SPLK-1002 Practice Test 7 — 10 Questions

Question 1

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 2

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. It first filters out outliers (response_time < 10000) using the where command, then calculates the average response time per user with stats avg(response_time) by user. This ensures outliers are excluded before the average is computed. Option A is incorrect because it uses if() after stats, which incorrectly modifies the average after it includes outliers. Option B is incorrect because the where clause after stats erroneously filters based on the per-user average itself, not on individual response_time values. Option C is incorrect because eventstats computes an overall average that still includes outliers, and the subsequent filter does not retroactively affect that average.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 3

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 4

A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)

Accepted Answer

Increase 'maxevents'.. Options C and E are correct. 'maxevents' sets the maximum number of events per transaction; increasing it allows more events to be collected before the transaction times out. 'maxtime' sets the maximum time (in seconds) from the first event to the transaction completion; increasing it gives the transaction more time to complete. Option A ('maxopentxn') controls the maximum number of concurrent open transactions, not the timeout. Option B ('connected=false') changes event grouping behavior and does not extend time. Option D ('maxspan') defines the maximum time span between earliest and latest event in a transaction; decreasing it would shorten the window and likely cause more timeouts.

Answer

Increase 'maxopentxn'.

Answer

Set 'connected=false'.

Answer

Decrease 'maxspan'.

Question 5

Which of the following searches correctly computes the average response time per host?

Accepted Answer

index=main | stats mean(response_time) by host. The `stats` command with `mean(response_time)` calculates the arithmetic mean of the response_time field, and the `by host` clause groups the calculation per host, producing the average response time for each host. This is the standard Splunk syntax for computing averages in a grouped statistics table.

Answer

index=main | stats average(response_time) by host

Answer

index=main | eventstats avg(response_time) by host

Answer

index=main | stats avg response_time by host

Question 6

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 7

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Accepted Answer

Reduce the time range of the search.. Reducing the time range limits the volume of data scanned by the search head, directly reducing I/O and processing overhead. This is one of the most effective ways to improve search performance because Splunk must read and filter every event in the specified time window from the index.

Answer

Use wildcard characters at the beginning of search terms.

Answer

Use the transaction command to group events.

Answer

Use the dedup command as early as possible.

Question 8

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

Accepted Answer

Choropleth map. C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Answer

Single value

Answer

Gauge

Answer

Scatter plot

Question 9

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Accepted Answer

Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart. Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Answer

Use | where status=401 | dedup src_ip | timechart count by region

Answer

Use | where status=401 | mvexpand region | timechart count by region

Answer

Use | where status=401 | top limit=100 region

Question 10

Order the steps to create a dashboard panel using the XML source editor in Splunk.

Accepted Answer

Open the dashboard in Edit mode, then click Source to open the XML editor, then add a panel element containing a search query and visualization, then save the XML.. Dashboard panels are defined in XML by adding a panel with a search query and visualization.

Answer

Click Source to open the XML editor, then open the dashboard in Edit mode, then add a panel element, then save.

Answer

Add a panel element, then open the dashboard in Edit mode, then click Source, then save.

Answer

Open the dashboard in Edit mode, then add a panel element, then click Source to open the XML editor, then save.