SPLK-1002 Practice Test 9 — 10 Questions

Question 1

Which TWO of the following searches are syntactically valid uses of the eventstats command? (Assume all referenced fields exist.)

Accepted Answer

| eventstats sum(bytes) as total_bytes by src_ip | eval pct = bytes/total_bytes*100. The `eventstats` command calculates aggregate statistics (here, `sum(bytes)`) over the entire result set or by group (here, `by src_ip`), and it adds the result as a new field (`total_bytes`) to every event. This allows the subsequent `eval` to compute a per-event percentage using that new field. Option C is correct because `eventstats` without a `by` clause computes the aggregate over all events and adds the result (here, `avg`) to each event, enabling the `eval` to calculate the difference from the global average.

Answer

| eventstats perc95(response_time) by host | eval p95 = perc95

Answer

| eventstats values(user) as users by session_id | eval num_users = len(users)

Answer

| eventstats max(_time)last_time by user | table last_time

Question 2

A Splunk administrator is troubleshooting a search that uses the transaction command to group login and logout events. The search runs but returns no results even though both types of events exist. The events are separated by at most 5 minutes. The current transaction command is:

`index=auth (action=login OR action=logout) | transaction action maxspan=10m maxpause=2s`

What is the most likely cause?

Accepted Answer

The maxpause value is too small; events may be more than 2 seconds apart.. The maxpause=2s parameter defines the maximum allowed gap between consecutive events in a transaction. If the actual time between a login and its corresponding logout event exceeds 2 seconds, the transaction command will close the transaction prematurely, treating the logout as the start of a new transaction. Since the events are separated by at most 5 minutes but could be more than 2 seconds apart, the maxpause value is too restrictive, causing the transaction to never complete with both events.

Answer

The maxspan value is too large, causing events to be grouped incorrectly.

Answer

The transaction command requires the connected=true argument to group events.

Answer

The transaction command requires keepevents=true to retain all events.

Question 3

Which THREE of the following are valid uses of the stats command? (Select three.)

Accepted Answer

Calculating the average of a field across all events.. The `stats` command in Splunk is used to perform statistical aggregations on search results. Option A is correct because `stats avg(field)` calculates the arithmetic mean of a specified field across all events in the result set. Option B is correct because `stats earliest(_time) by category` returns the minimum timestamp for each distinct value of the category field, which is a standard use of the `earliest()` function. Option C is correct because `stats count by category` groups events by the categorical field and returns the number of events in each group, a fundamental aggregation pattern.

Answer

Creating a time-based chart with multiple series.

Answer

Enriching events with fields from an external lookup.

Question 4

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. The 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 5

A Splunk environment ingests 10 TB per day. A user runs a search to count events per sourcetype over the last 7 days: `index=* earliest=-7d | timechart count by sourcetype`. The search returns partial results and eventually times out. The user needs to obtain the complete results efficiently. What is the best course of action?

Accepted Answer

Use `| tstats count where index=* earliest=-7d by _time span=1d, sourcetype` and then format as needed.. `tstats` runs on indexed metadata (tsidx files) rather than raw events, making it far more efficient for counting events over large time ranges. By specifying `by _time span=1d, sourcetype`, you get daily counts per sourcetype without scanning the entire event data, avoiding the timeout that occurs with a raw search over 10 TB/day for 7 days.

Answer

Use `| bucket span=1d | stats count by _time sourcetype` then `| xyseries` to format.

Answer

Use `| sitime` to sample the data and approximate counts.

Answer

Break the search into 1-day intervals and use `append` to combine results.

Question 6

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. The CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 7

The exhibit shows a search that reads a lookup file. Which of the following must be true for this search to work correctly?

Accepted Answer

The lookup must be defined in transforms.conf. For a lookup to work in a Splunk search, it must be defined in transforms.conf. This configuration file specifies the lookup type (e.g., file-based, KV-store, external), the filename, the field mapping, and other parameters. Without this definition, Splunk cannot resolve the lookup command or the lookup table reference in the search string, even if the file exists on disk.

Answer

The lookup file must be stored on the indexer

Answer

The file must be in the default lookup directory

Answer

The file server_status.csv must be in the $SPLUNK_HOME/etc/apps/search/lookups directory

Question 8

Refer to the exhibit. Which statement about this search is true?

Accepted Answer

It adds geographical info based on src_ip and then aggregates bytes by dest_ip and country.. The search uses `iplocation` to add geographical fields (like Country, City) based on the `src_ip` field, then renames `src_ip` to `src` and uses `stats` to aggregate bytes by `dest_ip` and the newly added `Country` field. This matches option D exactly.

Answer

It fails because iplocation requires a lookup table to be defined.

Answer

It uses iplocation to add geographical information about the destination IP.

Answer

It only includes events where src_ip is a valid IP address.

Question 9

A network operations team uses Splunk to analyze firewall logs. They need to identify top talkers (source IPs with highest total bytes) over the last hour. The current search: 'index=firewall | stats sum(bytes) as totalBytes by src_ip | sort -totalBytes | head 10' takes 5 minutes to complete. They want to make it faster. The environment has 5 indexers with default configurations. The data volume is 100 GB/day. Which action will most improve search performance?

Accepted Answer

Add 'earliest=-1h' to the search to restrict the time range explicitly.. Explicitly adding 'earliest=-1h' restricts the search to the last hour at the search head level, allowing Splunk to use time-based index metadata to skip irrelevant buckets entirely. Without an explicit time range, Splunk may scan all available data, dramatically increasing I/O and search time. This is the most impactful optimization for time-bound searches over large datasets.

Answer

Replace head 10 with limit 10 at the end of the pipeline.

Answer

Use map to run the search per indexer.

Answer

Set the search's parallelism to 'auto' in the commands.

Question 10

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.