Sample questions
Splunk Core Certified Power User SPLK-1003 practice questions
Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)
A user runs a search that returns 1,000,000 results but only sees 5,000 in the Statistics tab. What is the most likely cause?
Which two lookup types in Splunk support automatic time-based matching? (Choose 2)
What is the purpose of an automatic lookup?
Refer to the exhibit. What is the most likely cause of this error?
In a dashboard panel, a table shows event counts by source. The user wants to click on a sourcetype to drill down to a new search showing all events from that source. Which token-b…
A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?
An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be…
A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which sear…
Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes co…
A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?
A company uses a large Splunk environment with many users creating dashboards. They notice that some searches are slow and consume excessive resources. What is the best practice to…
An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?
A user wants to create a chart showing the count of errors per hour for the last 24 hours, with time bucketed hourly. Which search is correct?
An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?
What is the MOST likely reason the search returns no results?
To count events by host for the last hour, which search is most efficient?
Refer to the exhibit. What is the purpose of the eval command in this search?
Which THREE steps are necessary to create a file-based lookup?
A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create…
Match each Splunk index time field to its meaning.
A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The applicat…
Which of the following is true about the sort command?
An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minu…