SPLK-1002 Practice Test 31 — 15 Questions

Question 1

A security analyst wants to create a report that shows the count of failed login attempts per user over the last 24 hours, but only for users with more than 5 failures. Which Splunk command sequence should be used?

Accepted Answer

index=main action=failure | stats count by user | where count > 5. Option D is correct because it first filters events to only failed login attempts using `index=main action=failure`, then uses `stats count by user` to count failures per user, and finally applies `where count > 5` to keep only users with more than 5 failures. This sequence ensures the count is calculated only on the relevant subset of events and the filter is applied after aggregation.

Answer

index=main action=failure | top limit=5 user

Answer

index=main | stats count by user | where count > 5

Answer

index=main action=failure | stats count by user | search count > 5

Question 2

A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)

Accepted Answer

The lookup definition must specify the time format used in the time_field column. Option C is correct because the lookup definition must specify the time format used in the time_field column so that Splunk can correctly parse the time values in the lookup table. Without this format specification, Splunk cannot interpret the timestamps and the time-based matching will fail.

Answer

The lookup table must have exactly one row per unique time value

Answer

The lookup must be defined as an automatic lookup in props.conf

Question 3

A search needs to replace a field value 'user' with 'full name' using a CSV lookup that has 'username' and 'fullname' columns. Which lookup command is correct?

Accepted Answer

| lookup users.csv username AS user OUTPUT fullname AS full_name. Option C is correct because the `lookup` command syntax requires specifying the lookup file, then the field name in the lookup file (`username`) mapped to the field in the event (`user`) using `AS`, and then `OUTPUT` to bring the `fullname` field into the event as a new field named `full_name`. This matches the requirement to replace the field value 'user' with 'full name' by using the CSV lookup's `fullname` column.

Answer

| lookup users.csv username AS user OUTPUTNEW fullname

Answer

| lookup users.csv user AS username OUTPUT fullname

Answer

| lookup users.csv user AS fullname OUTPUT username

Question 4

A large enterprise uses Splunk across 50 indexers and a search head cluster. An analyst reports that a search using a lookup file 'employees.csv' (500 MB, 10 million rows) is extremely slow. The search is: `index=winlogs sourcetype=Security EventCode=4624 | lookup employees.csv account AS User OUTPUT department, manager`. The lookup currently runs on each event, and the entire CSV is loaded into memory on the search head each time. There are about 5 million matching events per day. The company has a separate Identity Management system that updates employee data hourly. The analyst needs the lookup to be fast and up-to-date. Which solution should the Splunk admin implement?

Accepted Answer

Convert the lookup to a KV store collection and use the lookup as a key-value store.. Option B is correct because converting the large, frequently updated CSV lookup to a KV store collection allows Splunk to index the data and perform key-value lookups efficiently without loading the entire file into memory on the search head. The KV store supports real-time updates from the Identity Management system via REST API, ensuring the lookup remains up-to-date while drastically improving search performance for 5 million daily events across 50 indexers.

Answer

Use a static CSV but compress it and use `lookup` command with `| makeresults` approach.

Answer

Increase the `max_mem_usage` setting for the lookup in limits.conf.

Answer

Add a time range early in the search to reduce events.

Question 5

Which THREE best practices should be followed when creating dashboards for a large organization with many users?

Accepted Answer

Use scheduled searches instead of real-time to reduce load. Option A is correct because scheduled searches run at defined intervals and cache results, reducing the load on indexers and search heads compared to real-time searches that continuously stream data. This is especially important in large organizations with many users, as real-time searches can consume significant system resources and degrade performance for all users.

Answer

Use multiple base searches per panel for flexibility

Answer

Use exclusively real-time searches for up-to-date data

Question 6

A team wants to add an interactive time range picker to a dashboard. The dashboard uses a base search with a token for earliest and latest. Which configuration is required?

Accepted Answer

Add input type='time' token='time_tok' and use $time_tok$ in the search. Option D is correct because the `input type='time'` element is the standard way to add an interactive time range picker in Splunk dashboards. By setting the `token` attribute to `time_tok` and referencing `$time_tok$` in the base search, the dashboard dynamically passes the selected time range to the search, overriding any static earliest/latest values.

Answer

Set the search's earliest and latest to -1h and now

Answer

Use the built-in time range picker by adding <option> elements

Answer

Add input type='dropdown' token='time' and use $time$ in the search

Question 7

A report is scheduled to run every hour but sometimes returns incomplete data because the search is too slow and times out. Which action should be taken to improve reliability without losing data?

Accepted Answer

Use a summary index to pre-aggregate data. A summary index pre-aggregates data at search time, storing the results in a separate index. When the report runs, it queries the summary index instead of the raw data, which is much faster and avoids timeouts. This ensures all data is captured because the summary is built incrementally from the full data set, not by sampling or truncating.

Answer

Add the 'lazy' command to defer computation

Answer

Reduce the time range to the last 30 minutes

Answer

Increase the search auto-finalization time

Question 8

A security analyst creates a report that shows the count of failed login attempts by user over the last 7 days. The report uses the `top` command. However, the report only shows the top 10 users, but the analyst wants to see all users. What should the analyst do?

Accepted Answer

Add the `limit=0` argument to the `top` command.. The `top` command in Splunk defaults to showing the top 10 results. Adding `limit=0` removes this limit, displaying all users with failed login attempts. This is the correct approach because `top` already counts occurrences and sorts them, so the analyst only needs to override the default limit.

Answer

Use the `rare` command instead.

Answer

Change the time range to include more data.

Answer

Use the `stats count by user` command and sort descending.

Question 9

A user wants to add a drilldown to a dashboard panel so that clicking a value opens a related search in a new tab. Which Simple XML attribute is used?

Accepted Answer

drilldown. In Simple XML, the `drilldown` attribute is used to enable or disable click interactions on dashboard panels. When set to `drilldown`, clicking a value triggers a drilldown action, which by default opens a related search in the same tab. To open the search in a new tab, you must combine `drilldown` with the `target` attribute set to `_blank`. The `drilldown` attribute itself is the correct answer because it is the primary attribute that enables the drilldown behavior.

Answer

link

Answer

target

Answer

href

Question 10

Refer to the exhibit. The report returns 0 results even though there are error events in the data. What is the most likely issue?

Accepted Answer

The field name is 'error' but the data uses 'ERROR'. Option C is correct because Splunk field names are case-sensitive. The search is looking for a field named 'error', but the CSV data contains a field named 'ERROR'. Since the field name does not match exactly, the `stats` command cannot find any events with the field 'error', resulting in zero results. Renaming the field in the search using `rename ERROR as error` or adjusting the field name in the data would resolve this.

Answer

The stats command is misspelled

Answer

The time range is not set

Answer

The CSV file has no header

Question 11

A user created a dashboard panel with a search that uses a token. The token is not being applied when the user modifies the dropdown. What is the most likely cause?

Accepted Answer

The token name in the search does not match the token in the input. Option C is correct because for a token to dynamically filter search results in a Splunk dashboard, the token name referenced in the search string (e.g., `$token_name$`) must exactly match the token name defined in the input's `token` attribute. If these names differ, the search will not receive the selected value, and the token will appear unapplied.

Answer

The input has a default value that overrides user selections

Answer

The dashboard is set to 'disabled' mode

Answer

The panel is set to 'static'

Question 12

Refer to the exhibit. The timechart returns only partial results for some sourcetypes, and there are gaps in the timeline. Which is the most likely reason?

Accepted Answer

The tstats command only uses summary data, which may not cover all time ranges. The `tstats` command in Splunk operates on indexed-time summary data stored in the tsidx files, not on raw events. This summary data is generated during indexing based on the data model acceleration or summary indexing configuration, and it may not cover all time ranges if the acceleration has not been built for those periods or if the data model is not fully accelerated. As a result, `tstats` can return partial results and gaps in the timeline, especially when the time range extends beyond the accelerated data coverage.

Answer

The timechart span=1h conflicts with the tstats span

Answer

The sourcetype field is not summarized

Answer

The where clause is invalid

Question 13

A compliance report must show the average latency per service for each hour over the past 30 days. The data set contains millions of events. To ensure the report finishes within a reasonable time, which approach is recommended?

Accepted Answer

Use the tstats command over a data model. The tstats command is optimized for use with data models and runs on indexed fields in the tsidx files, making it far faster than stats or timechart on raw events for large datasets. By pre-defining a data model with the latency field and using tstats, you avoid scanning millions of raw events and instead query pre-aggregated statistics, ensuring the report completes within a reasonable time.

Answer

Use timechart span=1h avg(latency) by service

Answer

Use stats avg(latency) by service, _time span=1h

Answer

Pre-process data using a summary index that runs hourly

Question 14

A user wants to create a dashboard panel that shows a single number representing the total number of errors in the last 24 hours. Which visualization type should be used?

Accepted Answer

Single value. A Single Value visualization is designed to display a single numeric metric prominently, making it the ideal choice for showing the total number of errors in the last 24 hours. It directly answers the user's requirement for a single number without any additional chart elements or time-series context.

Answer

Pie chart

Answer

Bar chart

Answer

Line chart

Question 15

A user wants to save a search as a report that can be used in a dashboard. Which TWO steps are required? (Select two.)

Accepted Answer

Run the search and click 'Save As' > 'Report'. Option B is correct because the first required step to save a search as a report is to run the search and then select 'Save As' > 'Report' from the Splunk UI. This action opens the Save As Report dialog, which is the standard method for converting an ad-hoc search into a persistent report object that can be used in dashboards.

Answer

Schedule the report for email delivery

Answer

Set a time range in the search

Answer

Add the report to a dashboard panel