SPLK-1002 Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

Accepted Answer

The `search` command should be `where` to use wildcard on extracted fields.. The search uses `search ip=10.0*` which attempts to apply a wildcard pattern to an extracted field. However, the `search` command does not support wildcards for field-value comparisons; it treats `10.0*` as a literal string. To use wildcards on extracted fields, the `where` command with a `like` operator (e.g., `where ip like "10.0%"`) or a regex match is required. This is why option C is correct.

Answer

The regex pattern is incorrect.

Answer

The field 'ip' is not extracted properly.

Answer

The index should be specified at the beginning of the search.

Question 2

A user creates a lookup definition for a CSV file containing user roles. The lookup is used in a search: `| lookup user_roles username OUTPUT role`. The search returns no additional field. The lookup file has columns: 'username', 'role', 'department'. What is the MOST likely issue?

Accepted Answer

The lookup definition uses a different filename than the CSV.. The lookup definition must reference the exact filename of the CSV file. If the definition points to a different filename than the actual CSV, the lookup will fail to load the file, and no fields will be returned. The search syntax is otherwise correct, so the issue lies in the mismatch between the definition and the file.

Answer

The username field in the search is not extracted.

Answer

The lookup file is not in the lookups directory.

Answer

The 'role' field is misspelled in the search.

Question 3

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The same clientip can appear in multiple transactions, causing overcounting.. The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.

Answer

The sourcetype does not contain enough methods to satisfy the condition.

Answer

The stats command should use `dc(clientip)` instead of `count by clientip`.

Answer

The mvcount function counts the number of unique methods, not events.

Question 4

Match each Splunk component to its function.

Accepted Answer

Search Head: Distributes search requests and merges results from indexers.. In a Splunk distributed environment, the Search Head handles search distribution and result merging, the Indexer indexes and stores data, the Universal Forwarder collects and forwards data, and the Deployment Server manages configuration deployment. Common mistakes include swapping the roles of Search Head and Indexer, or confusing the Deployment Server with a forwarder.

Answer

Search Head: Indexes and stores incoming data.

Answer

Deployment Server: Lightweight forwarder that sends data to indexers.

Question 5

Which TWO of the following are valid methods to join two sets of search results?

Accepted Answer

join. The `join` command in Splunk merges two result sets based on a common field, similar to a SQL JOIN. It requires both datasets to have a matching field and supports inner, left, outer, and other join types. Option B is correct because the `append` command simply adds the results of a subsearch to the main search results, effectively concatenating the two sets without requiring a common field.

Answer

union

Answer

stats values(*)

Answer

addcoltotals

Question 6

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Accepted Answer

Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.. The correct optimization is Option C: replacing the transaction command with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'. The transaction command is inefficient because it groups all session events in memory and calculates duration, which consumes significant resources on 20 indexers with 2 TB/day. The stats approach is streaming and reduces data to one row per session before the eval and avg, drastically lowering memory and CPU usage. Option A (reducing time range to 1 hour) might help but doesn't address the core inefficiency and could miss sessions spanning longer than an hour. Option B (adding eventstats before transaction) adds extra processing without removing the bottleneck, still using transaction. Option D (removing maxspan) would allow sessions to remain open indefinitely, increasing memory consumption and potentially causing timeouts. Therefore, Option C is the most effective optimization.

Answer

Reduce the time range to 1 hour.

Answer

Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

Answer

Remove the maxspan parameter from the transaction command to allow longer sessions.

Question 7

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 8

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

Accepted Answer

maxpause=2m. Maxpause=2m (Option C). This option specifies the maximum period of inactivity between events in a transaction. When no events matching the transaction are received for 2 minutes, the transaction closes. This is ideal for correlating events with variable delays because it waits for activity and closes after a quiet period. In contrast, maxspan (option B) sets a total time window from the first event, which would close the transaction regardless of activity after 2 minutes from the start. Options A and D (startswith/endswith) define specific start and end events rather than a timeout. Thus, maxpause ensures the transaction remains open as long as events arrive within 2 minutes of each other.

Answer

endswith="end"

Answer

maxspan=2m

Answer

startswith="start"

Question 9

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 10

Which THREE of the following are correct about the transaction command's default behavior?

Accepted Answer

Transaction groups events by host, source, and sourcetype by default.. Options A, B, and C are correct. By default, the transaction command groups events by host, source, and sourcetype (A). It does not require startswith or endswith to be specified; you can use fields or other options (B). Transactions can evict partial transactions if maxpause is exceeded, meaning if no new events arrive within the maxpause period, the transaction is considered complete and evicted (C). Option D is false because transaction does not require all events to come from the same host; by default it uses host, source, sourcetype but you can override with fields. Option E is false because evicted transactions are not included in the results unless you use the keepevicted=true option.

Answer

Transaction requires all events to come from the same host.

Answer

Transaction always includes all evicted events in the results.