SPLK-1003 Timed Practice Test 2 — 10 Questions

Question 1

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 2

An analyst wants to find the top 5 users who have the highest total bytes transferred. The data has fields 'user' and 'bytes'. Which search should be used?

Accepted Answer

| stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5. Option B is correct because it uses `stats sum(bytes) as total_bytes by user` to aggregate the total bytes transferred per user, then sorts the results in descending order with `sort - total_bytes`, and finally limits the output to the top 5 users with `head 5`. This directly answers the requirement for the highest total bytes transferred.

Answer

| stats max(bytes) as max_bytes by user | sort - max_bytes | head 5

Answer

| sort - bytes | head 5 | table user, bytes

Answer

| top limit=5 user

Question 3

The search above is executed but returns unexpected results: the count for 'API' is much lower than expected. What is the most likely cause?

Answer

The stats command should use 'count by category' but category is not a field until after eval.

Answer

The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'.

Answer

The case function has a default condition '1==1' that overrides all other conditions.

Question 4

A security analyst wants to find all events where the field 'src_ip' matches any IP address in a lookup table named 'malicious_ips.csv'. The lookup has fields 'ip' and 'threat'. Which search correctly enriches events with the threat info and filters to only malicious IPs?

Accepted Answer

`index=security | lookup malicious_ips.csv src_ip AS ip OUTPUTNEW threat | where isnotnull(threat)`. Option E is correct because it uses the `lookup` command with `OUTPUTNEW threat` to add the threat field only for matching src_ip values, and then `where isnotnull(threat)` filters to events that actually matched, ensuring only events with a known malicious IP are retained. The `OUTPUTNEW` clause is critical here as it only populates the threat field when a match occurs, unlike `OUTPUT` which would overwrite existing values.

Answer

`index=security | lookup malicious_ips.csv src_ip | search threat=*`

Answer

`index=security | lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""`

Answer

`index=security [| inputlookup malicious_ips.csv | fields ip | rename ip as src_ip]`

Answer

`index=security | lookup malicious_ips.csv src_ip AS ip | where isnotnull(threat)`

Question 5

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. Option B is correct because a data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 6

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. Option D is correct because the CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 7

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

Accepted Answer

The lookup definition name does not match the filename.. The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Answer

The engineer lacks permissions to read the lookup.

Answer

The lookup file is not in the correct directory.

Answer

The lookup file has a .csv extension but contains other data.

Question 8

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. Option A is correct because the `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 9

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 10

Which TWO are valid methods to join data from a CSV file in a Splunk search?

Accepted Answer

`| lookup myfile.csv`. Option C is correct because the `| lookup` command can reference a CSV file defined as a lookup table in Splunk, allowing field-based enrichment of search results. This is a standard method for joining data from a CSV file within a search, provided the lookup is properly configured in transforms.conf and props.conf.

Answer

`| append myfile.csv`

Answer

`| join myfile.csv`

Answer

`| csvlookup myfile.csv`