SPLK-1002 Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

Accepted Answer

It closes the transaction if there is no new event from the same clientip within 5 minutes.. maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Answer

It limits the number of events in a transaction to 5.

Answer

It limits the total time span of each transaction to 5 minutes.

Answer

It pauses the search for 5 minutes between transactions.

Question 2

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

Accepted Answer

maxspan=30m, maxpause=10m. The maxspan=30m parameter ensures that the transaction does not exceed 30 minutes total, matching the session duration. The maxpause=10m parameter closes the transaction if there is no activity for more than 10 minutes, which aligns with the requirement to end the transaction after 10 minutes of inactivity. Together, they correctly group events for the web session.

Answer

maxspan=30m, maxpause=5m

Answer

maxspan=10m, maxpause=30m

Answer

maxspan=1h, maxpause=10m

Question 3

In a Splunk environment, an analyst is using the transaction command to group events from different sources. Which THREE factors are most important to consider when designing the transaction search for optimal performance? (Choose three.)

Accepted Answer

Apply efficient search-time field extractions to avoid using the transaction command across unindexed fields.. Options C, D, and E are correct. Efficient search-time field extractions (C) reduce the overhead of the transaction command by avoiding unindexed field lookups. Limiting the time range with maxspan (D) narrows the search window, reducing the number of events to process. Using fields with low cardinality for grouping (E) minimizes the number of open transactions and memory usage. Option A (mvlist) is not a standard transaction option and does not improve performance; Option B (large maxevents) can degrade performance by consuming excessive memory.

Answer

Use the 'mvlist' option to store multiple values.

Answer

Use a large maxevents value to ensure all events are captured.

Question 4

A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?

Accepted Answer

Specify exact field names instead of wildcards. Using wildcard field names in the transaction command (e.g., *id) forces Splunk to scan all fields to find matches, which is inefficient and can cause poor performance. Specifying exact field names allows Splunk to directly access the relevant fields, reducing processing overhead and improving search speed. This is the best practice for optimizing transaction performance.

Answer

Use `transaction *id, nullif=null`

Answer

Increase maxopentxn in limits.conf

Answer

Replace transaction with stats

Question 5

What is the purpose of an automatic lookup?

Accepted Answer

To automatically apply a lookup to events based on a source type or index at search time.. An automatic lookup in Splunk applies a lookup table to events at search time based on the event's source type, source, or host, without requiring the user to type the lookup command. It enriches incoming events transparently by matching fields like src_ip to a CSV of asset owners. This is exactly what option D describes.

Answer

To automatically validate lookup field names.

Answer

To automatically update a lookup file when the CSV changes.

Answer

To automatically create a lookup table from search results.

Question 6

A security analyst wants to create a visualization that shows the count of failed login attempts per user over the last 7 days. Which visualization type is most appropriate?

Accepted Answer

Bar chart with users on x-axis and count on y-axis. A bar chart with users on the x-axis and count on the y-axis is the most appropriate visualization for comparing the count of failed login attempts per user. Bar charts excel at comparing categorical values (users) against a numeric measure (count), making differences between users immediately visible.

Answer

Pie chart showing proportion of attempts per user

Answer

Line chart with time on x-axis and count on y-axis

Answer

Scatter chart showing correlation between user and time

Question 7

A Splunk user wants to group web server logs into transactions representing a single user visit, where a visit starts with a 'GET' request and ends with a 'POST' request. Which transaction command syntax correctly implements this logic?

Accepted Answer

transaction startswith="GET" endswith="POST". The `transaction` command with `startswith="GET"` and `endswith="POST"` correctly groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit. Options A and D add unnecessary constraints (`maxevents=2` or `by src_ip`) that alter the intended grouping logic, and option B reverses the start and end events, which does not match the specified visit flow.

Answer

transaction startswith="GET" endswith="POST" maxevents=2

Answer

transaction startswith="POST" endswith="GET"

Answer

transaction by src_ip startswith="GET" endswith="POST"

Question 8

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Option B is correct because setting an appropriate (narrow) time range limits the amount of data scanned, which reduces search cost and improves performance, especially for saved searches that run repeatedly. Option C is correct because summary indexing precomputes and stores results of frequently run searches, so subsequent runs read the smaller summary index instead of re-scanning raw data, dramatically improving efficiency. Option E is correct because descriptive names that indicate the search's purpose make saved searches easier to identify, manage, share, and maintain across a team. Option A is not a best practice because saved searches are often scheduled deliberately to automate reporting and alerting, and simply not scheduling them does not address search efficiency. Option D is not a best practice because relying on the default time range can cause unpredictable or overly broad data scans; an explicit, appropriate time range should be set instead.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 9

Which TWO search commands can be used to calculate a running total (cumulative sum) of a field over time?

Accepted Answer

accum. Option B, accum, is correct because it computes a running (cumulative) total of a numeric field across events in the order they are processed, adding each event's value to the sum of all preceding events. Option D, streamstats, is correct because it calculates cumulative statistics such as sum() over a streaming window, and with sum(field) it produces a running total across events in order. Option A, delta, is incorrect because it computes the difference between consecutive field values, not a cumulative sum. Option C, transaction, is incorrect because it groups related events into transactions based on fields or time, not a running total. Option E, eventstats, is incorrect because it adds aggregate statistics (like an overall sum) to every event rather than a cumulative running total.

Answer

delta

Answer

transaction

Answer

eventstats

Question 10

Refer to the exhibit. The search returns results quickly but shows zero events for some src values. What does `summariesonly=t` imply?

Accepted Answer

It restricts tstats to only use data from accelerated data model summaries.. `summariesonly=t` in a `tstats` command restricts the search to only use data from accelerated data model summaries, ignoring raw event data. This is why the search returns quickly but shows zero events for some `src` values—those values are not present in the accelerated summaries, so they are excluded from the results.

Answer

It causes tstats to search the index directly.

Answer

It makes the search run faster but less accurate.

Answer

It forces tstats to return all events, including those not in summaries.