SPLK-1002 Practice Test 8 — 10 Questions

Question 1

A Splunk search uses 'transaction' with a large dataset and causes a 'max transaction' error. What is the most likely cause and best practice to avoid it?

Accepted Answer

The number of open transactions exceeds the limit; use fields to reduce cardinality or increase maxopentxn.. The 'max transaction' error occurs when the number of open transactions exceeds the default limit (maxopentxn) during a transaction search. The best practice is to reduce the cardinality of the transaction by using fields to group events more efficiently, or to increase the maxopentxn limit if appropriate. This error is about the number of concurrent open transactions, not about maxspan or maxevents.

Answer

The transaction command is used on non-indexed fields; use indexed fields instead.

Answer

The maxspan value is too low; increase maxspan.

Answer

The maxevents value is too low; increase maxevents.

Question 2

Which TWO of the following statements about lookup tables in Splunk are true?

Accepted Answer

KV Store lookups require defining a collection in collections.conf.. Option C is correct because KV Store lookups are backed by MongoDB collections that must be declared in collections.conf (with the stanza name matching the collection) before the lookup definition in transforms.conf can reference it. Option D is correct because CSV lookups read the file at search time, so replacing the CSV file (or uploading a new version via Settings > Lookups) takes effect immediately without restarting Splunk. Option A is wrong because lookups can overwrite existing field values when the lookup output field name matches an event field. Option B is wrong because external lookups can run scripts or binaries that return data from virtually any source, not just CSV. Option E is wrong because lookup files can live in any app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/<app>/lookups/) as well as system/lookups.

Answer

Lookups can only add new fields to events; they cannot replace existing field values.

Answer

External lookups can only retrieve data from CSV files.

Answer

Lookup files can only be stored in $SPLUNK_HOME/etc/system/lookups/.

Question 3

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

Accepted Answer

index=main | transaction user_id maxpause=15m | stats avg(duration). The transaction command with maxpause=15m groups events by user_id into sessions, closing a session when there is a gap of more than 15 minutes between events. The resulting transaction events include a duration field, and stats avg(duration) correctly computes the average session duration.

Answer

index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

Answer

index=main | transaction user_id maxpause=15 | stats avg(_time)

Answer

index=main | transaction user_id maxspan=15m | stats avg(duration)

Question 4

A systems engineer creates a summary index using a saved search that runs every 30 minutes. The summary index aggregates data from multiple sourcetypes. After a week, the engineer notices that the summary index contains duplicate events for certain time ranges. What is the most likely cause?

Accepted Answer

The summary index time range extends beyond the schedule interval, causing overlapping windows.. Duplicate events in a summary index typically occur when the saved search's time range overlaps between scheduled runs. If the search runs every 30 minutes but its time range covers, say, the last hour, each run re-summarizes events already captured in the previous run, producing duplicates. The fix is to align the search time range with the schedule interval (e.g., use '-30m to now' for a 30-minute schedule) or use a deduplication approach.

Answer

The macro used in the saved search includes a time zone conversion that shifts events.

Answer

The saved search schedule is set to run at the wrong time.

Answer

The summary index acceleration is enabled, causing automatic re-summarization.

Question 5

A search uses the transaction command with maxevents=1000 and maxspan=1h. The search is slow and memory-intensive. Which modification can reduce resource usage while still grouping related events?

Accepted Answer

Reduce maxevents to 100.. Reducing maxevents to 100 limits the number of events that the transaction command groups into a single transaction, which directly reduces memory consumption and processing overhead. This modification still allows related events to be grouped together, but with a smaller batch size, making the search less resource-intensive while preserving the core grouping logic.

Answer

Use eventstats with a time window.

Answer

Use tstats instead of transaction.

Answer

Increase maxspan to 2h.

Question 6

Order the steps to set up a data input for monitoring a log file in Splunk.

Accepted Answer

Navigate to Settings > Add Data, then select 'Monitor' as input type, then specify the log file path, then set the source type and index.. Adding a file monitor involves selecting the input type, specifying the file, and configuring source type and index.

Answer

Navigate to Settings > Add Data, then specify the log file path, then select 'Monitor' as input type, then set the source type and index.

Answer

Navigate to Settings > Add Data, then set the source type and index, then select 'Monitor' as input type, then specify the log file path.

Answer

Select 'Monitor' as input type, then navigate to Settings > Add Data, then specify the log file path, then set the source type and index.

Question 7

A search uses 'transaction' to group events by session, but the results show too many transactions with only one event. What is the best way to filter out single-event transactions?

Accepted Answer

| transaction ... | where eventcount > 1. The `transaction` command groups events into transactions, and appending `| where eventcount > 1` filters out any transaction that consists of only a single event. This directly addresses the requirement to remove single-event transactions, as `eventcount` is a default field added by `transaction` that counts the number of events in each transaction.

Answer

Add maxspan=5m to the transaction command

Answer

| transaction maxevents=2 ...

Answer

| transaction ... | where eventcount=2

Question 8

Which of the following are characteristics of the Splunk Common Information Model (CIM)? (Choose three.)

Accepted Answer

It requires the installation of the Splunk Common Information Model Add-on. Option B is correct because the CIM is delivered as the Splunk Common Information Model Add-on, which must be installed (typically alongside the Splunk Common Information Model app) to provide the data models and knowledge objects that normalize data. Option C is correct because CIM data models support acceleration, which precomputes and stores model results in summary form to speed up searches that reference the data models. Option D is correct because the CIM's core purpose is to define standard field names, event categories, and tags so that data from different sources can be searched consistently. Option A is not correct because the CIM does not automatically rename fields; field aliases, calculated fields, and lookups must be configured to map raw fields to CIM names. Option E is not correct because predefined dashboards and reports are not a defining characteristic of the CIM itself; the CIM focuses on data models, field standards, and tags.

Answer

The CIM automatically renames all fields in incoming data to match its standard

Answer

The CIM includes predefined dashboards and reports

Question 9

A saved search is configured to run every hour and generate a summary index. The original search returns data that is then summarized. Which of the following best describes the purpose of summary indexing?

Accepted Answer

To speed up searches by pre-aggregating data into smaller datasets. Summary indexing runs a scheduled search and stores its results in a separate summary index, so future searches can query the much smaller pre-aggregated dataset instead of scanning massive raw event volumes. This dramatically speeds up reporting and dashboard searches over long time ranges by trading storage for query performance.

Answer

To reduce disk space usage by compressing raw data

Answer

To create real-time alerts based on historical data

Answer

To normalize data to the CIM

Question 10

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]