SPLK-1002 Multiple Select — 10 Questions

Question 1

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Accepted Answer

The original number of events is preserved.. Option A is correct because eventstats enriches each original event with the computed aggregate values rather than collapsing the result set, so the original number of events is preserved. Option C is correct because the aggregated fields produced by eventstats are added to each event and can therefore be referenced in later commands such as where, eval, or sort. Option E is correct because, since each event retains its own fields plus the aggregate values, you can inspect individual event details alongside the aggregate statistics. Option B is incorrect because eventstats generally consumes more memory than stats, since it must retain and enrich every event instead of reducing them to aggregate rows. Option D is incorrect because eventstats is not always faster than stats; it typically performs additional work to attach aggregates to each event, so performance depends on the search.

Answer

It uses less memory than stats.

Answer

It is always faster than stats.

Question 2

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Option A is correct because a lookup's core purpose is to enrich events by pulling in additional fields from an external source (CSV, KV store, or a lookup definition) and appending them to the search results. Option D is correct because automatic lookups are defined in props.conf, where you specify the lookup name, the input field(s), and the output field(s) so the enrichment happens at search time without an explicit lookup command. Option E is correct because lookups can be backed by CSV files (file-based lookups) or by KV store collections (KV store lookups), both of which are valid lookup types in Splunk. Option B is wrong because lookups also support CIDR and wildcard matching, not just exact match. Option C is wrong because lookup data does not need to be indexed; it is referenced at search time from a file or KV store collection.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 3

Which three of the following are benefits of using the Common Information Model (CIM)? (Choose THREE.)

Accepted Answer

Ensures consistent field naming across data sources.. Option A is correct because CIM enforces a standardized set of field names and tags (e.g., src, dest, user, action) so that data from heterogeneous sources is normalized into consistent field naming across data sources, enabling searches and correlation to work uniformly. Option B is correct because CIM ships with pre-built data models for common domains such as Authentication, Network Traffic, Web, and Endpoint, which provide predefined objects, fields, and constraints that accelerate analytics without building schemas from scratch. Option E is correct because once data is mapped to CIM data models, dashboards, reports, and searches built against those models become portable and can be shared and reused across different environments and data sources. Option C is not correct because CIM still requires field aliases and lookups (custom field extractions or knowledge objects) to map raw source fields into the CIM-compliant names; it does not eliminate that mapping work. Option D is not correct because CIM is a normalization and modeling framework, not a compliance reporting engine, and it does not automatically generate compliance reports.

Answer

Reduces the need for custom field extractions.

Answer

Automatically generates reports for compliance.

Question 4

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. Option B, timechart, is correct because it produces a time-series visualization by bucketing events into time intervals (e.g., span=1d) and plotting aggregated values such as count or avg per bucket, which is exactly the time-series foundation needed for a week-over-week comparison. Option D, timewrap, is correct because it takes the output of a timechart and overlays or wraps multiple time periods (e.g., a 1-week span) so the current week and previous week can be compared side by side on the same chart. Used together, timechart builds the per-interval series and timewrap aligns the current and prior week for direct visual comparison. Option A, stats, is not correct here because it aggregates without producing a time-bucketed series, so it cannot by itself render a week-over-week time-series comparison. Option C, eventstats, is not correct because it adds aggregate values back to individual events rather than creating a time-series chart. Option E, appendcols, is not correct because it merely appends columns from a subsearch to the current results and does not perform time-period wrapping or time-series comparison.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 5

Which TWO of the following statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

It can add a 'duration' field to the result events.. Option A is correct because the transaction command supports the duration option, which adds a 'duration' field to each resulting transaction event showing the elapsed time between the first and last event in the group. Option E is correct because transaction groups events into a single result when they share common field values (specified via the by clause) and occur within a defined time span (maxspan/maxpause), reflecting logical and temporal proximity. Option B is wrong because transaction expects events sorted in ascending _time order, not descending. Option C is wrong because transaction supports many options such as maxspan, maxpause, maxevents, and mvlist, not just startswith/endswith. Option D is wrong because the by clause is optional; transaction can group events using only time-based constraints.

Answer

It requires events to be sorted by _time in descending order.

Answer

It can only be used with 'startswith' and 'endswith' options.

Answer

It requires at least one field in the 'by' clause.

Question 6

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 7

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 8

Which TWO of the following statements about lookup tables in Splunk are true?

Accepted Answer

KV Store lookups require defining a collection in collections.conf.. Option C is correct because KV Store lookups are backed by MongoDB collections that must be declared in collections.conf (with the stanza name matching the collection) before the lookup definition in transforms.conf can reference it. Option D is correct because CSV lookups read the file at search time, so replacing the CSV file (or uploading a new version via Settings > Lookups) takes effect immediately without restarting Splunk. Option A is wrong because lookups can overwrite existing field values when the lookup output field name matches an event field. Option B is wrong because external lookups can run scripts or binaries that return data from virtually any source, not just CSV. Option E is wrong because lookup files can live in any app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/<app>/lookups/) as well as system/lookups.

Answer

Lookups can only add new fields to events; they cannot replace existing field values.

Answer

External lookups can only retrieve data from CSV files.

Answer

Lookup files can only be stored in $SPLUNK_HOME/etc/system/lookups/.

Question 9

Which of the following are characteristics of the Splunk Common Information Model (CIM)? (Choose three.)

Accepted Answer

It requires the installation of the Splunk Common Information Model Add-on. Option B is correct because the CIM is delivered as the Splunk Common Information Model Add-on, which must be installed (typically alongside the Splunk Common Information Model app) to provide the data models and knowledge objects that normalize data. Option C is correct because CIM data models support acceleration, which precomputes and stores model results in summary form to speed up searches that reference the data models. Option D is correct because the CIM's core purpose is to define standard field names, event categories, and tags so that data from different sources can be searched consistently. Option A is not correct because the CIM does not automatically rename fields; field aliases, calculated fields, and lookups must be configured to map raw fields to CIM names. Option E is not correct because predefined dashboards and reports are not a defining characteristic of the CIM itself; the CIM focuses on data models, field standards, and tags.

Answer

The CIM automatically renames all fields in incoming data to match its standard

Answer

The CIM includes predefined dashboards and reports

Question 10

In a Splunk environment, an analyst is using the transaction command to group events from different sources. Which THREE factors are most important to consider when designing the transaction search for optimal performance? (Choose three.)

Accepted Answer

Apply efficient search-time field extractions to avoid using the transaction command across unindexed fields.. Options C, D, and E are correct. Efficient search-time field extractions (C) reduce the overhead of the transaction command by avoiding unindexed field lookups. Limiting the time range with maxspan (D) narrows the search window, reducing the number of events to process. Using fields with low cardinality for grouping (E) minimizes the number of open transactions and memory usage. Option A (mvlist) is not a standard transaction option and does not improve performance; Option B (large maxevents) can degrade performance by consuming excessive memory.

Answer

Use the 'mvlist' option to store multiple values.

Answer

Use a large maxevents value to ensure all events are captured.