SPLK-1003 Practice Test 7 — 10 Questions

Question 1

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

Accepted Answer

`stats avg($field$) as avg_response`. Option D is correct because in Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro.

Answer

`stats avg($field$) | eval avg_response=$result$`

Answer

"stats avg($field$) as avg_response"

Answer

`stats avg($field$) as avg_$field$`

Question 2

An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?

Accepted Answer

The lookup definition is not configured as a CIDR type. The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet. Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.

Answer

The IP addresses in the events are in lowercase

Answer

The lookup file is not in CSV format

Answer

The lookup file is compressed and not being read correctly

Question 3

A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?

Accepted Answer

The search is not scheduled or set to 'Auto' for the panel.. Option B is correct because the single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.

Answer

The 'Token delay' is too high.

Answer

The time range picker is set to 'All time'.

Answer

The dashboard's 'Auto-refresh' interval is not set.

Question 4

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Answer

External lookup

Answer

KV Store lookup

Answer

Geospatial lookup

Question 5

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. Option C is correct because it first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 6

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

Accepted Answer

A lookup definition must be added to transforms.conf. When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Answer

The lookup file must be uploaded via the UI instead of placed manually

Answer

The search head must be configured as a lookup server

Answer

The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory

Question 7

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Accepted Answer

transaction by transaction_id. Option A is correct because the `transaction` command with `by transaction_id` groups all events sharing the same `transaction_id` field value into a single transaction, with no default time constraints. This matches the requirement to correlate events across `web_access`, `auth_log`, and `app_log` sourcetypes without any time window restrictions.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 8

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

Accepted Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h. Option C is correct because the `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h

Answer

index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time

Answer

index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h

Question 9

Which TWO statements are true about the `transaction` command in Splunk?

Accepted Answer

It can group events based on one or more common field values.. Option A is correct because the `transaction` command groups events that share one or more common field values, such as `session_id` or `user_id`, into a single transaction. This allows you to correlate related events across different sources or sourcetypes based on matching field values.

Answer

It automatically calculates the duration between the first and last event.

Answer

It can only correlate events from the same sourcetype.

Answer

It automatically sorts events in chronological order within each transaction.

Question 10

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. Option A is correct because the 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.