SPLK-1003 Timed Hard Questions — 25 Difficult Questions

Question 1

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Accepted Answer

It improves the ability to correlate events from different technologies.. Option A is correct because the Common Information Model (CIM) provides a standardized set of field names and event tags across different data sources, enabling correlation of events from disparate technologies (e.g., firewalls, IDS, endpoints) using common fields like 'dest_ip', 'src_ip', 'user', and 'action'. This normalization allows Splunk to join or relate events that share the same CIM-compliant fields, making it possible to build coherent security or operational stories across heterogeneous data.

Answer

It improves search performance by pre-aggregating data.

Answer

It provides built-in security monitoring use cases.

Answer

It eliminates the need for custom field extractions.

Question 2

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. Option A is correct because it uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 3

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

Accepted Answer

The lookup definition name does not match the filename.. The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Answer

The engineer lacks permissions to read the lookup.

Answer

The lookup file is not in the correct directory.

Answer

The lookup file has a .csv extension but contains other data.

Question 4

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 5

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 6

Which THREE of the following are best practices when using lookups in Splunk?

Accepted Answer

Use the lookup command instead of inputlookup when possible to reduce memory usage. Option A is correct because using the `lookup` command with the `local=t` argument (or when the lookup table is small enough to be loaded into memory) can reduce memory usage compared to `inputlookup`, which always loads the entire lookup file into memory. The `lookup` command can stream results and only loads necessary fields, making it more efficient for large datasets. This is a best practice to avoid out-of-memory errors in distributed search environments.

Answer

Store lookup tables in KV Store when the table has more than 1 million rows

Answer

Always use KV Store lookups for faster performance compared to CSV lookups

Question 7

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Option B is correct because using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 8

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. Option B is correct because the `transaction` command groups events by the `user` field, and the `maxspan=10m` parameter ensures the entire transaction (all three events) completes within 10 minutes. This allows the three actions (login, privilege escalation, sensitive file access) to occur in any order within that time window, but the security team's requirement is that they occur in sequence; however, `transaction` does not enforce order—it only groups events that share the same `user` and fall within the time span. For strict ordering, you would need to use `transaction` with `ordered=t` or a subsearch, but the question asks for grouping these three events into one transaction, and `transaction user maxspan=10m` is the correct SPL to group all events for the same user within 10 minutes.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 9

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

Accepted Answer

Increase maxpause to 2 minutes. Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Answer

Decrease maxspan to 30 seconds

Answer

Remove maxpause and use only maxspan

Answer

Group by destination IP instead of source IP

Question 10

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

Accepted Answer

The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.. The `search stage="*"` command filters out all transactions because `stage` is a multivalue field created by the `transaction` command. In Splunk, a multivalue field cannot be matched with a simple wildcard search like `stage="*"`; this search only returns events where `stage` is a single literal asterisk. To search for any value in a multivalue field, you must use `mvcount(stage)>0` or `search stage=*` (without quotes).

Answer

The transaction should group by user instead of src.

Answer

The case statement does not set stage for events that don't match either pattern.

Answer

The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.

Question 11

A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search:

`index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200`

This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?

Accepted Answer

The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.. Option D is correct because the `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.

Answer

The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.

Answer

The search lacks a `fields` command to include `user_id`, so the transaction fails.

Answer

The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.

Question 12

A Splunk administrator runs the following search to identify the top 5 users by total bytes transferred:

index=proxy sourcetype=webproxy
| stats sum(bytes) as total_bytes by user
| sort - total_bytes
| head 5

The search returns results, but the numbers seem inflated. On closer inspection, the 'bytes' field is a string type. What must be done to correct the search?

Accepted Answer

Use 'eval bytes_numeric = tonumber(bytes)' then 'stats sum(bytes_numeric) as total_bytes by user'.. Option B is correct because the `bytes` field is stored as a string, and `stats sum()` cannot perform arithmetic on string values — it would silently treat them as zero or concatenate them, leading to inflated results. The `tonumber()` function explicitly converts the string to a numeric type, enabling accurate summation. Using `eval` to create a new numeric field before `stats` is the standard approach in Splunk for this scenario.

Answer

Use 'convert num(bytes)' before stats.

Answer

Use 'where isnum(bytes)' to filter out non-numeric values before stats.

Answer

Use 'eval bytes = string(bytes)' before stats.

Question 13

A Splunk administrator runs the following search and notices that the results include events where the 'status' field is 200 or 404, but also includes events where the 'status' field is missing. What is the most efficient way to modify the search to exclude events where the 'status' field does not exist?

Accepted Answer

NOT ISNULL(status) (status=200 OR status=404). Option B is correct because it uses the `NOT ISNULL(status)` filter before the OR conditions, which efficiently excludes events where the `status` field does not exist. In Splunk, `ISNULL()` returns true if a field is missing or null, so `NOT ISNULL(status)` ensures only events with a defined `status` field are considered, and then the parentheses group the OR conditions correctly. This approach is more efficient than post-filtering because it reduces the result set early in the search pipeline.

Answer

status=200 OR status=404 | search status!=null

Answer

status=200 OR status=404 | where isnotnull(status)

Answer

status=200 OR status=404

Question 14

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

Accepted Answer

`... | timechart span=1h dc(user)`. Option C is correct because `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Answer

`... | stats dc(user) by _time span=1h`

Answer

`... | timechart span=1h dc(by user)`

Answer

`... | eval user=user | timechart span=1h count by user`

Answer

`... | timechart span=1h sum(count) by user`

Question 15

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. Option D is correct because the 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 16

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 17

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. Option C is correct because in Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 18

Which THREE are best practices for creating lookups in Splunk?

Accepted Answer

Use case-insensitive matching by default for user-facing lookups.. Option A is correct because using case-insensitive matching by default in user-facing lookups ensures that users do not need to worry about the case of the lookup key, which improves usability and reduces errors. In Splunk, this is configured via the `LOOKUP` command or in transforms.conf with the `case_sensitive_match = false` setting, which is the default behavior for most lookup types. This best practice avoids confusion when users query data with varying case formats, such as user names or hostnames.

Answer

Use wildcard matching in lookups for better performance.

Answer

Use a time-based lookup for static reference data.

Question 19

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. Option A is correct because the CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 20

A Splunk admin notices that a scheduled search using inputlookup is returning inconsistent results. The lookup file is stored on the search head and is updated via a script every 15 minutes. What is the most likely cause of the inconsistency?

Accepted Answer

The lookup file is cached and not automatically refreshed. The most likely cause is that the lookup file is cached by Splunk after the first read, and subsequent updates via the script do not automatically refresh the in-memory cache. By default, Splunk caches lookup files on the search head to improve performance, and changes to the file are not reflected until the cache expires or is manually cleared. This leads to inconsistent results when the scheduled search runs against a stale cached version.

Answer

The search head is not configured as a lookup server

Answer

The lookup file contains duplicate entries with different timestamps

Answer

The lookup file exceeds the maximum file size