SPLK-1002 Practice Test 22 — 15 Questions

Question 1

Refer to the exhibit. The search returns no results from the lookup. What is the most likely issue?

Accepted Answer

The lookup command references 'error_id' but the alias changed the field to 'error_code'. The correct answer is D because the search uses `lookup error_codes.csv error_id` but the FIELDALIAS in props.conf has renamed the field `error_id` to `error_code`. Since the lookup command references the original field name `error_id`, which no longer exists in the events after alias processing, the lookup cannot match any values and returns no results.

Answer

The FIELDALIAS syntax is incorrect

Answer

The lookup table is not defined in transforms.conf

Answer

The lookup file 'error_codes.csv' does not exist

Question 2

A user notices that a data model designed for web server logs is not showing any events in the 'Web' object, even though the underlying logs are searched correctly with a normal search. The root events are pulling from the 'main' index, and the data model uses constraints. Which of the following is the most likely cause?

Accepted Answer

The constraint defined in the data model's root event is too restrictive and excludes all events.. The most likely cause is that the constraint defined in the data model's root event is too restrictive and excludes all events. Data model constraints act as a filter on the underlying index data; if the constraint condition (e.g., `sourcetype=access_combined`) does not match any events in the 'main' index, the root event will be empty, even though a normal search without the constraint returns results. This is a common misconfiguration when the constraint is too narrow or uses incorrect field values.

Answer

The time range picker is set to a period outside the acceleration summary's range.

Answer

The data model definition includes calculated fields that require specific field extractions.

Answer

The user does not have permissions to run the data model, so events are hidden.

Question 3

A team has a lookup table 'app_errors.csv' that includes a field 'error_code'. They want to automatically join error descriptions from 'error_codes.csv' on 'error_code' every time they search a sourcetype. What is the best way to achieve this?

Accepted Answer

Set up an automatic lookup in props.conf for the sourcetype. Option A is correct because an automatic lookup in props.conf allows you to define a lookup that runs automatically on every search for a given sourcetype, without requiring manual invocation. This configuration joins the 'error_code' field from the search results with the 'error_codes.csv' lookup table, appending the description field to every event of that sourcetype. It is the most efficient and consistent method for automatically enriching data at search time.

Answer

Use an eval statement with if() to assign description

Answer

Configure field aliases to rename 'error_code'

Answer

Use the lookup command in every search

Question 4

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

Accepted Answer

Configure a CSV lookup and use lookup command in search. Option D is correct because a CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Answer

Use a time-based lookup to match event time with lookup time

Answer

Set up an external lookup that calls a REST API

Answer

Create a KV Store lookup and update it via REST

Question 5

A user wants to see the list of all fields that are extracted from a specific sourcetype. Which command should they use?

Accepted Answer

| fieldsummary. The `fieldsummary` command provides a summary of all fields extracted from the events in the search results, including their count, distinct count, and percentage of events containing each field. When applied to a specific sourcetype, it lists every field that has been extracted from that sourcetype, making it the correct tool for this task.

Answer

| rex field=_raw ...

Answer

| fields *

Answer

| eval fields=...

Question 6

A user wants to create a bar chart showing the count of events by host for the last hour. Which command should be used?

Accepted Answer

`index=* | stats count by host`. Option D is correct because `stats count by host` produces a table of hosts and their event counts, which can be directly visualized as a bar chart. The user wants a count of events by host for the last hour, and `stats` with a `by` clause is the appropriate transforming command to aggregate counts per host without time-series splitting.

Answer

`index=* | timechart count by host`

Answer

`index=* | top host`

Answer

`index=* | chart count by host`

Question 7

Which THREE of the following are valid options for the lookup command?

Accepted Answer

local=. Option A is correct because the `local=` parameter in the lookup command specifies whether the lookup should be performed on the search head (local) or distributed across indexers. When set to `true`, the lookup file is read from the search head; when `false`, it is distributed to all indexers, which is critical for performance in large environments.

Answer

rename <field> as <alias>

Answer

join <field>

Question 8

A user has a search that produces a chart of error counts by host. They want to add a calculated field 'error_rate' as errors per million events. Which approach is correct?

Accepted Answer

Use eventstats to get total counts, then eval to compute rate, then chart. Option A is correct because it uses `eventstats` to compute the total count of events per host across the entire result set, then `eval` to calculate the error rate as (error_count / total_count) * 1,000,000, and finally `chart` to display the results. This two-step approach ensures the total count is available for each row before the rate calculation, which is necessary because `chart` alone cannot reference a field computed in the same command.

Answer

Use chart eval(error_count/total_count) by host

Answer

Use stats to compute error_rate directly: stats avg(error_rate) by host

Answer

Use the lookup command to apply a calculated field

Question 9

An administrator wants to add a lookup table that maps user IDs to department names. The lookup file is a CSV with columns `user_id` and `department`. To use this lookup in searches, what must be configured?

Accepted Answer

Define a lookup definition in props.conf and transforms.conf.. Option D is correct because to use a static CSV lookup in Splunk, you must first upload the file to the lookups directory, then define a lookup stanza in transforms.conf specifying the filename, and finally create a lookup definition in props.conf (or via the UI) to make it available for search commands like `lookup` or `inputlookup`. This two-step configuration ensures Splunk can locate the file and map the fields correctly.

Answer

Define the lookup as a time-based lookup.

Answer

Define the lookup table file in the transforms.conf with a search string.

Answer

Upload the CSV to Splunk and it automatically becomes available.

Question 10

Which TWO commands can be used to filter events based on field values?

Accepted Answer

where. The `where` command is used to filter events based on field values using Boolean expressions. It evaluates each event against a condition and retains only those events where the condition is true, making it a direct filtering command for field values.

Answer

lookup

Answer

fields

Answer

eval

Question 11

A search using `| lookup user_lookup user_id OUTPUT department_name` returns incorrect department names for some users. The lookup file is correct. What could be the issue?

Accepted Answer

The field `user_id` in the events has trailing spaces.. Option B is correct because trailing spaces in the `user_id` field within the events will cause the lookup to fail to match the corresponding entry in the lookup file, even though the lookup file itself is correct. Splunk performs exact string matching for lookups by default, so any leading or trailing whitespace in the event data will prevent a match, leading to incorrect or missing output. Using the `trim` function or a `| rex` command to strip whitespace before the lookup resolves this issue.

Answer

The output field name is misspelled in the search.

Answer

The lookup file has duplicate entries for the same user_id.

Answer

The lookup definition uses case-insensitive matching.

Question 12

Which command is used to import an external CSV file into a Splunk lookup table for the first time?

Accepted Answer

`| outputlookup`. The `| outputlookup` command is used to create or overwrite a lookup table file in Splunk from search results. When importing an external CSV file into a Splunk lookup table for the first time, you would first ingest the CSV data (e.g., via `| inputcsv` or by uploading the file), then use `| outputlookup` to write that data into a lookup definition that Splunk can reference.

Answer

`| lookup`

Answer

`| inputlookup`

Answer

`| fields`

Question 13

A security analyst runs a search that returns many fields, most of which are not needed. Which command should be used to remove all fields except 'src_ip', 'dest_ip', and 'action'?

Accepted Answer

| fields + src_ip, dest_ip, action. The `fields` command with the `+` prefix explicitly keeps only the listed fields and removes all others from the search results. This is the correct way to retain only `src_ip`, `dest_ip`, and `action` while discarding the rest.

Answer

| rename src_ip as src, dest_ip as dest, action as act

Answer

| fields - src_ip, dest_ip, action

Answer

| table src_ip, dest_ip, action

Question 14

Which THREE of the following are capabilities of the rex command?

Accepted Answer

Extract fields using regex named groups.. Option B is correct because the `rex` command can extract fields using regex named groups, where the group name becomes the field name and the matched value becomes the field value. This is a core capability of `rex` for field extraction in Splunk.

Answer

Perform case-insensitive extraction by default.

Answer

Set a default value for a field.

Question 15

An analyst runs a search and notices that a field `status_code` contains values like '200', '404', '500'. They want to categorize these as 'Success' or 'Error'. Which approach is most efficient?

Accepted Answer

Use eval with case function to map status codes to categories directly in the search.. Option B is correct because using `eval` with `case` is the most efficient approach for a simple, static mapping of status codes to categories directly within the search pipeline. It avoids the overhead of disk I/O and lookup table management, and it executes entirely in memory on the search head or indexer, making it ideal for small, hardcoded mappings.

Answer

Use the csv file as a lookup and inputlookup to filter.

Answer

Create a lookup table with status codes and categories, then use the lookup command.

Answer

Use the rename command to change field values.

SPLK-1002 Practice Test 22 — 15 Questions

Exhibit

SPLK-1002 Practice Test 22 — 15 Questions

Exhibit