SPLK-1002 Practice Questions 2 — 50 Questions

Question 1

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

Accepted Answer

Use the fields option to include only necessary fields.. Using the fields option to include only necessary fields reduces memory usage because the transaction command by default keeps all fields from the events, which can be memory-intensive. By specifying only the fields needed for the transaction logic, Splunk can discard unnecessary data, significantly lowering memory footprint while preserving the transaction grouping. This is the best approach to maintain transaction logic while optimizing memory.

Answer

Increase the maxeventtokens setting.

Answer

Replace transaction with stats to aggregate.

Answer

Use timeline to store transactions.

Question 2

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 3

Arrange the steps to create a new index in Splunk in the correct order.

Accepted Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Enter index name and configure settings. Step 4: Click Save.. Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Answer

Step 1: Click New Index. Step 2: Navigate to Settings > Indexes. Step 3: Enter index name and configure settings. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Enter index name and configure settings. Step 3: Click New Index. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Click Save. Step 4: Enter index name and configure settings.

Question 4

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. Option B, timechart, is correct because it produces a time-series visualization by bucketing events into time intervals (e.g., span=1d) and plotting aggregated values such as count or avg per bucket, which is exactly the time-series foundation needed for a week-over-week comparison. Option D, timewrap, is correct because it takes the output of a timechart and overlays or wraps multiple time periods (e.g., a 1-week span) so the current week and previous week can be compared side by side on the same chart. Used together, timechart builds the per-interval series and timewrap aligns the current and prior week for direct visual comparison. Option A, stats, is not correct here because it aggregates without producing a time-bucketed series, so it cannot by itself render a week-over-week time-series comparison. Option C, eventstats, is not correct because it adds aggregate values back to individual events rather than creating a time-series chart. Option E, appendcols, is not correct because it merely appends columns from a subsearch to the current results and does not perform time-period wrapping or time-series comparison.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 5

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Accepted Answer

`index=main | stats count by user, action`. Splunk macros with arguments substitute the positional tokens `$1$` and `$2$` with the values passed at call time. In the search `index=main | `mysearch(user, action)`, `$1$` becomes `user` and `$2$` becomes `action`, so the macro definition `stats count by $1$, $2$` expands to `stats count by user, action`. The final expanded search is therefore `index=main | stats count by user, action`.

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Question 6

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

Accepted Answer

It defines the time interval for each data point (1 hour).. The span argument in the timechart command defines the time interval for each data point on the chart. In the search `... | timechart span=1h count by status`, span=1h means each data point represents a 1-hour bucket, and the count is aggregated over that hour for each status value. This controls the granularity of the time series.

Answer

It limits the number of status values displayed.

Answer

It groups events into 1-minute intervals.

Answer

It sets the time range of the chart.

Question 7

Refer to the exhibit. This search returns an error. What is the most likely cause?

Accepted Answer

The timechart command requires a _time field which is not present after stats. The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Answer

The eval command cannot be used before timechart

Answer

The status_group field is not available after timechart because it was created in eval

Answer

The stats command aggregates data, so timechart cannot use the aggregated count field

Question 8

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Accepted Answer

1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.. The Field Extractor guides you through selecting sample data, defining extraction rules, testing, and saving.

Answer

1. Highlight the field value, 2. Select a sample event, 3. Name the field, 4. Save the extraction.

Answer

1. Name the field, 2. Select a sample event, 3. Highlight the field value, 4. Save the extraction.

Answer

1. Select a sample event, 2. Name the field, 3. Highlight the field value, 4. Save the extraction.

Question 9

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Accepted Answer

The field `uri_path` does not exist or contains data that does not match the pattern.. The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.

Answer

The stats command cannot be used after rex.

Answer

The search time range is too short to include any events.

Answer

The regex pattern is incorrectly written.

Question 10

A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?

Accepted Answer

The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.. The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D). Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.

Answer

The alert is disabled due to throttling or suppression settings.

Answer

The search uses a summary index that is not searchable by the alert system.

Answer

The time range in the saved search does not align with the alert schedule.

Question 11

A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?

Accepted Answer

endswith="action=deny". The endswith option in the transaction command defines the condition that marks the final event of a transaction. Setting endswith="action=deny" tells Splunk to close the transaction when a deny event for that session ID is encountered, which matches the requirement that the transaction ends on a deny.

Answer

endswith="action=allow"

Answer

startswith="action=deny"

Answer

maxevents=2

Question 12

Which TWO of the following statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

It can add a 'duration' field to the result events.. Option A is correct because the transaction command supports the duration option, which adds a 'duration' field to each resulting transaction event showing the elapsed time between the first and last event in the group. Option E is correct because transaction groups events into a single result when they share common field values (specified via the by clause) and occur within a defined time span (maxspan/maxpause), reflecting logical and temporal proximity. Option B is wrong because transaction expects events sorted in ascending _time order, not descending. Option C is wrong because transaction supports many options such as maxspan, maxpause, maxevents, and mvlist, not just startswith/endswith. Option D is wrong because the by clause is optional; transaction can group events using only time-based constraints.

Answer

It requires events to be sorted by _time in descending order.

Answer

It can only be used with 'startswith' and 'endswith' options.

Answer

It requires at least one field in the 'by' clause.

Question 13

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 14

A security analyst wants to calculate the average latency for each web server over the past hour, but only for requests where the status code is 200. The search result includes fields: server, latency, status. Which search correctly accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(latency) by server. It filters events to only those with status=200 before the stats command, ensuring the average latency is calculated exclusively over successful requests. The stats command then computes the average latency grouped by server, which directly answers the requirement without needing conditional logic or post-filtering.

Answer

index=web sourcetype=access | eval good_latency=if(status=200, latency, null) | stats avg(good_latency) by server

Answer

index=web sourcetype=access | eventstats avg(latency) by server | where status=200

Answer

index=web sourcetype=access | stats avg(latency) by server | where status=200

Question 15

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

Accepted Answer

Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.. When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.

Answer

The transaction command failed to group events properly and returned only the login event.

Answer

The transaction command is processing events out of order, causing login and logout timestamps to be the same.

Answer

The maxevents=5 limitation causes the transaction to close early, but the logged duration is still calculated correctly from the first event timestamp.

Question 16

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. For a lookup definition to work, the CSV file must be placed in the lookups directory of the same app where the transforms.conf is defined. Splunk looks for lookup files relative to the app's directory structure, so the file must reside in $SPLUNK_HOME/etc/apps/<app_name>/lookups/. This ensures the lookup is properly scoped and accessible to the app's configuration.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.

Question 17

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 18

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 19

An analyst runs `transaction user_id` to correlate events from a web server. The resulting transaction events have a field 'duration' that shows the time between the first and last event. However, some transactions span over 30 minutes. What transaction option should be added to limit the maximum time between the first and last event?

Accepted Answer

maxspan=30m. The maxspan option sets the maximum time span from the first event to the last event in a transaction.

Answer

maxpause=30m

Answer

maxevents=30

Answer

contime=30m

Question 20

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. It uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10