SPLK-1002 Practice Test 7 — 10 Questions

Question 1

A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

endswith="action=deny". The endswith option in the transaction command defines the condition that marks the final event of a transaction. Setting endswith="action=deny" tells Splunk to close the transaction when a deny event for that session ID is encountered, which matches the requirement that the transaction ends on a deny.

Answer

endswith="action=allow"

Answer

startswith="action=deny"

Answer

maxevents=2

Question 2

Which TWO of the following statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

It can add a 'duration' field to the result events.. Option A is correct because the transaction command supports the duration option, which adds a 'duration' field to each resulting transaction event showing the elapsed time between the first and last event in the group. Option E is correct because transaction groups events into a single result when they share common field values (specified via the by clause) and occur within a defined time span (maxspan/maxpause), reflecting logical and temporal proximity. Option B is wrong because transaction expects events sorted in ascending _time order, not descending. Option C is wrong because transaction supports many options such as maxspan, maxpause, maxevents, and mvlist, not just startswith/endswith. Option D is wrong because the by clause is optional; transaction can group events using only time-based constraints.

Answer

It requires events to be sorted by _time in descending order.

Answer

It can only be used with 'startswith' and 'endswith' options.

Answer

It requires at least one field in the 'by' clause.

Question 3

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 4

A security analyst wants to calculate the average latency for each web server over the past hour, but only for requests where the status code is 200. The search result includes fields: server, latency, status. Which search correctly accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(latency) by server. It filters events to only those with status=200 before the stats command, ensuring the average latency is calculated exclusively over successful requests. The stats command then computes the average latency grouped by server, which directly answers the requirement without needing conditional logic or post-filtering.

Answer

index=web sourcetype=access | eval good_latency=if(status=200, latency, null) | stats avg(good_latency) by server

Answer

index=web sourcetype=access | eventstats avg(latency) by server | where status=200

Answer

index=web sourcetype=access | stats avg(latency) by server | where status=200

Question 5

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

Accepted Answer

Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.. When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.

Answer

The transaction command failed to group events properly and returned only the login event.

Answer

The transaction command is processing events out of order, causing login and logout timestamps to be the same.

Answer

The maxevents=5 limitation causes the transaction to close early, but the logged duration is still calculated correctly from the first event timestamp.

Question 6

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. For a lookup definition to work, the CSV file must be placed in the lookups directory of the same app where the transforms.conf is defined. Splunk looks for lookup files relative to the app's directory structure, so the file must reside in $SPLUNK_HOME/etc/apps/<app_name>/lookups/. This ensures the lookup is properly scoped and accessible to the app's configuration.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.

Question 7

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 8

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 9

An analyst runs `transaction user_id` to correlate events from a web server. The resulting transaction events have a field 'duration' that shows the time between the first and last event. However, some transactions span over 30 minutes. What transaction option should be added to limit the maximum time between the first and last event?

Accepted Answer

maxspan=30m. The maxspan option sets the maximum time span from the first event to the last event in a transaction.

Answer

maxpause=30m

Answer

maxevents=30

Answer

contime=30m

Question 10

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. It uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10