SPLK-1003 Advanced Searching and Statistics Practice Test 3 — 15 Questions

Question 1

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Option B is correct because replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 2

Arrange the steps to create a new index in Splunk in the correct order.

Question 3

Arrange the steps to create a knowledge object of type 'Event Type' in Splunk.

Question 4

Arrange the steps to configure role-based access control in Splunk.

Question 5

Match each Splunk search command to its primary function.

Question 6

Match each Splunk search operator to its behavior.

Question 7

Match each Splunk report type to its description.

Question 8

A security analyst needs to find the top 10 users with the most failed login attempts from the linux_secure sourcetype. Which SPL command is most efficient for this task?

Accepted Answer

index=main sourcetype=linux_secure "Failed password" | top limit=10 user. Option A is correct because the `top` command in SPL is specifically designed to return the most frequent values of a field, and the `limit=10` parameter directly restricts the output to the top 10 results. This approach is more efficient than using `stats count` followed by `sort` and `head` because `top` performs the aggregation and ranking in a single operation, reducing processing overhead. The search also correctly filters for 'Failed password' events within the `linux_secure` sourcetype, ensuring only failed login attempts are considered.

Answer

index=main sourcetype=linux_secure "Failed password" | stats count by user | sort 10 -count

Answer

index=main sourcetype=linux_secure "Failed password" | stats count by user | sort -count | head 10

Answer

index=main sourcetype=linux_secure | regex _raw="Failed password" | stats count by user | top limit=10

Question 9

A search returns 50,000 events. The analyst wants to sample 1% evenly across time. Which sampling command should be used?

Accepted Answer

sample method=random ratio=0.01. Option B is correct because the `sample` command with `method=random` and `ratio=0.01` performs a random sampling of exactly 1% of events, and when used without a `by` clause, it distributes the sampling evenly across time by default. This ensures a statistically representative subset of the 50,000 events, preserving temporal distribution.

Answer

sample 0.01

Answer

sample method=block ratio=0.01

Answer

sample ratio=0.01

Question 10

Which of the following searches correctly computes the average response time per host?

Accepted Answer

index=main | stats mean(response_time) by host. Option A is correct because the `stats` command with `mean(response_time)` calculates the arithmetic mean of the response_time field, and the `by host` clause groups the calculation per host, producing the average response time for each host. This is the standard Splunk syntax for computing averages in a grouped statistics table.

Answer

index=main | stats average(response_time) by host

Answer

index=main | eventstats avg(response_time) by host

Answer

index=main | stats avg response_time by host

Question 11

Which command adds the overall average of a field to each event in the results?

Accepted Answer

eventstats avg(latency) as avg_latency. The `eventstats` command computes aggregate statistics (like `avg(latency)`) over the entire result set and adds the result as a new field to every event, preserving all original events. This matches the requirement to add the overall average to each event. In contrast, `stats` collapses events into a single summary row, `streamstats` computes a running average per event, and `timechart` produces a time-based chart, none of which add the overall average to every original event.

Answer

streamstats avg(latency) as avg_latency

Answer

timechart avg(latency) as avg_latency

Answer

stats avg(latency) as avg_latency

Question 12

A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?

Accepted Answer

They are split into separate transactions because the gap exceeds maxpause.. The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.

Answer

They are merged because maxpause is 5s but maxspan is 30s, so the 10s gap is within maxspan.

Answer

They are considered part of the same transaction as long as total span ≤ 30s.

Answer

They are split only if the total span exceeds maxspan.

Question 13

Which command extracts a field named 'ip' from the raw event using a regex pattern?

Accepted Answer

rex "ip=(?\d+\.\d+\.\d+\.\d+)". Option B is correct because the `rex` command uses the named capture group syntax `(?...)` to extract a field named 'ip' from the raw event. The pattern `(?\d+\.\d+\.\d+\.\d+)` matches an IPv4 address and assigns it to the field 'ip'. By default, `rex` operates on the `_raw` field, so no explicit `field=_raw` is needed, and the syntax `(?...)` is the correct Splunk named capture group syntax.

Answer

rex "ip=(?\d+\.\d+\.\d+\.\d+)"

Answer

rex field=_raw "ip=(?P<ip>\d+\.\d+\.\d+\.\d+)"

Answer

rex field=_raw "ip=(?<ip>\d+\.\d+\.\d+\.\d+)"

Question 14

Which command returns the list of all sourcetypes in a specific index?

Accepted Answer

| metadata type=sourcetypes index=main. Option D is correct because the `| metadata` command with `type=sourcetypes` retrieves a list of all sourcetypes present in a specified index, along with their earliest and latest timestamps. This command queries the index metadata directly, making it the appropriate tool for listing sourcetypes within a given index.

Answer

| sourcetype count index=main

Answer

| eventtype count index=main

Answer

| metasearch index=main sourcetype=*

Question 15

A search produces a field 'count'. You need to find the event with the maximum count. Which approach is correct?

Accepted Answer

| eventstats max(count) as maxcount | where count = maxcount. Option A is correct because it uses `eventstats` to compute the maximum count across all events, storing it in a new field `maxcount`, and then filters the events where the original `count` equals that maximum. This approach preserves the full event data for the event(s) with the highest count, which is necessary when you need to retrieve the entire event, not just the aggregated value.

Answer

Both B and C work.

Answer

| sort -count | head 1

Answer

| stats max(count) as maxcount