SPLK-1002 Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. The search returns only events where src_zone is 'external'. What is the problem?

Accepted Answer

The 'case' function cannot compare IP addresses to CIDR ranges. The 'case' function evaluates conditions in order. The second condition '1=1' is always true, so any IP not matching '10.0.0.0/8' gets 'external'. However, the 'case' function does not support CIDR matching; it treats '10.0.0.0/8' as a literal string. So no IP matches the first condition, and all get 'external'.

Answer

The 'src_ip' field is not extracted

Answer

The default condition should be 'true()' instead of '1=1'

Answer

The 'search' command should be before 'eval'

Question 2

Refer to the exhibit. A Splunk admin created this dashboard XML. When viewing the dashboard, the "Response Time" panel shows no data. What is the most likely cause?

Accepted Answer

The 'response_time' field does not exist in the access_combined sourcetype.. The search for response time uses a field 'response_time' which may not exist in the access_combined sourcetype. The access_combined sourcetype typically does not have a response_time field; it might be named differently (e.g., time_taken).

Answer

The index 'web' does not contain any events.

Answer

The bar chart cannot display the results.

Answer

The stats command requires a by clause and host is not a valid field.

Question 3

Which two of the following search commands are transforming commands? (Choose two.)

Accepted Answer

chart. Transforming commands return a statistics table. chart and stats are transforming; eval, search, and fields are non-transforming.

Answer

search

Answer

eval

Answer

fields

Question 4

Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?

Accepted Answer

Change the eval to a case statement with multiple conditions.. Using a case statement allows multiple conditions clearly. A nested if would work but is less readable. fillnull adds missing values, but the issue is categorization not missing data. search would filter, not categorize.

Answer

Use the `fillnull` command to add missing values.

Answer

Use the `search` command to filter threat_score>90.

Answer

Add a third condition: if(threat_score > 60 AND threat_score <=90, "medium", ...) inside the existing eval.

Question 5

An analyst executes the following search: index=main sourcetype=access | stats dc(user) by host. What does dc(user) do?

Accepted Answer

Distinct count of users per host. The `dc(user)` function in SPL stands for 'distinct count' of the `user` field. When used after `stats ... by host`, it calculates the number of unique users associated with each host. This is why option B is correct: it returns the distinct count of users per host.

Answer

Count of hosts

Answer

Count of all users

Answer

Sum of user IDs

Question 6

Which of the following is required to use data model acceleration for a Pivot report?

Accepted Answer

Check the 'Accelerate' box on the data model and set a time range. Option C is correct because data model acceleration is enabled by checking the 'Accelerate' box on the data model and setting a time range. Option A is wrong because summary indexing is not required. Option B is wrong because root objects are not the only requirement. Option D is wrong because acceleration is not configured via the datamodel command.

Answer

Create a data model with only root objects

Answer

Enable summary indexing

Answer

Use the `datamodel` command with `acceleration` parameter

Question 7

A data model has been accelerated but some Pivot reports are showing incomplete data. What is the most likely cause?

Accepted Answer

The acceleration summary range does not cover the full time range of the report.. Option B is correct because the acceleration summary range may not cover the full time range of the report, leading to incomplete data. Option A is wrong because normalization is not related. Option C is wrong because too many fields do not cause incomplete data. Option D is wrong because conflicting field extractions are not directly related.

Answer

The data model has too many fields.

Answer

The data model is not normalized.

Answer

The search time field extractions are conflicting.

Question 8

Refer to the exhibit. A data model named 'Web' is built on sourcetype 'web_access'. A user reports that the timestamp field is not being extracted correctly in the data model. What is the most likely issue?

Accepted Answer

The TIME_PREFIX is set to `^` which may not match the timestamp location.. Option A is correct because the TIME_PREFIX is set to `^`, which may not accurately match the timestamp location in the event. Option B is wrong because MAX_TIMESTAMP_LOOKAHEAD is fine. Option C is wrong because the DATETIME_CONFIG file exists. Option D is wrong unless the format does not match; but the format looks correct for common web logs.

Answer

The DATETIME_CONFIG file is missing.

Answer

The TIME_FORMAT does not match the data.

Answer

The MAX_TIMESTAMP_LOOKAHEAD is too high.

Question 9

A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?

Accepted Answer

Use the `| datamodel <model> search` command to preview data and identify missing fields.. Option C is correct because using the `| datamodel` command allows you to see the raw data and identify missing fields. Option A is wrong because rebuilding acceleration is not a first step. Option B is wrong because field extractions might not be the issue. Option D is wrong because increasing acceleration time range does not help with field population.

Answer

Rebuild the data model acceleration.

Answer

Increase the acceleration time range.

Answer

Check the field extractions in transforms.conf.

Question 10

Refer to the exhibit. An admin is trying to accelerate this data model, but receives an error: 'Data model 'Authentication' has no constraints.' What is the most likely cause?

Accepted Answer

The constraint is missing the dataset name.. The error 'Data model 'Authentication' has no constraints' occurs because the constraint definition in the data model is missing the dataset name prefix. In Splunk data models, constraints must specify which dataset they apply to (e.g., 'Authentication.action=*' instead of just 'action=*'), otherwise the data model cannot enforce the constraint and fails validation.

Answer

The data model name must be in uppercase.

Answer

The field 'action' is not allowed in a data model.

Answer

The constraint is defined at the root level incorrectly.

SPLK-1002 Practice Test 8 — 10 Questions

Exhibit

SPLK-1002 Practice Test 8 — 10 Questions

Exhibit