uses multiple eval and where commands. The search returns correct results but takes 2 minutes. The developer wants to identify which parts of the search are slow. The environment is a single instance Splunk with moderate data. What should the developer do?

Accepted Answer

Run the search with the 'search job inspector' option enabled.. The Search Job Inspector provides detailed per-command execution statistics, including time spent, number of results, and memory usage for each pipe segment. This allows the developer to pinpoint exactly which `eval` or `where` command is causing the slowdown, without altering the search logic or time range.

Answer

Manually check the search in the Job Manager after it completes.

Answer

Limit the time range to 1 minute and run the search.

Answer

Add comments to the search to track progress.

Question 10

Which TWO of the following are valid ways to define arguments in a Splunk macro?

Accepted Answer

In the macro definition, use $arg1$, $arg2$ as placeholders for the arguments.. Splunk macros use named placeholders like $arg1$, $arg2$ in the macro definition to represent arguments. When the macro is invoked, these placeholders are replaced with the actual values passed by the user, allowing flexible and reusable search snippets.

Answer

In the macro definition, use $1$, $2$ as positional placeholders.

Answer

Arguments are automatically inferred from the search string in the macro definition.

Answer

In the macro definition, use named placeholders like $error_code$.

Question 11

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 12

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. It first filters out outliers (response_time < 10000) using the where command, then calculates the average response time per user with stats avg(response_time) by user. This ensures outliers are excluded before the average is computed. Option A is incorrect because it uses if() after stats, which incorrectly modifies the average after it includes outliers. Option B is incorrect because the where clause after stats erroneously filters based on the per-user average itself, not on individual response_time values. Option C is incorrect because eventstats computes an overall average that still includes outliers, and the subsequent filter does not retroactively affect that average.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 13

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 14

A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)

Accepted Answer

Increase 'maxevents'.. Options C and E are correct. 'maxevents' sets the maximum number of events per transaction; increasing it allows more events to be collected before the transaction times out. 'maxtime' sets the maximum time (in seconds) from the first event to the transaction completion; increasing it gives the transaction more time to complete. Option A ('maxopentxn') controls the maximum number of concurrent open transactions, not the timeout. Option B ('connected=false') changes event grouping behavior and does not extend time. Option D ('maxspan') defines the maximum time span between earliest and latest event in a transaction; decreasing it would shorten the window and likely cause more timeouts.

Answer

Increase 'maxopentxn'.

Answer

Set 'connected=false'.

Answer

Decrease 'maxspan'.

Question 15

Which of the following searches correctly computes the average response time per host?

Accepted Answer

index=main | stats mean(response_time) by host. The `stats` command with `mean(response_time)` calculates the arithmetic mean of the response_time field, and the `by host` clause groups the calculation per host, producing the average response time for each host. This is the standard Splunk syntax for computing averages in a grouped statistics table.

Answer

index=main | stats average(response_time) by host

Answer

index=main | eventstats avg(response_time) by host

Answer

index=main | stats avg response_time by host

Question 16

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 17

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Accepted Answer

Reduce the time range of the search.. Reducing the time range limits the volume of data scanned by the search head, directly reducing I/O and processing overhead. This is one of the most effective ways to improve search performance because Splunk must read and filter every event in the specified time window from the index.

Answer

Use wildcard characters at the beginning of search terms.

Answer

Use the transaction command to group events.

Answer

Use the dedup command as early as possible.

Question 18

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

Accepted Answer

Choropleth map. C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Answer

Single value

Answer

Gauge

Answer

Scatter plot

Question 19

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Accepted Answer

Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart. Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Answer

Use | where status=401 | dedup src_ip | timechart count by region

Answer

Use | where status=401 | mvexpand region | timechart count by region

Answer

Use | where status=401 | top limit=100 region

Question 20

Order the steps to create a dashboard panel using the XML source editor in Splunk.

Accepted Answer

Open the dashboard in Edit mode, then click Source to open the XML editor, then add a panel element containing a search query and visualization, then save the XML.. Dashboard panels are defined in XML by adding a panel with a search query and visualization.

Answer

Click Source to open the XML editor, then open the dashboard in Edit mode, then add a panel element, then save.

Answer

Add a panel element, then open the dashboard in Edit mode, then click Source, then save.

Answer

Open the dashboard in Edit mode, then add a panel element, then click Source to open the XML editor, then save.