SPLK-1002 Practice Test 6 — 10 Questions

Question 1

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

Accepted Answer

Use the fields option to include only necessary fields.. Using the fields option to include only necessary fields reduces memory usage because the transaction command by default keeps all fields from the events, which can be memory-intensive. By specifying only the fields needed for the transaction logic, Splunk can discard unnecessary data, significantly lowering memory footprint while preserving the transaction grouping. This is the best approach to maintain transaction logic while optimizing memory.

Answer

Increase the maxeventtokens setting.

Answer

Replace transaction with stats to aggregate.

Answer

Use timeline to store transactions.

Question 2

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 3

Arrange the steps to create a new index in Splunk in the correct order.

Accepted Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Enter index name and configure settings. Step 4: Click Save.. Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Answer

Step 1: Click New Index. Step 2: Navigate to Settings > Indexes. Step 3: Enter index name and configure settings. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Enter index name and configure settings. Step 3: Click New Index. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Click Save. Step 4: Enter index name and configure settings.

Question 4

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. Option B, timechart, is correct because it produces a time-series visualization by bucketing events into time intervals (e.g., span=1d) and plotting aggregated values such as count or avg per bucket, which is exactly the time-series foundation needed for a week-over-week comparison. Option D, timewrap, is correct because it takes the output of a timechart and overlays or wraps multiple time periods (e.g., a 1-week span) so the current week and previous week can be compared side by side on the same chart. Used together, timechart builds the per-interval series and timewrap aligns the current and prior week for direct visual comparison. Option A, stats, is not correct here because it aggregates without producing a time-bucketed series, so it cannot by itself render a week-over-week time-series comparison. Option C, eventstats, is not correct because it adds aggregate values back to individual events rather than creating a time-series chart. Option E, appendcols, is not correct because it merely appends columns from a subsearch to the current results and does not perform time-period wrapping or time-series comparison.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 5

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Accepted Answer

`index=main | stats count by user, action`. Splunk macros with arguments substitute the positional tokens `$1$` and `$2$` with the values passed at call time. In the search `index=main | `mysearch(user, action)`, `$1$` becomes `user` and `$2$` becomes `action`, so the macro definition `stats count by $1$, $2$` expands to `stats count by user, action`. The final expanded search is therefore `index=main | stats count by user, action`.

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Question 6

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

Accepted Answer

It defines the time interval for each data point (1 hour).. The span argument in the timechart command defines the time interval for each data point on the chart. In the search `... | timechart span=1h count by status`, span=1h means each data point represents a 1-hour bucket, and the count is aggregated over that hour for each status value. This controls the granularity of the time series.

Answer

It limits the number of status values displayed.

Answer

It groups events into 1-minute intervals.

Answer

It sets the time range of the chart.

Question 7

Refer to the exhibit. This search returns an error. What is the most likely cause?

Accepted Answer

The timechart command requires a _time field which is not present after stats. The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Answer

The eval command cannot be used before timechart

Answer

The status_group field is not available after timechart because it was created in eval

Answer

The stats command aggregates data, so timechart cannot use the aggregated count field

Question 8

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Accepted Answer

1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.. The Field Extractor guides you through selecting sample data, defining extraction rules, testing, and saving.

Answer

1. Highlight the field value, 2. Select a sample event, 3. Name the field, 4. Save the extraction.

Answer

1. Name the field, 2. Select a sample event, 3. Highlight the field value, 4. Save the extraction.

Answer

1. Select a sample event, 2. Name the field, 3. Highlight the field value, 4. Save the extraction.

Question 9

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Accepted Answer

The field `uri_path` does not exist or contains data that does not match the pattern.. The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.

Answer

The stats command cannot be used after rex.

Answer

The search time range is too short to include any events.

Answer

The regex pattern is incorrectly written.

Question 10

A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?

Accepted Answer

The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.. The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D). Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.

Answer

The alert is disabled due to throttling or suppression settings.

Answer

The search uses a summary index that is not searchable by the alert system.

Answer

The time range in the saved search does not align with the alert schedule.