SPLK-1001 Practice Test 21 — 15 Questions

Question 1

A NOC analyst needs to display the 20 slowest web transactions from the last hour in a Splunk search. The events contain a numeric field named response_time_ms. The analyst wants the output to show the largest response_time_ms values first. Which SPL search accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=web sourcetype=access_combined earliest=-1h | sort - response_time_ms | head 20. Sorting by the response_time_ms field with a leading minus sign orders the largest values first, and head 20 then returns only those top rows. The command sequence is critical: the sort must occur before the limiting command so that the entire result set is considered. Reversing the sort sign or using top would produce the wrong set of transactions.

Answer

index=web sourcetype=access_combined earliest=-1h | sort + response_time_ms | head 20

Answer

index=web sourcetype=access_combined earliest=-1h | top limit=20 response_time_ms

Answer

index=web sourcetype=access_combined earliest=-1h | head 20 | sort - response_time_ms

Question 2

An analyst wants to create a report that shows the average response time for each HTTP status code over the past week, but only for status codes that appear more than 100 times. The events contain fields named status and response_time. Which search produces the required report?

Accepted Answer

index=web earliest=-7d | stats avg(response_time) as avg_rt count by status | where count > 100. The report requires two aggregations, average response time and event count, grouped by status, followed by a filter on the count. The stats command computes both values in one pass, and the where command then filters the aggregated rows to those with count greater than 100. Filtering before aggregation or using search for the numeric comparison leads to incorrect results.

Answer

index=web earliest=-7d | stats avg(response_time) as avg_rt count by status | search count > 100

Answer

index=web earliest=-7d | where count > 100 | stats avg(response_time) as avg_rt count by status

Answer

index=web earliest=-7d | stats avg(response_time) as avg_rt by status | search count > 100

Question 3

A Splunk user wants to calculate the 95th percentile of response times for each API endpoint from a set of logs. The events contain fields 'endpoint' and 'response_time'. Which search will produce this result?

Accepted Answer

index=api | stats p95(response_time) by endpoint. The stats command with the p95 function calculates the 95th percentile of a numeric field. When combined with a by clause, it groups the results by the specified field, producing a table with each endpoint and its 95th percentile response time. The other options calculate different statistics or use eventstats, which does not produce a summary table.

Answer

index=api | stats median(response_time) by endpoint

Answer

index=api | eventstats p95(response_time) by endpoint

Answer

index=api | stats avg(response_time) by endpoint

Question 4

A Splunk administrator is reviewing a search that uses several commands and wants to identify which of the following are transforming commands that will change the result set into a statistical table. (Choose two.)

Accepted Answer

top. Transforming commands convert events into a statistical table by aggregating data. The stats and top commands both perform aggregation and produce summarized results, making them transforming commands. The eval, table, and rename commands modify or display fields but do not aggregate, so they are not transforming commands.

Answer

table

Answer

eval

Answer

rename

Question 5

A security analyst needs to enrich web proxy events by adding a department name to each event. The events already contain a field named 'src_user', and a CSV lookup named 'user_departments' contains the columns 'username' and 'department'. The analyst wants the department value added to every matching event without removing any existing fields. Which search command should the analyst use?

Accepted Answer

lookup user_departments username AS src_user OUTPUT department. The lookup command enriches events by matching event fields against lookup table columns. Because the event field is src_user and the lookup column is username, the AS clause is required to map them. OUTPUT department adds only the department field and preserves all existing fields, which matches the analyst's requirement exactly.

Answer

lookup user_departments username AS src_user REPLACE department

Answer

lookup user_departments src_user OUTPUT department

Answer

lookup user_departments username AS src_user OUTPUTNEW department

Question 6

A security analyst runs a search that returns events from a firewall sourcetype. The analyst wants to add a field called 'priority' to each event, using values stored in a CSV lookup file named 'priority_map.csv' that contains the fields 'severity' and 'priority'. The events already contain a 'severity' field. Which search command should the analyst use to add the 'priority' field to the events?

Accepted Answer

lookup priority_map.csv severity OUTPUT priority. The lookup command enriches events by matching event field values to a lookup table and adding specified output fields. Here, the event field 'severity' matches the lookup's 'severity' column, and the OUTPUT clause adds the 'priority' column to each event. This is the standard method for adding lookup-derived fields without altering the original event data or replacing the result set.

Answer

inputlookup priority_map.csv severity OUTPUT priority

Answer

lookup priority_map.csv severity AS priority

Answer

outputlookup priority_map.csv severity OUTPUT priority

Question 7

A Splunk user needs to create a timechart that shows the number of successful and failed login attempts per hour over the last 24 hours, with separate lines for success and failure. The events contain an action field with values 'success' and 'failure'. Which search produces the required timechart?

Accepted Answer

index=auth earliest=-24h | timechart span=1h count by action. A timechart with separate lines per action value is created by using timechart span=1h count by action. The by clause splits the aggregation into one series per distinct value of the action field, so success and failure appear as separate lines. Using chart without a time field, or misusing count(action), fails to produce the required hourly series.

Answer

index=auth earliest=-24h | chart count by action

Answer

index=auth earliest=-24h | timechart span=1h count(action)

Answer

index=auth earliest=-24h | stats count by action, _time | timechart span=1h count

Question 8

An analyst needs to find the average duration of transactions per host, but only for hosts where the average duration exceeds 300 milliseconds. The events contain host and duration fields. Which search will produce this result?

Accepted Answer

index=app | stats avg(duration) as avg_duration by host | where avg_duration > 300. To filter on an aggregated value, the aggregation must happen first. The stats command computes the average duration per host, and the where command then filters those results for averages over 300. Attempting to use where or search before or instead of the aggregation, or misusing eval, will not correctly produce the filtered averages.

Answer

index=app | eval avg_duration = avg(duration) | stats avg(avg_duration) by host | where avg_duration > 300

Answer

index=app | where avg(duration) > 300 | stats avg(duration) as avg_duration by host

Answer

index=app | stats avg(duration) as avg_duration by host | search avg_duration > 300

Question 9

A security analyst is investigating authentication events and wants to see a breakdown of the number of events for each combination of src and dest IP addresses, but only for combinations that have more than 100 events. The events contain src and dest fields. Which SPL search returns the desired results?

Accepted Answer

index=auth | stats count by src, dest | where count > 100. Grouping by two fields with stats count by src, dest creates one row per unique pair and calculates the event count for each. Applying where count > 100 afterward keeps only those pairs that exceed the threshold. Because where evaluates fields created by stats, the aggregation must come first, and the filter must use where rather than search for a numeric comparison.

Answer

index=auth | stats count by src, dest | head 100

Answer

index=auth | stats count by src, dest | search count > 100

Answer

index=auth | where count > 100 | stats count by src, dest

Question 10

A Splunk administrator is troubleshooting why a lookup named 'asset_lookup' is not returning expected values for some events. The lookup definition is configured and the CSV file contains a header row with fields 'host', 'owner', and 'location'. The administrator runs a search and notices that events with a host value of 'WEB01' do not get enriched, while events with 'web01' do get enriched. Which TWO actions could resolve the matching issue? (Choose two.)

Accepted Answer

Normalize the host field values to a consistent case before the lookup. The problem is case sensitivity in lookup matching. Disabling case-sensitive matching in the lookup definition or normalizing the host field to a consistent case before the lookup both allow uppercase and lowercase values to match correctly. Enabling case sensitivity would make it worse, and adding a duplicate lookup or changing the key field does not address the underlying case mismatch.

Answer

Add a second lookup definition that maps uppercase host values

Answer

Enable case-sensitive matching in the lookup definition

Answer

Change the lookup key field from host to location

Question 11

A Splunk user runs a search that returns events only when a user logs in from an external IP address. The user wants to count how many times each user logged in from external IPs, and then keep only users with more than 10 such logins. The search should return a table with two columns: 'user' and 'count'. Which SPL search accomplishes this?

Accepted Answer

index=security action=login src_ip=external | stats count by user | where count > 10. The requirement is to count logins per user and then filter users with more than 10 logins. The stats command with 'count by user' performs the grouping and counting, and the where command filters the aggregated results. This yields a table with user and count columns, exactly as needed. The other options either do not group by user, add extra columns, or return event-level results instead of a summary table.

Answer

index=security action=login src_ip=external | eventstats count as user_count | where user_count > 10

Answer

index=security action=login src_ip=external | stats count(user) | where count > 10

Answer

index=security action=login src_ip=external | top user | where count > 10

Question 12

A Splunk user needs to create a new field called 'risk_score' that is calculated from existing fields in each event. The calculation must be evaluated at search time and must not modify the original indexed data. The user also wants the field to be available in future searches without re-adding the calculation each time. Which approach should the user take?

Accepted Answer

Create a calculated field named risk_score using an eval expression. Calculated fields are search-time knowledge objects that use eval expressions to create new fields from existing ones. They do not modify indexed data and can be saved to make the field available automatically in future searches. Field extractions parse raw data, aliases rename existing fields, and manually adding eval to each search does not provide the desired persistence.

Answer

Create a field extraction named risk_score using a regex

Answer

Add the eval command to every search that needs risk_score

Answer

Create a field alias named risk_score that maps to an existing field

Question 13

A fraud analyst wants to build a search that returns the total transaction amount and the number of transactions for each merchant, and then keep only merchants whose total amount exceeds 10,000. Which two SPL elements are required in the search pipeline? (Choose two.)

Accepted Answer

stats sum(amount) as total_amount count as txn_count by merchant. Producing per-merchant totals and transaction counts requires an aggregation stage, which stats provides with sum and count grouped by merchant. Filtering those aggregated rows against a numeric threshold requires the where command, because only where evaluates computed fields numerically after the transformation has occurred.

Answer

eval total_amount = sum(amount)

Answer

search total_amount > 10000

Answer

dedup merchant

Question 14

A Splunk administrator is reviewing a search that uses the transaction command to group events by a session ID. The administrator wants to ensure the transaction command correctly groups events that occur within 30 minutes of each other and have the same session ID. The administrator also wants to limit the transaction to a maximum of 100 events. Which two parameters should be used with the transaction command to achieve this? (Choose two.)

Accepted Answer

maxevents=100. To group events by session ID within 30 minutes and limit to 100 events, the transaction command should use maxspan=30m to enforce the time window and maxevents=100 to cap the number of events per transaction. The startswith and endswith parameters are used to define transaction boundaries based on field values, not time or count limits. mvlist controls output formatting, not grouping constraints.

Answer

startswith=session_id

Answer

endswith=session_id

Answer

mvlist=true

Question 15

A Splunk user has a lookup definition named 'product_info' that maps product IDs to product names and prices. The user runs a search that includes the command `| lookup product_info product_id OUTPUT product_name price`. After reviewing the results, the user notices that some events have a product_name value of NULL even though those product IDs exist in the lookup table. Which action should the user take to ensure that the product_name field is populated for all matching events?

Accepted Answer

Verify that the field name in the events matches the field name used in the lookup definition's match field.. The most common reason for a lookup returning NULL when values should match is a mismatch between the field name in the events and the field name defined in the lookup definition. Verifying that the event field matches the lookup's match field ensures the lookup can find corresponding rows. Other options address different issues such as overwriting, multiple matches, or storage format, none of which resolve a simple field name mismatch.

Answer

Increase the lookup definition's maximum matches setting to allow more than one match per event.

Answer

Convert the lookup from a CSV file to a KV Store collection to improve matching reliability.

Answer

Add the OUTPUTNEW keyword before product_name and price to force the lookup to overwrite existing values.