Splunk Core Certified Power User SPLK-1003 (SPLK-1003) — Questions 301–375

A security analyst wants to map IP addresses to hostnames using a CSV lookup file. Which command is correct to define a lookup that maps the IP field to hostname field, with the file named 'ip_host.csv'?

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

A network engineer wants to add geographic location (city, country) to firewall logs based on source IP. Which lookup type is most appropriate?

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

A security analyst runs `index=network sourcetype=firewall | stats count by src_ip | sort - count | head 10` to find the top 10 source IPs by event count. The search returns only 5 results. Which of the following is the most likely reason?

Refer to the exhibit. The macro `count_by_host` is defined as shown. The macro is invoked as `| `count_by_host`. What will the expanded search look like?

A financial company wants to group all events related to a single trading session. The session ID appears in all events. Which is the most efficient way to correlate these events without using transaction?

A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?

GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count > 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count > 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count>5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?

Match each Splunk license violation type to its consequence.

Which TWO options can be used with the `transaction` command to define the beginning and end of a transaction?

Which TWO components must be configured to enable an automatic lookup that populates fields at index time?

An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Match each Splunk search mode to its behavior.

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Which TWO statements about lookup tables are true?

A Splunk admin notices that a scheduled search using inputlookup is returning inconsistent results. The lookup file is stored on the search head and is updated via a script every 15 minutes. What is the most likely cause of the inconsistency?

Which TWO of the following are valid considerations when defining macros in Splunk?

Match each Splunk search operator to its behavior.

A transaction is created using the command: 'index=web status=200 OR status=404 | transaction sessionid'. The user wants to include transactions only if they contain both a 200 and a 404 status. Which additional step achieves this?

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

Which transaction option should be used to ensure that a transaction does not exceed a total duration of 10 minutes?

A saved search that runs every hour is showing 'No results' in its history, but the same search when run manually returns results. Which two of the following are likely causes? (Choose TWO.)

A security analyst needs to find the top 10 users with the most failed login attempts from the linux_secure sourcetype. Which SPL command is most efficient for this task?

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

Which THREE of the following are valid uses of the stats command? (Select three.)

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Which TWO of the following statements about the `transaction` command are true? (Choose two.)

An analyst wants to create a visualization showing the average response time by hour over the past day, with each server in a separate line. Which command should they use?

A search uses a subsearch to retrieve a list of user IDs, and then the main search uses IN operator to filter events. The subsearch is expected to return up to 10,000 values. What is a potential limitation and how can it be addressed?

A team develops multiple dashboards that share common search logic. What is the best practice for managing these searches?

A security team has a saved search that runs every 5 minutes and looks for 'FAILED' events in Windows Security logs. The search uses a macro 'failed_logins' defined as: `define failed_logins() [search index=windows sourcetype=WinEventLog:Security EventCode=4625]`. Recently, the team noticed that the search is returning no results even though there are failed login events. What is the most likely issue?

A team wants to create a dashboard that displays daily user activity over the past 30 days. The underlying data is voluminous (hundreds of millions of events per day). They need the dashboard to load quickly. The admin considers two options: using a summary index with a scheduled search to pre-compute the daily counts, or using data model acceleration on a CIM data model. Which approach is most appropriate for this specific requirement?

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Match each Splunk index time field to its meaning.

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

A large e-commerce company uses Splunk to monitor their web application. They have a query that uses the transaction command to group related events into transactions based on session ID and a 30-minute max pause. The query runs slowly and often times out. The environment has 10 indexers with 4 CPU cores each. The search is run over the last 7 days. Which of the following is the best course of action to improve performance?

Which TWO features are available for customizing dashboards in Splunk's Simple XML?

A security analyst needs to find all events where the field `status` has a value of either "error" or "critical" and the field `bytes` is greater than 1000. Which search correctly accomplishes this?

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Refer to the exhibit. What does the final result represent?

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

A transaction that groups events by field 'session_id' sometimes produces transactions that contain events from multiple distinct sessions due to session_id reuse over time. What is the best way to ensure transactions are correctly separated?

A team wants to create a custom visualization that requires JavaScript and CSS modifications. Which Splunk feature should be used?

A security team needs to correlate failed login attempts across multiple web servers to identify brute force attacks. Each server logs authentication failures with timestamps and source IPs. The team wants to create a transaction that groups failed attempts within 5 minutes from the same IP, but only if there are at least 3 failures. Which approach correctly implements this requirement?

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

An administrator runs a transaction command that groups events by a customer ID but notices that some transactions are missing expected events. The log shows that the events are present and within the maxpause. What could be the reason?

Order the steps to create a data model in Splunk in the correct order.

A search `index=main | eval weekday=strftime(_time,"%A") | stats count by weekday | sort - count` shows that Monday has the highest count. However, the user suspects that Monday data is double-counted due to timezone offset. What should be done to investigate?

You are a Splunk power user working for a healthcare organization. You have created a visualization that shows patient wait times by department over the last 30 days. The chart uses a timechart command with a 'stacked' option. Recently, the chart started showing negative values for some departments, which is impossible because wait times cannot be negative. You have verified that the raw data is correct and contains only positive wait times. The search is: index=healthcare sourcetype=patient_wait | timechart span=1d avg(wait_time) by department. The chart is displayed as a stacked area chart. The negative values appear only for a few departments sporadically. You suspect the issue is related to how null values are handled. What could be causing the negative values?

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

Which THREE of the following are valid Splunk search commands?

A security analyst needs to find all events where the field 'status' is either 'error' or 'critical', and then count the number of events per source IP. Which search is correct?

Which SPL command can be used to create a new field based on a conditional evaluation, such as setting a status field to 'critical' if a numeric threshold is exceeded?

A systems engineer creates a summary index using a saved search that runs every 30 minutes. The summary index aggregates data from multiple sourcetypes. After a week, the engineer notices that the summary index contains duplicate events for certain time ranges. What is the most likely cause?

Match each Splunk role to its typical permission level.

An analyst needs to correlate events from two different data sources (web logs and database logs) based on a common session ID. The events occur within a short time window of 5 seconds. Which command is most appropriate?

What is the MOST likely reason the search returns no results?

Which two statements about the transaction command are correct? (Choose two.)

Arrange the steps to create a new index in Splunk in the correct order.

A search produces a table with many rows. Which visualization type is best suited to show the distribution of a single field's values?

Which statement best describes the search result?

A Splunk administrator runs the following search to identify the top 5 users by total bytes transferred: index=proxy sourcetype=webproxy | stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5 The search returns results, but the numbers seem inflated. On closer inspection, the 'bytes' field is a string type. What must be done to correct the search?

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

A company's security team uses Splunk to monitor firewall logs. They have a lookup file named 'threat_intel.csv' containing 10,000 IP addresses classified by threat level. The lookup is used in a dashboard that shows the number of blocked connections from high-threat IPs over the past 24 hours. Recently, the dashboard has become slow, taking over 30 seconds to load. The lookup file is updated every 15 minutes via a script that replaces the entire file. The search currently uses: `index=firewall | lookup threat_intel.csv src_ip OUTPUT threat_level | where threat_level="high" | stats count`. Which of the following is the MOST efficient way to improve dashboard performance?