475 questions total · 7pages · All types, answers revealed
A dashboard developer wants to display the count of errors over the last 24 hours with a line chart. Which search command should be the final command before the visualization?
timechart produces a time-based chart by default.
Why this answer
timechart automatically creates a time-based chart suitable for line chart visualization without additional formatting.
An admin notices that a saved search with a scheduled alert is not triggering as expected even though the search returns results. The search uses a macro with arguments. Which troubleshooting step should the admin take first?
Macro syntax errors are a common cause of search failure.
Why this answer
When a saved search using a macro with arguments fails to trigger despite returning results, the admin should first review the macro definition for syntax errors (Option B). Common issues include missing brackets, incorrect argument references, or improper use of pipe characters within the macro. This is the most direct troubleshooting step because the macro may be defined incorrectly, causing the alert to fail even though the search itself returns results when run manually.
Option A (name conflicts) is possible but less likely and should be checked after syntax. Option C (permissions) is irrelevant if the macro is used in a saved search that already runs. Option D (job inspector) is useful for deeper analysis but not the first step.
A user needs to identify the top 3 error types by count, but only for the current month, and exclude results with fewer than 100 occurrences. Which TWO steps are necessary? (Select two.)
Excludes error types with count less than 100.
Why this answer
The `where` command in Splunk is used to filter results based on a condition, and here it is needed to exclude error types with fewer than 100 occurrences after counting. Option D is correct because the `top` command with `limit=3` returns the top 3 values of a field by count, which directly satisfies the requirement to identify the top 3 error types.
Exam trap
Splunk often tests the distinction between using the time range picker versus explicit time commands in the search, and candidates may incorrectly assume that the time range picker is a necessary step when the search itself can use relative time modifiers like `earliest=-30d@d`.
What is the MOST likely cause of this error?
Trailing spaces cause field name mismatch.
Why this answer
The error is most likely caused by a trailing space in the CSV column header 'asset_type'. When `inputlookup` reads a CSV file, it treats column headers as literal strings; a trailing space makes the field name 'asset_type ' (with a space) instead of 'asset_type'. This mismatch causes the `where` command to fail because it references 'asset_type' without the space, leading to a field-not-found error.
Exam trap
Splunk often tests the subtlety that CSV headers are parsed literally, including whitespace, and candidates mistakenly assume Splunk automatically trims or normalizes field names, leading them to overlook trailing spaces as the root cause.
How to eliminate wrong answers
Option A is wrong because a lookup not configured to output all fields would simply not return certain fields, but it would not cause a field-not-found error in the `where` command; the lookup would still work with the fields it does output. Option B is wrong because an incorrect lookup definition filename would cause a 'lookup table not found' error, not a field mismatch error in the `where` clause. Option D is wrong because the `where` command can absolutely be used after `inputlookup`; it is a standard pattern for filtering results from a lookup table.
A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?
transaction is designed exactly for this purpose: it groups events that share common fields and satisfy start/end conditions.
Why this answer
The `transaction` command is specifically designed to group related events that share a common field (e.g., user or session ID) and occur within a defined time window. By using `startswith='login'` and `endswith='logout'`, it correctly identifies the beginning and end of a user session, grouping all intermediate events into a single transaction. This is the most direct and efficient method for correlating login and logout events in Splunk.
Exam trap
Splunk often tests the misconception that `stats` or `eval` can replace `transaction` for sessionization, but the trap is that `transaction` is the only command that natively groups events based on a start and end condition without requiring manual time-window calculations or complex field manipulation.
How to eliminate wrong answers
Option B is wrong because the `sort` command only reorders events and does not group them into sessions; manually identifying sessions from sorted data is impractical and error-prone. Option C is wrong because `stats` with `values()` and `earliest()` can aggregate fields but cannot define a transaction boundary based on event types (login/logout) or group intermediate events into a single session. Option D is wrong because `eval` can create a calculated field like a session ID based on time differences, but it lacks the built-in logic to automatically detect start and end events and group all events in between; this would require complex, custom logic that `transaction` handles natively.
Which TWO are valid methods to join data from a CSV file in a Splunk search?
`lookup` joins fields from a lookup file.
Why this answer
The `| lookup` command can reference a CSV file defined as a lookup table in Splunk, allowing field-based enrichment of search results. This is a standard method for joining data from a CSV file within a search, provided the lookup is properly configured in transforms.conf and props.conf.
Exam trap
The trap here is that candidates often confuse `| lookup` with `| inputlookup`, not realizing that both are valid for CSV data but serve different purposes—`| lookup` for field-based enrichment and `| inputlookup` for loading the entire file as a dataset.
A user runs a search on web access logs: `index=web | eventstats sum(bytes) as total_bytes by host`. The search returns the correct total bytes per host, but now the user needs to calculate the average bytes per host for each event. Which command should be added to the base search to achieve this?
eventstats can compute average directly and add it to each event.
Why this answer
Adding `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats computes the average bytes per host for each event, preserving all raw events. Option B is incorrect because streamstats would compute a running (cumulative) average, not the overall average per host. Option C is incorrect because it attempts `eval avg_bytes = total_bytes / count`, but `count` is not a field available in each event; moreover, it would require a per-host count, which is not directly available without another aggregation.
Option D is inefficient and unnecessary, as `stats` would aggregate away the events, and `join` is slow and can cause issues with large datasets.
A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?
Correct: maxevents=2 ensures each transaction contains only the expected two events, reducing memory and processing.
Why this answer
Adding `maxevents=2` limits each transaction to exactly two events (a request and a response), preventing large groupings that cause memory issues and timeouts. The `maxspan=30s` already sets a time window. Option A (using a time range picker) does not address the internal grouping inefficiency.
Option B (`stats values(*) as * by transaction_id`) does not maintain event order and can mix fields, failing to properly correlate request-response pairs. Option C (renaming component to type) does not improve performance.
Which TWO statements about the 'transaction' command are correct? (Choose two.)
The 'by' clause is used to specify the field(s) that define a transaction group.
Why this answer
The 'transaction' command can use a 'by' clause to group events that share common field values into a single transaction. This allows you to correlate events from different sources or sourcetypes as long as they have matching field values, enabling flexible event correlation.
Exam trap
Splunk often tests the misconception that 'transaction' aggregates numeric fields (like sum or average) when in reality it only concatenates events, and that 'maxevents' controls the total number of transactions rather than the maximum events per transaction.
Which TWO of the following are valid uses of the stats command in Splunk? (Choose two.)
Valid: returns list of distinct IPs per user.
Why this answer
The `stats` command in Splunk can compute aggregate statistics over fields. `values(ip) by user` is valid because `values()` returns a multivalue list of all distinct `ip` values for each `user`, which is a standard aggregation function. `count by host` is valid because `count` is a default aggregation that counts events per `host`.
Exam trap
The trap here is that candidates may confuse valid `stats` functions with functions from other contexts (like `mode()` from statistics or `first()` from programming languages) or assume that `median()` is supported when Splunk uses percentile functions instead.
You are a Splunk power user at a manufacturing company. You have created a timechart that shows machine temperature readings over time. The data is indexed with timestamps every minute, but the timechart shows gaps where no data exists because some machines may not report at all times. You want to fill the gaps with 0 values to avoid misleading visualizations. The current search is: index=manufacturing sourcetype=temperature | timechart span=1h avg(temp) by machine. Which modification to the timechart command will fill the gaps with 0?
usenull=t fills nulls with 0.
Why this answer
Usenull=t fills null values with 0. Option A is incorrect because cont=t ensures continuous time buckets but does not fill nulls with 0. Option B is incorrect because limit=0 does not affect null filling.
Option D is incorrect because usenull=f leaves gaps, and useother=f is irrelevant.
A saved search is configured to run every 5 minutes and send an alert when the count of failures exceeds 10. After several days, users report they are not receiving alerts even though failures are occurring. The saved search runs successfully and produces results. What is the most likely cause?
Throttling stops alerts from firing again within a set time window, even if the condition is true again.
Why this answer
Alert throttling is designed to suppress duplicate alerts within a specified time period. If throttling is enabled, even though the saved search runs every 5 minutes and the condition (count of failures > 10) is met, only the first alert is sent. Subsequent alerts are suppressed until the throttle window resets, explaining why users stop receiving alerts despite ongoing failures.
The search runs successfully, so permissions and alert action configuration are not the issue, and the condition is correctly set to exceed 10, not less than 10.
An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?
Longer pause tolerance captures the scans despite latency, while still closing transactions after gaps.
Why this answer
Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.
Exam trap
The trap here is that candidates may think decreasing `maxpause` or removing it entirely will reduce false positives, but in reality, that would increase missed detections (false negatives) without addressing the root cause of latency gaps.
How to eliminate wrong answers
Option A is wrong because decreasing maxspan to 30 seconds would tighten the overall time window, making it even harder to capture scans with latency-induced gaps, thus missing more valid scans. Option B is wrong because removing maxpause and using only maxspan would eliminate the pause tolerance entirely, causing the transaction to close as soon as any gap occurs, which would miss scans with intermittent delays. Option C is wrong because grouping by destination IP instead of source IP changes the correlation logic entirely, which would not address the gap issue and could introduce false positives by correlating unrelated events from different sources to the same destination.
Which THREE practices improve lookup performance in Splunk? (Select three.)
KV Store provides fast indexed lookups and supports frequent updates without reindexing.
Why this answer
The three practices that improve lookup performance in Splunk are: Use KV Store lookups for data that is updated frequently (B), use index-time lookups for static reference data that rarely changes (D), and keep lookup files small and focused for fast search-time loading (E). Option A is incorrect because large CSV files used as automatic lookups can degrade performance. Option C is incorrect because the 'format' command does not reduce lookup size; it formats results and does not improve lookup performance.
A dashboard panel uses a timechart to show error counts over time. Users report that the time range picker does not affect the panel. What is the most likely cause?
Correct. When the search uses explicit earliest and latest parameters (e.g., `earliest=-1h@h latest=now`), the time range picker is overridden.
Why this answer
If the search uses fixed earliest/latest times (e.g., via `earliest=-30d@d` or a set time range in the search string), the time range picker has no effect. Option A is incorrect because sharing the dashboard does not affect time range behavior. Option B is incorrect because 'stats' can still respect the time range if used correctly, but the issue here is fixed time bounds, not the command.
Option C is incorrect because an index that is not time-based would prevent any time-based search from working, but the panel would show no data or an error, not simply ignore the time picker.
Refer to the exhibit. What is the result of this search?
This accurately describes the output of the search.
Why this answer
The search uses the `top` command, which by default returns the most common values of a field sorted by count in descending order, limited to 10 results. The `limit=5` parameter overrides the default to return only the top 5 users. The `countfield` option renames the count column to 'total', and the `showcount=f` hides the percent column, producing a table of users and their total counts sorted by count descending, limited to 5 rows.
Exam trap
Splunk often tests the default behavior of the `top` command—specifically that it sorts by count descending and limits results to 10—and candidates mistakenly think it returns all values or sorts alphabetically, or they overlook the `limit=5` override.
How to eliminate wrong answers
Option A is wrong because the `top` command sorts by count descending, not ascending, and it does not return all users—it limits results to the top 5. Option B is wrong because the search does not filter for 'failed password' events; it operates on all events in the index and uses the `top` command to find the most common users, not the first 5 events. Option D is wrong because the `top` command sorts by count, not alphabetically by username, and it returns the most frequent users, not a simple alphabetical list.
After upgrading Splunk to a new version, the Security team notices that the CIM Authentication dashboard is showing a much lower number of events than before. They verify that the data is still being indexed and that the sourcetype mappings to the Authentication data model are unchanged. The admin runs a search against the data model and sees some fields are missing. What is the most likely cause of the issue?
Correct: Acceleration may become stale after an upgrade; rebuilding it can restore full data.
Why this answer
After an upgrade, data model acceleration may become stale and needs to be rebuilt. The acceleration caches field values, and if not rebuilt, it can lead to missing fields and lower event counts. Options B, C, and D are less likely because field definitions rarely change between minor upgrades, permissions affect visibility but not data content, and index configuration changes would affect all searches, not just the data model.
A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?
A gap of 10s exceeds the 5s maxpause, so a new transaction begins.
Why this answer
The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.
Exam trap
The trap here is that candidates often confuse `maxpause` with `maxspan`, mistakenly thinking that as long as the total duration is under `maxspan`, any gap is acceptable, when in fact `maxpause` enforces a strict per-gap limit that can split transactions independently.
How to eliminate wrong answers
Option A is wrong because it incorrectly assumes that a gap within `maxspan` overrides `maxpause`; in reality, `maxpause` is evaluated first and any gap exceeding it forces a split. Option B is wrong because it ignores the `maxpause` constraint entirely, suggesting that only the total span matters, which is false. Option C is wrong because it claims splitting only occurs when total span exceeds `maxspan`, but the `maxpause` parameter independently triggers splits on inter-event gaps.
A user wants to see a single consolidated event for each user session that includes the start time, end time, and total duration. The session events have a 'action' field with values 'start' and 'end' and a common 'user_id'. Which transaction command would achieve this?
Correctly defines session boundaries using action values.
Why this answer
Using startswith and endswith defines the boundary events, and transaction automatically calculates duration when there are start and end events.
An analyst wants to group events by 'session_id' but only if the events occur within 5 minutes of each other, and there must be at least 2 events per transaction. Which transaction parameters achieve this?
Correct: maxpause ensures events are close, minevents ensures at least 2.
Why this answer
Maxpause=300 ensures events are within 5 minutes of each other, and minevents=2 ensures at least 2 events. Option A (maxspan=300) only limits total time. Option B (maxevents=2) limits event count but not grouping window.
Option D (minpause) is not a valid parameter.
A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?
Correct: A field like src_ip is needed to group related events.
Why this answer
The transaction command requires at least one field (like src_ip) to group events into sessions; without a grouping field, events cannot be correlated. Option C is correct because the transaction command can define transaction boundaries using startswith and endswith conditions, enabling detection of a sequence like failed login followed by successful login. Option A is incorrect because transaction is not optimized for very long time ranges; it can be resource-intensive and is better suited for shorter windows.
Option D is incorrect because transaction does not require identical timestamps; events can span time. Option E is incorrect because transaction does not automatically deduplicate events; you would need the dedup command for that.
An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?
The 'by' clause creates a separate time series for each unique value of method.
Why this answer
The `timechart` command with a `by` clause splits the count into separate series for each distinct value of the 'method' field, creating one line per method on the chart. Option A is incorrect because the time range is determined by the search, not necessarily per day. Option B is incorrect because the default span depends on the time range (e.g., less than 24 hours uses 1-minute bins, etc.).
Option C is incorrect because `timechart` does not limit to top 10 by default.
Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?
If `uri_path` is not a field in the sourcetype, the rex will not extract anything.
Why this answer
The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.
Exam trap
Splunk often tests the misconception that a regex pattern is incorrect when the real issue is that the source field is missing or contains non-matching data, leading candidates to focus on syntax rather than data validation.
How to eliminate wrong answers
Option A is wrong because `stats` can be used after `rex` without issue; `rex` extracts fields, and `stats` can then aggregate them. Option C is wrong because if the time range were too short, the search would return no events at all, not just no results for `api_version` while other fields might exist. Option D is wrong because the regex pattern `(?<api_version>/v[0-9]+)` is syntactically correct for capturing a version string like `/v1` or `/v2`; the issue is that it is applied to a field that may not contain matching data.
A large e-commerce company uses Splunk to monitor its web application performance. The operations team has created a dashboard with a timechart showing the 95th percentile of page load times over the last 24 hours. Recently, the dashboard stopped showing data for the last hour. The Splunk administrator confirms that the index is receiving data and the sourcetype is correctly configured. The search string is: `index=web_app sourcetype=access_combined earliest=-24h@h latest=@h | timechart perc95(page_load_time) by host` The dashboard panel uses a base search and a post-process search. The base search is: `index=web_app sourcetype=access_combined earliest=-7d@d latest=@h` What is the most likely cause of the missing last hour of data?
@h snaps to the beginning of the hour, missing the last 45 minutes.
Why this answer
The base search uses `latest=@h`, which snaps the end time to the beginning of the current hour (e.g., 14:00:00), excluding any data from the current partial hour (e.g., 14:00:01 to 14:59:59). Since the dashboard panel relies on this base search, the post-process search inherits that time range, causing the last hour of data to be missing even though the index is actively receiving data.
Exam trap
Splunk often tests the subtle behavior of time modifiers like `@h` and `@d`, where candidates mistakenly believe the data is missing due to indexing or sourcetype issues rather than the time range snapping to the start of the current hour.
How to eliminate wrong answers
Option A is wrong because the post-process search does not have a time range override; it inherits the base search's time range, and no conflict is described. Option B is wrong because the base search does not use a macro; it is a literal search string. Option C is wrong because the base search correctly specifies `sourcetype=access_combined`, matching the panel's search, and the administrator confirmed the sourcetype is correctly configured.
A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?
maxevents caps the number of events per transaction, preventing runaway resource usage.
Why this answer
Maxevents=500. This option limits the number of events that can be included in a single transaction, preventing a transaction with many events (like 1000+) from consuming too many resources. Option A (keepevicted=true) retains evicted events but does not limit resource usage.
Option B (maxspan=1h) limits the time span of the transaction, not the event count. Option D (maxpause=5m) limits the time between events but does not cap the total number of events.
A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?
Correct: The condition must evaluate the count field value, not the number of results.
Why this answer
The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D).
Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.
A security team needs to group all login events from the same user session. Events include 'login' and 'logout' with a common session_id field. Which command should be used to combine these events into a single event per session?
Correctly groups events by session_id into a single transaction event.
Why this answer
The `transaction` command is designed to group related events based on common fields and time constraints, making it ideal for combining login and logout events by session_id.
An analyst creates a macro that uses `| inputlookup` to validate a macro argument. Which statement about macro validation is true?
This is a common pattern to ensure argument values are valid.
Why this answer
Macros can use `| inputlookup` within their definition to validate arguments by checking against a lookup table. Option A is incorrect because macro validation is possible using lookups. Option C is incorrect because validation is implemented within the macro, not in the saved search.
Option D is incorrect because macros do not support regex validation; they rely on lookups for argument validation.
You need to find the percentage of total events contributed by each sourcetype. Which command should follow index=* | stats count by sourcetype?
eventstats adds total column, then eval computes percentage per row.
Why this answer
`eventstats sum(count) as total` adds a new field 'total' containing the sum of the count field across all events, and then `eval percent = count/total*100` computes the percentage for each sourcetype. Option A (`addtotals`) adds row totals, not a column total, so it cannot be used to compute percentages of total. Option C uses `sum(count)` inside `eval`, which is a statistical function not available in `eval`.
Option D (`appendpipe`) appends a row with the total, not a column, making the calculation incorrect because the total is not available per event in the subsequent `eval`.
A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?
This suppresses duplicate alerts for the same IP within 5 minutes.
Why this answer
Enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.
Exam trap
The trap here is that candidates often confuse throttling with alert conditions or time windows, mistakenly thinking that setting a rolling time window or result count alone will prevent duplicate alerts, when in fact throttling is the specific mechanism designed to suppress repeated alerts based on field values.
How to eliminate wrong answers
Option A is wrong because Digest mode sends a single alert containing all results in a summary, but it does not suppress duplicate alerts for the same source IP across consecutive search runs; it also does not inherently throttle per IP. Option B is wrong because a Real-time window of 5 minutes with 'Alert on' set to 'Result count' would trigger an alert every time the search runs (every 5 minutes) if the condition is met, but it does not suppress repeated alerts for the same source IP within overlapping windows. Option C is wrong because setting 'Number of results > 100' with a rolling time window of 5 minutes will fire an alert every time the search executes and the condition is true, without any deduplication or throttling per source IP, leading to multiple alerts for the same incident.
Which THREE factors should be considered when deciding between using a lookup table and a KV store for enriching data?
KV store supports real-time updates.
Why this answer
The correct factors are B, C, and D. B is correct because KV stores can be updated in real-time via REST API, while lookup tables are typically static files. C is correct because KV store collections can be used with the 'kv' command for search-time operations, whereas lookup tables use 'inputlookup' or 'lookup'.
D is correct because lookup tables can support time-based lookups using time fields, which is a feature not available in KV stores. A is incorrect because 'inputlookup' is for file-based lookups, not KV stores; KV store collections are typically accessed with the 'kv' command. E is incorrect because KV stores are generally faster and more scalable for large datasets due to their database-backed storage and indexing, while CSV lookup files can become slow when dealing with very large data sets.
A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?
Correctly splits and expands each ID, then looks up department.
Why this answer
It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.
Exam trap
The trap here is that candidates often confuse makemv (which only creates a multivalue field) with mvexpand (which actually creates separate events), leading them to choose Option A and miss the need to expand before lookup.
How to eliminate wrong answers
Option A is wrong because makmew with delim=',' creates a multivalue field but does not expand it into separate events; with max_matches=1, the lookup would only match the first value and ignore the rest. Option B is wrong because match() is a string-matching function, not a lookup mechanism, and the syntax is invalid for performing a table lookup. Option D is wrong because inputlookup does not accept a dynamic field reference like emp_id_field; it requires a literal value or a subsearch, and it cannot be used inline with event data.
A lookup table maps combinations of 'source_ip' and 'dest_port' to a 'policy' field. The lookup is defined in transforms.conf with a max_match of 1. Which lookup command syntax will correctly perform the lookup?
This syntax correctly maps event fields to lookup fields.
Why this answer
The lookup command takes a space-separated list of event fields to match against lookup fields in order.
A large CSV lookup file (over 10 million rows) is causing search performance degradation. Which solution best improves performance without sacrificing accuracy?
KV Store lookups provide indexed lookups and can be updated without reindexing, improving performance for large, dynamic datasets.
Why this answer
KV Store lookups provide indexed lookups and can be updated without reindexing, improving performance for large, dynamic datasets. Option A is incorrect because increasing max_memory in transforms.conf does not fundamentally improve lookup efficiency for large CSV files. Option B is incorrect because index-time lookups require reindexing and are not suitable for frequently changing data.
Option D is incorrect because reducing the CSV file to only the most common keys would lose accuracy for less common lookup keys.
Which TWO fields are automatically created by the transaction command? (Select exactly 2 correct answers.)
Correct: transaction adds _endtime.
Why this answer
The transaction command adds _starttime and _endtime fields to each event in the transaction. It also adds duration and eventcount, but those are not listed as options. _time and maxpause are not created by transaction.
A user defined a macro that includes a lookup command. The macro works correctly in ad-hoc searches. However, when the macro is used in a scheduled saved search, the macro fails to expand. Administration confirms the macro is shared globally. What is the most likely cause of this failure?
All knowledge objects used in the macro must be accessible from the saved search's app context.
Why this answer
Scheduled saved searches run under the context of the app where the saved search is defined. Even though the macro itself is shared globally, any commands or lookups used within the macro must be accessible in that app context. If the lookup used in the macro is defined in a different app and not shared to the saved search's app, the macro will fail at schedule time while working in ad-hoc searches where the user has access to the lookup.
Therefore, option B is correct. Option A is unlikely because macro arguments would cause failure in ad-hoc as well. Option C is false as administration confirmed the macro is shared globally.
Option D is incorrect because a syntax error would also manifest in ad-hoc searches.
Which TWO conditions can cause a transaction to be evicted?
If maxpause is reached, the transaction is closed and evicted from open set.
Why this answer
Correct options: A (Maximum pause between events exceeded) and C (Maximum number of events per transaction reached). These are two conditions that cause a transaction to be evicted. Option B (Timestamp format mismatch) does not cause eviction; it may cause events not to be grouped.
Option D (Transaction has too many fields) is not a standard eviction condition. Option E (Search is canceled by user) stops the search, not evicts a transaction.
A dashboard developer wants to color-code the bars in a column chart based on a severity field (critical=red, high=orange, medium=yellow, low=green). How can this be achieved?
The chart command supports mapping severity to colors via options like 'colorPalette' or by using a color field in the search.
Why this answer
In Splunk, to color-code a chart based on a field like severity, you can use the `eval` command to create a color field that maps severity values to color names (e.g., `| eval color=case(severity="critical","red", severity="high","orange", ...)`), and then use that field in the chart's visualization options for color. The `chart` command itself does not have a `useColors=true` parameter; the phrase refers to a conceptual use of color palettes or visualization settings. Option A is incorrect because drilldown is for navigation, not coloring.
Option C is incorrect because the `overlay` option overlays a second chart, not for color coding. Option D is incorrect because CSS is not the standard method for dynamic field-based coloring in Simple XML dashboards.
A large e-commerce company uses Splunk to monitor its web application performance. The application logs every HTTP request with fields: `transaction_id`, `url`, `response_time_ms`, `status`. Currently, the team uses the following search to identify slow page loads: `index=web sourcetype=access_combined | transaction transaction_id maxspan=60s | eval total_time = sum(response_time_ms) | where total_time > 5000` However, the search returns no results even though there are known slow pages. The team verified that logs contain `transaction_id` values and that some pages take over 10 seconds. What is the most likely reason the search fails to identify slow pages?
`sum()` is a statistical function; you need `eval total_time = mvsum(response_time_ms)` or use `stats sum` in a different approach.
Why this answer
After the `transaction` command, `response_time_ms` becomes a multivalue field containing all the individual response times from the events in the transaction. The `sum()` function in `eval` does not automatically aggregate multivalue fields; it requires explicit use of the `mvsum()` function or a `stats sum()` approach. Without this, `total_time` is not calculated correctly, so the `where` clause never matches, returning no results despite slow pages existing.
Exam trap
The trap here is that candidates assume `sum()` in `eval` automatically aggregates multivalue fields, but Splunk's `eval` does not support aggregation functions on multivalue fields without explicit `mv` functions.
How to eliminate wrong answers
Option A is wrong because the search is designed to find slow pages with total time > 5000 ms (5 seconds), and the `maxspan=60s` is more than sufficient to capture transactions that take over 10 seconds; the issue is not the maxspan duration. Option B is wrong because the team verified that logs contain `transaction_id` values and that pages take over 10 seconds, implying the same `transaction_id` is used per page load; if IDs differed, the `transaction` command would simply create separate transactions, not cause zero results. Option C is wrong because the field name `response_time_ms` is explicitly stated in the question as a field in the logs, and there is no evidence of a misspelling; the problem lies in how the field is processed after `transaction`.
A lookup is not returning any results even though the search events contain the matching field. The lookup definition in transforms.conf includes 'default_match = false'. What is the most likely issue?
Case mismatch is a common cause of lookup failure.
Why this answer
Lookups are case-sensitive by default; if event fields have different case than lookup fields, no match occurs. default_match=false causes no default value on mismatch.
A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?
maxpause ends transaction after 30 minutes of inactivity between events.
Why this answer
Maxpause=30m. The maxpause option specifies the maximum time between events in a transaction; if the pause exceeds this value, the transaction ends. This is ideal for grouping events by user session with a 30-minute inactivity timeout.
Option B (keepevicted=true) retains partial transactions that were evicted from memory, not ending criteria. Option C (maxspan=30m) limits the total time span from the first to the last event, not inactivity. Option D (maxevents=100) limits the number of events in a transaction.
A Splunk admin needs to schedule a search to run every day at 2 AM and send an email alert if more than 100 events are found. Which saved search configuration achieves this?
Correct: Standard schedule, trigger, and action.
Why this answer
Splunk saved searches allow setting a schedule with 'Daily' at a specific time (02:00), and you can configure an alert trigger condition 'Number of Events' > 100, with action 'Email'. Option A uses 'Custom condition' with a string 'search result count > 100', which is not a standard trigger and the syntax is incorrect. Option B uses 'Every day' which is not a valid schedule option in Splunk; valid options include 'Daily'.
Option D uses 'Result count' which is not a standard trigger condition name; the correct term is 'Number of Events'.
Which TWO of the following eval functions can be used to convert a string to a numeric value?
`int()` converts a value to an integer, working on strings as well.
Why this answer
The `int()` function (option C) converts a string representation of an integer into a numeric integer value, and `tonumber()` (option E) converts a string to a floating-point or integer number, making both valid for converting strings to numeric values in Splunk's eval command.
Exam trap
Splunk often tests candidates' familiarity with Splunk's specific eval function names, and the trap here is that `number()` and `str()` sound plausible but are not valid Splunk functions, leading candidates to select them based on general programming knowledge rather than Splunk's actual syntax.
An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?
Correct: mvindex accesses elements by position.
Why this answer
The correct filter uses mvindex to access the first and last values of the multivalue 'action' field created by the transaction command. Option A uses invalid array indexing (action[0] is not valid in Splunk). Option B uses nonexistent functions first() and last().
Option C would require a single event to have both values simultaneously, which is impossible. Option D correctly uses mvindex(action,0) for the first event and mvindex(action,-1) for the last event, ensuring the transaction starts with 'login' and ends with 'logout'.
Which THREE of the following are true considerations when using CIM data model acceleration? (Select exactly 3.)
tstats reads the tsidx files directly.
Why this answer
Options B, C, and D are correct. Option A is false: acceleration works on both indexed and extracted fields, but constraints do not require field aliases; they can use field names directly. Option E is false: acceleration uses tsidx files (time-series indexes), not summary indexes, to store precomputed results.
A company has over 2000 saved searches that are used across multiple teams. Each team has its own app, and many searches share common logic, such as filtering by a specific index or time range. The system is experiencing slow search performance and difficulty in managing changes. The administrator wants to improve maintainability and performance. Which action would best address these issues?
Correct: Macros reduce duplication, simplify updates, and improve performance.
Why this answer
Macros reduce duplication, simplify updates, and can improve performance by reducing parsing time. Consolidating into a single app does not reduce logic duplication. Increasing memory is a temporary fix.
Acceleration on all searches may consume resources and does not address logic duplication.
A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?
A subsearch can pre-filter or aggregate events, reducing the input size for transaction and thus memory.
Why this answer
Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.
Exam trap
The trap here is that candidates often assume increasing maxspan or adding fields will reduce memory usage, but these actions actually increase the memory footprint or do not address the root cause of excessive data volume.
How to eliminate wrong answers
Option A is wrong because 'kvform' extracts key-value pairs from event data and does not perform event correlation or grouping, so it cannot replace the 'transaction' command's functionality. Option C is wrong because adding more fields to the 'transaction' command increases the specificity of grouping but does not reduce memory usage; in fact, it may increase memory overhead by requiring more comparisons. Option D is wrong because increasing maxspan to 2 hours would allow longer time windows, potentially increasing the number of events grouped per transaction and worsening memory consumption, not reducing it.
A Splunk administrator is troubleshooting a search that uses the `transaction` command. The search is taking too long to complete and returning incomplete results. Which TWO changes are most likely to improve performance and accuracy of transaction searches? (Choose TWO.)
Reduces data volume processed by transaction.
Why this answer
Using the `fields` command before `transaction` reduces the amount of data Splunk must process by retaining only the fields necessary for correlation and output. This minimizes memory and CPU overhead, directly improving search performance and reducing the risk of incomplete results due to resource limits.
Exam trap
Splunk often tests the misconception that increasing limits (like `maxevents` or removing `maxspan`) will improve results, when in fact it exacerbates resource exhaustion and incomplete data.
A security analyst wants to find IP addresses that have attempted to access a specific URL more than 5 times in the last hour and also have a user agent string containing "curl". They need to use a subsearch to pre-filter IPs. Which search is correct?
Correctly uses subsearch to filter IPs, then counts and filters.
Why this answer
It uses a subsearch to first find IPs that have accessed the URL more than 5 times with a user agent containing 'curl', then passes those IPs to the outer search to filter the original data. The subsearch returns a list of src_ip values, which the outer search uses as a filter, ensuring only IPs meeting both conditions are counted again. This matches the requirement to pre-filter IPs using a subsearch.
Exam trap
The trap here is that candidates often confuse a subsearch with a simple filter or stats command, leading them to choose options that either omit the subsearch syntax or place it incorrectly, such as at the start without proper piping.
How to eliminate wrong answers
Option A is wrong because the subsearch is placed at the beginning without a leading pipe, making it a standalone search that does not feed into the outer search; it also lacks the outer search's index and sourcetype, so it returns no results. Option C is wrong because it does not use a subsearch at all; it simply filters and counts in a single search, which does not pre-filter IPs as required. Option D is wrong because it uses parentheses incorrectly and does not include a subsearch; it performs a single-pass filter and count, failing to pre-filter IPs.
A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?
maxpause=1800 seconds (30 minutes) closes the transaction after 30 minutes of inactivity.
Why this answer
(maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.
Exam trap
The trap here is confusing maxspan (total duration limit) with maxpause (inactivity timeout), leading candidates to choose maxspan=30m when the requirement explicitly calls for an inactivity-based end condition.
How to eliminate wrong answers
Option A is wrong because startswith=login endswith=logout defines explicit start and end events for the transaction, but the requirement is to end based on inactivity, not on a specific logout event. Option B is wrong because mvlist=session_id is not a valid transaction command option; it is used with the stats or eventstats command to create a multivalue field, not to control transaction boundaries. Option C is wrong because maxspan=30m sets a maximum total time span for the entire transaction from first to last event, not a pause or inactivity limit; if events span more than 30 minutes, the transaction is forcibly split, which does not match the requirement of ending after 30 minutes of inactivity.
A Splunk admin has created several macros to simplify complex search commands. One macro, named `time_filter`, is defined as `earliest=-7d@d latest=@d`. The admin also has a saved search that uses this macro. Recently, users have complained that the saved search reports data from the wrong time range: it appears to be showing data from the last 24 hours instead of the last 7 days. The admin inspects the saved search and finds that the search string is: `index=main | eval days=now() | where days > relative_time(now(), "-7d@d") | `time_filter`` The admin suspects the macro is not being expanded correctly. Which of the following is the most likely cause of the issue?
If the macro is disabled, it will not expand. This would cause the search to miss the time range modifiers and default to the last 24 hours.
Why this answer
The macro `time_filter` is defined as `earliest=-7d@d latest=@d`, but if it is disabled, it will not be expanded when invoked with backticks. Consequently, the search runs without the specified time range, defaulting to the last 24 hours, which explains the user reports. The admin should verify and enable the macro in the settings.
Exam trap
The trap is that candidates may assume macro definition is correct and overlook the macro's enabled status. A disabled macro will not expand, leading to unexpected default behavior.
How to eliminate wrong answers
Option B is wrong because saved search permissions (Private vs. Global) do not affect macro expansion; macros are resolved at search time regardless of the saved search's permissions. Option C is wrong because macros are invoked with backticks, not pipes; using a pipe would treat `time_filter` as a search command, which would fail because it is not a valid command.
Option D is wrong because if the macro were disabled, the saved search would fail with an error, not silently show wrong data; the admin would see an error message indicating the macro is not found.
Which THREE of the following are required steps to properly schedule a saved search for summary indexing that runs a macro?
The summary index must exist to store the results.
Why this answer
Correct answers: A, B, E. A is required because the summary index must exist before the search writes summary data. B is required because the saved search must have a schedule to run automatically.
C is incorrect because the summary index is not automatically created; it must be created beforehand. D is incorrect because the macro does not have to be in the same app; it can be shared across apps. E is correct because the macro must be accessible from the context (app permissions) where the saved search runs.
A security analyst wants to calculate the average latency for each web server over the past hour, but only for requests where the status code is 200. The search result includes fields: server, latency, status. Which search correctly accomplishes this?
Correctly filters only status=200 events before statistical aggregation.
Why this answer
It filters events to only those with status=200 before the stats command, ensuring the average latency is calculated exclusively over successful requests. The stats command then computes the average latency grouped by server, which directly answers the requirement without needing conditional logic or post-filtering.
Exam trap
The trap here is that candidates often think they can filter after stats using where, but stats collapses events into summary statistics, so a subsequent where cannot filter the original events used in the aggregation.
How to eliminate wrong answers
Option A is wrong because it uses eval to set good_latency to null for non-200 statuses, but stats avg() ignores null values, so it effectively averages only over status=200 events; however, this is less efficient and less idiomatic than filtering first, and the question asks for the 'correct' search, where D is the standard best practice. Option B is wrong because eventstats calculates the average latency across all events (including non-200) and adds it to each event, then filters to status=200; this gives the overall average latency for all requests, not the average per server for only status=200 requests. Option C is wrong because it applies the where status=200 filter after the stats command, which has already aggregated data across all status codes, so the filter has no effect on the computed averages.
A security team notices that using `transaction` on a large dataset of firewall logs causes memory issues. Which alternative approach would most efficiently correlate events while reducing resource consumption?
stats consumes less memory than transaction for grouping events.
Why this answer
Using `stats` with `list()` and `bin` time is more memory-efficient than `transaction` for correlating events by session_id. `transaction` creates a transaction object with all event details, consuming more memory, while `stats` aggregates fields without storing raw events. Options A (`concurrency`) is for analyzing concurrent events, not correlation; B (increasing limits) only postpones issues; C (`append`) is for combining results, not efficient correlation.
A security analyst is writing a search to detect lateral movement across servers by correlating authentication events from multiple domain controllers. Each event has a `user`, `src_ip`, and `dest_ip`. The analyst wants to group events where the same user authenticates from at least 3 different source IPs within 10 minutes. Which TWO components must be part of the search to achieve this? (Choose TWO.)
Groups events by user for correlation.
Why this answer
Options A and C are correct. The `transaction user` command groups events by user, and `maxspan=10m` limits the grouping window. Option B is incorrect because `mvcount(src_ip)>=3` counts all occurrences of `src_ip`, not distinct IPs, so it does not guarantee that the user authenticated from at least 3 different source IPs.
The correct approach would involve using a different method to ensure distinct IPs, such as removing duplicates within the transaction before counting.
Exam trap
The trap here is that candidates may confuse `maxevents` with the requirement for distinct source IPs, or think that `dedup` is needed to reduce data volume, when in fact it would break the correlation by removing necessary events.
During peak hours, a search that uses a KV Store lookup frequently times out. The search runs on daily data but the KV Store collection has millions of records. Which approach is most effective to reduce lookup time while maintaining data freshness?
This reduces the dataset size and improves lookup speed.
Why this answer
Pre-computing lookup results into a smaller CSV that is refreshed frequently can improve performance while keeping data up-to-date.
A lookup definition includes the option 'batch_index_query=True'. What is the effect?
Correct because batch_index_query=True means the lookup is populated from an index query when first used, loading data into memory for efficient lookups.
Why this answer
Batch_index_query=True means the lookup is populated from an index search when first used. Option B is wrong because it incorrectly implies batch processing to reduce lookups. Option C is wrong because it incorrectly implies the lookup is applied to all indexes.
Option D is wrong because caching is separate.
A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?
The panel's search must be set to run automatically to refresh data.
Why this answer
The single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.
Exam trap
Splunk often tests the misconception that setting the dashboard's auto-refresh interval alone is sufficient to update panel values, when in fact each panel's search must also be configured to re-execute on refresh (via 'Auto' or a scheduled search).
How to eliminate wrong answers
Option A is wrong because 'Token delay' controls the debounce time for token changes, not the execution of the underlying search; a high token delay would affect how quickly a token-driven search runs after a user interaction, not the periodic update of a static search. Option C is wrong because setting the time range picker to 'All time' affects the time scope of the search, not whether the search re-executes on refresh; it would still return a static result if the search is not scheduled. Option D is wrong because the dashboard's 'Auto-refresh' interval (set in Dashboard Settings) triggers a page-level refresh, but if the panel's search is not scheduled or set to 'Auto', the refresh only reloads the cached result from the initial search, not a new computation.
A user wants to calculate the average response time per user, but only for users who have more than 10 events. Which search approach is efficient?
Computes both statistics and filters correctly.
Why this answer
It first uses `stats` to compute both the average response time and the event count per user, then filters with `where cnt>10` to keep only users who have more than 10 events. This ensures the average is calculated only after grouping, and the count condition is applied on the aggregated result, which is efficient and accurate.
Exam trap
The trap here is that candidates often confuse `eventstats` with `stats` and think they can filter on an aggregated field like `count` without first computing it in the same `stats` command, leading them to choose Option A or D.
How to eliminate wrong answers
Option A is wrong because `eventstats` adds the average and count to each raw event without reducing the dataset, and then `where count>10` filters events rather than users, so it does not correctly isolate users with more than 10 events. Option C is wrong because `where count>10` is applied before any aggregation, but `count` is not a field in raw events, so this will return no results or an error. Option D is wrong because `stats avg(response_time) by user` computes only the average per user, discarding the count, so `where count>10` cannot reference the count field, causing the search to fail or produce incorrect results.
A Splunk administrator notices that a transaction command is consuming excessive memory and taking too long to complete. The transaction is defined on a field with high cardinality. Which of the following would most effectively reduce memory usage and improve performance?
Lower cardinality means fewer transaction groups, reducing memory and computation.
Why this answer
The transaction command groups events based on field values, and high cardinality fields create many unique groups, each requiring memory for state tracking. Using a lower-cardinality field reduces the number of concurrent groups, directly lowering memory consumption and processing time. This addresses the root cause rather than adjusting timeouts or eviction policies.
Exam trap
The trap here is that candidates often focus on adjusting time-based parameters (maxspan, maxpause) or output options (keepevicted) instead of recognizing that the fundamental issue is the cardinality of the grouping field, which directly drives memory and state management overhead.
How to eliminate wrong answers
Option A is wrong because increasing maxspan allows the transaction to span a longer time window, which can actually increase memory usage by keeping events in memory longer, not reduce it. Option B is wrong because removing the maxspan constraint removes any time boundary, causing the transaction to wait indefinitely for events, which can dramatically increase memory usage and completion time. Option C is wrong because keepevicted=false controls whether evicted (incomplete) transactions are returned, but it does not reduce the memory consumed by the active transaction groups themselves; it only affects output behavior.
A security analyst wants to map IP addresses to hostnames using a CSV lookup file. Which command is correct to define a lookup that maps the IP field to hostname field, with the file named 'ip_host.csv'?
Correct syntax for lookup with field mapping.
Why this answer
The lookup command syntax for mapping multiple fields is 'lookup <lookup-table> <input-field1> as <output-field1> <input-field2> as <output-field2>'. Here, 'lookup ip_host.csv ip as ip_output hostname as hostname_output' correctly maps the ip field from your data to ip_output in the lookup, and hostname from the lookup to hostname_output. Option A incorrectly uses OUTPUT, which is used for single field output.
Option B has reversed order and missing output alias. Option C returns all rows without mapping.
An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?
If only one event exists, the transaction will have duration 0. To avoid this, use startswith/endswith or adjust maxspan.
Why this answer
A duration of 0 often occurs when there is only one event in the transaction. This can happen if the events do not meet the criteria for starting or ending a transaction, or if the maxpause is too short.
A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?
Without a logout event, the transaction may contain only one event, and duration is not calculated, defaulting to 0.
Why this answer
When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.
Exam trap
Splunk often tests the misconception that a 0-second duration is caused by a grouping or ordering error, when in fact it is a direct result of incomplete transactions (missing end events) within the transaction command's logic.
How to eliminate wrong answers
Option A is wrong because the transaction command groups events correctly based on the fields specified (e.g., user or session ID); a 0-second duration is not caused by a failure to group but by incomplete transactions. Option B is wrong because the transaction command processes events in time order (as indexed) and does not arbitrarily reorder timestamps; if login and logout timestamps were the same, it would indicate simultaneous events, not a processing order issue. Option C is wrong because maxevents=5 limits the number of events in a transaction but does not cause early closure that results in a 0-second duration; the duration is calculated from the first to the last event in the transaction, so if multiple events exist, the duration would be non-zero.
A network engineer wants to add geographic location (city, country) to firewall logs based on source IP. Which lookup type is most appropriate?
A CSV file with IP ranges and locations is straightforward and performs well for static reference data.
Why this answer
File-based lookup (CSV). A CSV file containing IP-to-location mappings is simple, efficient, and well-suited for static geographic data. Option A (KV Store lookup) is designed for dynamic, frequently updated data, not static IP-to-location mappings.
Option B (Scripted lookup) is for complex external data sources requiring external commands or scripts. Option C (Automatic lookup configured in props.conf) is a method to apply lookups automatically at search time, but it requires a lookup definition file (like CSV) first; it is not a lookup type. Therefore, the most appropriate lookup type for this use case is a file-based CSV lookup.
Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)
Correct: join correlates events from two datasets.
Why this answer
Transaction groups events based on common fields. Join can correlate events from two searches. Stats with values can also correlate by grouping events into a single result.
Append and subsearch do not perform correlation.
A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?
Per Result triggers an alert action for each search result; combined with throttling, you can limit emails.
Why this answer
Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting.
Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism.
Therefore, C is the key setting among the choices.
If the number of distinct src_ip values is less than 10, head 10 returns all of them, resulting in fewer than 10 rows.
Why this answer
The `stats count by src_ip` command groups events by each unique source IP address and counts them. If the search returns only 5 results, it means there are only 5 unique source IPs in the dataset matching the time range and filters. The `head 10` command then limits output to 10 rows, but since only 5 groups exist, only 5 rows are returned.
Exam trap
The trap here is that candidates assume `head 10` always returns 10 results, forgetting that `head` limits the number of output rows from the preceding command, which may already have fewer rows than the limit.
How to eliminate wrong answers
Option A is wrong because a short time range would reduce the total event count, but the `stats count by src_ip` command still groups by unique IPs; if there are more than 10 unique IPs, the search would return 10 results regardless of total event count. Option B is wrong because `sort - count` with a space is valid syntax in SPL; the space between the dash and the field name is optional and does not cause the command to fail. Option C is wrong because the `stats count by src_ip` command already includes `count` as the aggregation function and `src_ip` as the grouping field; there is no requirement to list `count` in the `by` clause.
Refer to the exhibit. The macro `count_by_host` is defined as shown. The macro is invoked as `| `count_by_host`. What will the expanded search look like?
Correct: Double pipe due to leading pipe in macro definition.
Why this answer
Since the macro definition includes a leading pipe, invoking it with `| `count_by_host` results in two pipes – one from the invocation and one from the definition. So the expanded search becomes `| | stats count by host, sourcetype`. Option A would be missing the second pipe, option B shows the macro invocation unexpanded, and option C would be missing both pipes.
A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?
Correct: This ends the transaction when a deny event is encountered.
Why this answer
'endswith="action=deny"' specifies the event that terminates the transaction when a deny event occurs. Option A 'endswith="action=allow"' would end on an allow event, not the desired deny. Option B 'startswith="action=deny"' would start the transaction on a deny event, not end it.
Option D 'maxevents=2' limits the number of events but does not define a condition based on event content.
GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count > 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count > 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count>5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?
Correct. After an upgrade, the app context might have changed, causing the macro to be unavailable.
Why this answer
Macros are resolved in the context of the app where the saved search is defined. If the macro 'get_failed_users' is not defined in the same app context as the 'Brute Force Detection' saved search, the subsearch will fail to resolve the macro and return no results, even though the macro works when run manually in a different app context. Splunk's macro resolution depends on the app context of the search, not the user's current app.
Exam trap
The trap here is that candidates assume macros are globally available or that the subsearch's manual success implies it will work in the saved search, overlooking the critical role of app context in macro resolution.
How to eliminate wrong answers
Option A is wrong because the subsearch is not limited by the time range of the main search; subsearches default to the same time range as the main search unless explicitly overridden, and the tstats portion runs fine, indicating time range is not the issue. Option C is wrong because macros can be used in subsearches; there is no restriction preventing macros from being used within subsearches. Option D is wrong because the administrator confirmed that the macro's search works when run manually in the same time range, ruling out a typo in the macro definition.
Match each Splunk license violation type to its consequence.
Drag a concept onto its matching description — or click a concept then click the description.
Indicates usage is near the limit
Usage exceeds license quota, search may be limited
License has expired, functionality is restricted
License key is incorrect or corrupted
Usage is within license limits
Why these pairings
Splunk license violations have two states: Warning (grace period with alerts) and Violation (search restricted for non-admins). Common mistakes include confusing the two or expecting immediate indexing stoppage.
Which TWO options can be used with the `transaction` command to define the beginning and end of a transaction?
Defines the end event.
Why this answer
startswith and endswith define boundary events. maxspan and maxpause are constraints.
Which TWO components must be configured to enable an automatic lookup that populates fields at index time?
The lookup definition (filename, fields, match type) is in transforms.conf.
Why this answer
Options A and D are correct. transforms.conf defines the lookup table and field mapping, and props.conf specifies which sourcetype should use the lookup automatically at index time. Option B is incorrect because the lookup table file must be placed in the 'lookups' directory of the app, not 'lookup' (typo) and also the file placement is necessary but not sufficient for automatic lookup; configuration files are required. Option C is incorrect because indexes.conf is for index configuration, not lookups.
Option E is incorrect because lookups can be defined via configuration files, not only via Splunk Web.
An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?
Correct: Groups events by common field across sourcetypes.
Why this answer
(transaction). The transaction command groups events from multiple sourcetypes based on a common field (user) and can correlate them into a single event per session, preserving all fields. Options A (append) simply adds events from one search to another without correlation, B (union) combines results from multiple searches without grouping, and D (join) merges events from two datasets based on a common field but does not handle sessionization or multiple sourcetypes as effectively as transaction.
An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?
Correctly filters for 404 errors and efficiently returns top 5 user agents using the top command.
Why this answer
It first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.
Exam trap
Splunk often tests the order of operations in Splunk SPL, specifically that filtering commands like `status=404` must precede statistical commands like `top` or `stats` to ensure the aggregation is performed only on the subset of interest, not on the entire dataset.
How to eliminate wrong answers
Option B is wrong because the `top` command processes fields in the order they are listed; placing `user_agent` before `status=404` means it will count user_agent values across all events, then apply the status=404 filter as a secondary field, which does not restrict the count to only 404 errors. Option C is wrong because it omits the status=404 filter entirely, returning the top 5 user agents across all HTTP status codes, not just 404 errors. Option D is wrong because the `where status=404` clause is placed after the `stats count by user_agent` command, which already aggregated data without the status filter; at that point, the `status` field is no longer available in the results, causing the search to fail or return no results.
Practice SPLK-1002 by domain
Target a specific domain to shore up weak areas.