SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk administrator is asked to create a dashboard that shows the top 10 source IPs by count of failed logins over the past week. The data is already CIM-compliant and uses the Authentication data model. Which search is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src limit 10
It uses the tstats command on the Accelerated Authentication data model, filters for Authentication.action=failure, and uses the src field (CIM-compliant source IP) with a limit of 10 to get the top source IPs by failed logins. Option B is incorrect because summaryonly=true prevents retrieval of individual event counts needed for the top 10, and the action field is not fully qualified as Authentication.action. Option C is incorrect because the datamodel command is less efficient than tstats for accelerated data models, and using top on the full dataset is resource-intensive. Option D is incorrect because it does not leverage the CIM data model acceleration and searches across all sourcetypes, which may include non-authentication data, making it less accurate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src limit 10
Why this is correct
Uses tstats on the accelerated data model with proper field and limit.
- ✗
| tstats summaryonly=true count from datamodel=Authentication where action=failure by src
Why it's wrong here
summaryonly=true does not return raw events; it returns summary counts but missing limit clause.
- ✗
| datamodel Authentication search | search action=failure | top src
Why it's wrong here
Using datamodel without acceleration is less efficient and not best practice for large datasets.
- ✗
| search sourcetype=* authentication action=failure | stats count by src | sort - count | head 10
Why it's wrong here
This search is valid but does not leverage the CIM data model acceleration; it is slower.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.