SPLK-1001 Practice Test 23 — 15 Questions

Question 1

A SOC analyst needs to find all failed login events from the last 24 hours where the field `action` equals "failure". The raw events contain fields `user`, `src_ip`, and `action`. Which SPL search will return only the relevant events?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=security sourcetype=auth action=failure earliest=-24h. The correct search places the field filter and time range directly in the base search, which is the most efficient and accurate way to retrieve only failed login events from the last 24 hours. Using a transforming command like stats would change the output to a summary, and placing time modifiers after a pipe is invalid.

Answer

index=security sourcetype=auth | stats count by action | search failure

Answer

index=security sourcetype=auth | search action=failure earliest=-24h

Answer

index=security sourcetype=auth | where action="failure" | head 24h

Question 2

A Splunk user has a table panel showing the top 10 slowest API endpoints. When a user clicks a row, the team wants a second panel to update and show detailed events for only that endpoint. Which dashboard feature should the user configure to achieve this interaction?

Accepted Answer

A token set by the table's drilldown that the detail panel's search references.. Table drilldown can set a token from the clicked row's field values, and a second panel whose search references that token will update automatically. This token-based dependency delivers the click-to-filter behavior the team wants without manual input or scheduled jobs.

Answer

A post-process search that reuses the table's results in the detail panel.

Answer

A form input that the user manually edits to type the endpoint name before searching.

Answer

A scheduled alert that refreshes the detail panel every time the table changes.

Question 3

A Splunk user has a lookup table named http_status.csv that maps HTTP status codes to descriptive text, with columns status_code and status_description. The user wants to enrich events that contain a field called status_code with the matching status_description from the lookup. Which SPL command should the user run?

Accepted Answer

lookup http_status status_code. The lookup command is designed to enrich events with fields from an external lookup table by matching on one or more fields. Specifying the lookup definition name and the matching field status_code causes Splunk to add the corresponding status_description from http_status.csv to each event. The other commands either read, write, or join data in ways that do not provide the required per-event enrichment.

Answer

inputlookup http_status.csv

Answer

join status_code

Answer

outputlookup http_status.csv

Question 4

A Splunk user has a dashboard with a base search that returns a large number of events. They want to add several panels that display different statistics from the same base search results without re-running the search for each panel. Which dashboard feature should they use to optimize performance?

Accepted Answer

Post-process search. Post-process searches are designed to optimize dashboards by allowing a base search to run once and then multiple panels to run post-process searches on those results. This reduces the number of full searches executed. Scheduled searches, accelerated data models, and report acceleration are different performance optimization techniques that do not address the specific need of sharing a base search across multiple dashboard panels.

Answer

Report acceleration

Answer

Accelerated data model

Answer

Scheduled search

Question 5

A Splunk administrator needs to identify which commands in a search pipeline are transforming commands that will produce a tabular result set suitable for charting. Which two commands in the following list are transforming commands? (Choose two.)

Accepted Answer

timechart. Transforming commands aggregate events into a summary table. The chart and timechart commands are both transforming because they group and aggregate data, producing tabular results suitable for visualization. The eval, rex, and lookup commands are event-processing commands that operate on individual events without aggregating them, so they are not transforming.

Answer

lookup

Answer

rex

Answer

eval

Question 6

A Splunk administrator is preparing a dashboard for a quarterly executive review. The administrator wants to control who can view and edit the dashboard and to make it easy for executives to open it later. Which two actions are valid ways to manage sharing and access for a classic dashboard? (Choose two.)

Accepted Answer

Add the dashboard to a role's default app or navigation so targeted users can find it easily. Managing dashboard access relies on per-object permissions that grant read or write rights to selected roles, and on app placement or navigation exposure so the intended audience can find the dashboard. Together these control who can view or edit and make the dashboard easy to open. Alert actions, renaming saved searches, and disabling refresh do not govern access or improve discoverability for executives.

Answer

Rename the dashboard's underlying saved search so it inherits the administrator's personal permissions

Answer

Disable the dashboard's scheduled refresh so only the administrator can open it during the review

Answer

Convert the dashboard's panels into an alert action so recipients receive it by email automatically

Question 7

An analyst needs to add a new field named 'duration_seconds' to every event by dividing the existing 'duration_ms' field by 1000, without removing any other fields or changing the number of events returned. Which SPL search accomplishes this?

Accepted Answer

index=app | eval duration_seconds = duration_ms / 1000. Adding a calculated field to every event without altering the event count requires eval, which evaluates an arithmetic expression per event and writes the result into a new field. The other commands either aggregate events into fewer rows, extract text with pattern matching, or merely relabel an existing field. Only eval performs the division while preserving all original fields and rows.

Answer

index=app | rex field=duration_ms "(?<duration_seconds>.*)"

Answer

index=app | stats sum(duration_ms) as duration_seconds

Answer

index=app | rename duration_ms as duration_seconds

Question 8

A SOC manager wants a report that displays total events per sourcetype as proportional slices of a whole, so executives can instantly see which sourcetype dominates. Which Splunk visualization type should the manager select?

Accepted Answer

Pie chart. A pie chart is designed to show parts of a whole, so it directly answers the need to see which sourcetype accounts for the largest share of events. Splunk renders it from a single split-by field plus a statistical function such as count, letting executives compare proportional slices without doing mental arithmetic.

Answer

Column chart

Answer

Scatter chart

Answer

Single value

Question 9

A security analyst wants to see the number of failed login attempts per user account for the past week, but only for accounts with more than 20 failures. Which SPL search returns exactly that?

Accepted Answer

index=security action=failure earliest=-7d | stats count by user | where count > 20. Filtering on an aggregated value requires the aggregation to run first. The stats command creates a count field for each user, and the where command then evaluates that field, keeping only rows where the count exceeds 20. Placing the filter before stats or using head instead of where cannot produce the correct threshold-based result.

Answer

index=security action=failure earliest=-7d | search count > 20 | stats count by user

Answer

index=security action=failure earliest=-7d | where count > 20 | stats count by user

Answer

index=security action=failure earliest=-7d | stats count by user | head 20

Question 10

A Splunk user is analyzing authentication logs and wants to identify users who have had more than 3 failed login attempts within a 5-minute window. The user writes the search: index=auth action=failure | bucket _time span=5m | stats count by _time, user | where count > 3. However, the results show users with more than 3 failures across the entire 5-minute bucket, but the user wants to identify only those users who had more than 3 failures within any 5-minute window, even if that window spans across bucket boundaries. Which command should be used instead of bucket to achieve this?

Accepted Answer

| streamstats time_window=5m count by user. The streamstats command with a time_window option provides a sliding window calculation, which is ideal for detecting a threshold within any 5-minute period. It processes events in chronological order and maintains a count of events for each user over the last 5 minutes, allowing accurate identification of users exceeding the threshold within any such window, not just in fixed buckets.

Answer

| timechart span=5m count by user

Answer

| eventstats count by user

Answer

| transaction user maxspan=5m

Question 11

A security analyst runs a search that returns events with a field named `src_ip`. They want to display only the events where `src_ip` is not null and then sort the results by `src_ip` in descending order. Which SPL search will accomplish this?

Accepted Answer

index=security | where isnotnull(src_ip) | sort - src_ip. To display events where `src_ip` is not null, the `where` command with `isnotnull()` is the correct filter because it explicitly checks for the presence of a value. Sorting descending requires the minus sign before the field name in the `sort` command. Using `search src_ip=*` is less precise and may include empty strings, while `isnull` does the opposite. The combination of `where isnotnull(src_ip)` and `sort - src_ip` precisely meets the analyst's needs.

Answer

index=security | search src_ip=* | sort - src_ip

Answer

index=security | where isnull(src_ip) | sort - src_ip

Answer

index=security | dedup src_ip | sort + src_ip

Question 12

A security analyst needs to find all events in the last 24 hours where the 'status' field is either 'failed' or 'error'. The analyst writes: index=security status=failed OR error. The search returns events with status='failed' but also events where the word 'error' appears anywhere in the raw event, including in unrelated fields. What is the best way to correct the search to return only events where the 'status' field is exactly 'failed' or 'error'?

Accepted Answer

index=security status=failed OR status=error. To restrict results to events where the status field matches specific values, each value must be explicitly associated with the field name. Using 'status=failed OR status=error' ensures that only events with those exact field values are returned, eliminating false positives from the term 'error' appearing elsewhere in the raw event data.

Answer

index=security status=failed OR status=error NOT status=success

Answer

index=security status=failed OR error

Answer

index=security status IN (failed, error)

Question 13

A SOC analyst needs to build a quick pie chart showing the distribution of events per sourcetype over the last 24 hours. Which SPL search accomplishes this with a single transforming command?

Accepted Answer

index=main earliest=-24h | stats count by sourcetype. The stats command is transforming because it aggregates events into a summary table. Using stats count by sourcetype groups events by sourcetype and calculates a count for each group, which is exactly what a pie chart needs to show distribution. The other commands either filter fields or remove duplicates without aggregating, so they do not produce the required summary.

Answer

index=main earliest=-24h | table sourcetype

Answer

index=main earliest=-24h | dedup sourcetype

Answer

index=main earliest=-24h | fields sourcetype

Question 14

A Splunk user is building a dashboard and wants to add a panel that shows a map of geographic locations based on IP addresses. The user has a search that returns a field named 'clientip'. Which two steps are required to display the map correctly? (Choose two.)

Accepted Answer

Use the iplocation command to extract latitude and longitude from the clientip field.. To display a map of geographic locations from IP addresses, you first need to extract latitude and longitude coordinates using the iplocation command. Then, you must select the Map visualization for the panel. These two steps are essential. The geostats command is for aggregated cluster maps, a lookup is unnecessary because iplocation is built-in, and xyseries is not used for map data.

Answer

Use the geostats command to aggregate events by location.

Answer

Use the xyseries command to format the data for the map.

Answer

Add a lookup to a CSV file containing IP address mappings.

Question 15

An analyst needs to identify which source IP addresses produced more than 100 authentication failures in the last hour and show each such IP alongside its failure count. Which SPL search returns only IPs meeting that threshold?

Accepted Answer

index=auth action=failure earliest=-1h | stats count by src_ip | where count > 100. Threshold filtering on an aggregated value requires aggregation first, then a filter that can evaluate the computed field. Grouping failures by source IP with stats count by src_ip produces the count field, and where count > 100 then keeps only IPs exceeding the threshold, yielding one summary row per qualifying address.

Answer

index=auth action=failure earliest=-1h | eventstats count by src_ip | where count > 100

Answer

index=auth action=failure earliest=-1h | where count > 100 | stats count by src_ip

Answer

index=auth action=failure earliest=-1h | stats count by src_ip | search count > 100