Splunk Core Certified Power User SPLK-1003 SPLK-1002 Questions 301–375 | Page 5/7

301

Matchingmedium

Match each Splunk search mode to its behavior.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Optimizes for speed, may skip event data

Balances speed and completeness (default)

Returns all available fields for each event

Searches data as it is indexed

Searches data already indexed

Why these pairings

Search modes control Splunk's behavior: Fast for speed (summary data), Verbose for completeness (all data), Smart as default balance. Common confusions involve swapping these definitions.

Full explanation →

302

MCQeasy

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

A.The maximum number of transactions allowed.

B.The maximum number of events in the transaction.

C.The maximum total time span of the transaction.

D.The maximum time gap between events in the transaction.

AnswerD

Correct: maxpause defines the allowed gap between consecutive events.

Why this answer

maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.

Full explanation →

303

Multi-Selecteasy

Which TWO statements about lookup tables are true?

Select 2 answers

A.Lookups can only be defined by administrators.

B.A lookup definition can include time-based expiration.

C.Lookups are case-sensitive by default.

D.Lookups can be defined from CSV files or KV store collections.

E.Lookups can only be used in the 'lookup' command.

AnswersB, D

Time-based lookups allow automatic refresh.

Why this answer

Options B and D are correct. B: A lookup definition can include time-based expiration, allowing lookups to automatically refresh after a specified period. D: Lookups can be defined from CSV files or KV store collections, providing flexibility in data sources.

A is false because lookups can be defined by power users and administrators, not just administrators. C is false because lookups are case-insensitive by default, not case-sensitive. E is false because lookups can be used in multiple commands such as 'lookup', 'inputlookup', and 'outputlookup'.

Full explanation →

304

MCQhard

A Splunk admin notices that a scheduled search using inputlookup is returning inconsistent results. The lookup file is stored on the search head and is updated via a script every 15 minutes. What is the most likely cause of the inconsistency?

A.The search head is not configured as a lookup server

B.The lookup file contains duplicate entries with different timestamps

C.The lookup file is cached and not automatically refreshed

D.The lookup file exceeds the maximum file size

AnswerC

inputlookup caches the file; changes require a reload or restart.

Why this answer

The most likely cause is that the lookup file is cached by Splunk after the first read, and subsequent updates via the script do not automatically refresh the in-memory cache. By default, Splunk caches lookup files on the search head to improve performance, and changes to the file are not reflected until the cache expires or is manually cleared. This leads to inconsistent results when the scheduled search runs against a stale cached version.

Exam trap

Splunk often tests the misconception that file updates are immediately reflected in search results, when in reality Splunk's caching mechanism introduces a delay that can cause inconsistency unless the cache is explicitly refreshed.

How to eliminate wrong answers

Option A is wrong because the concept of a 'lookup server' applies to distributed environments where lookups are shared across search heads, but the issue here is local caching on a single search head, not server configuration. Option B is wrong because duplicate entries with different timestamps would cause consistent behavior (e.g., returning the first match) rather than inconsistency across runs; the problem is about stale data, not duplicate resolution. Option D is wrong because exceeding the maximum file size would cause the lookup to fail entirely or be truncated, not produce inconsistent results; the search would either error out or return partial data consistently.

Full explanation →

305

Matchingmedium

Match each Splunk search operator to its behavior.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Pipes output of one command to the next

Excludes events that match the following term

Matches events that contain either term

Matches events that contain both terms (default)

Groups terms to control evaluation order

Why these pairings

The correct matches are: AND combines with both, OR with either, NOT excludes. Common confusion is swapping AND and OR.

Full explanation →

306

MCQmedium

A transaction is created using the command: 'index=web status=200 OR status=404 | transaction sessionid'. The user wants to include transactions only if they contain both a 200 and a 404 status. Which additional step achieves this?

A.| transaction sessionid keepevicted=true | where mvcount(status)>=2

B.| where mvcount(mvdedup(status))>=2

C.| search status="200" OR status="404"

D.| where mvcount(status)==2

AnswerB

Correct: Counts distinct status values.

Why this answer

`| where mvcount(mvdedup(status))>=2`. After the initial `transaction` command, each event in a transaction has a multivalue field `status` containing the status codes from all events in that transaction. The goal is to include only transactions that have both a 200 and a 404 status.

Using `mvdedup(status)` removes duplicate status values, then `mvcount()` counts the distinct values. If the count is >=2, it means both statuses are present. Option A uses `keepevicted=true` which is irrelevant; option C is just a search that doesn't filter by transaction; option D counts all occurrences (including duplicates), which could be 2 even if only one status appears twice.

Full explanation →

307

MCQmedium

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

A.Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table

B.Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes

C.Transactions of src_ip 10.0.0.1 that start with deny and end with allow

D.Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes

AnswerD

Correct interpretation of the transaction parameters.

Why this answer

The transaction command groups events by src_ip=10.0.0.1 with startswith='allow' and endswith='deny' and a maxspan of 5 minutes. This forms transactions that begin with an 'allow' event and end with a 'deny' event within a 5-minute window for that source IP. Option A is incorrect because the search filters events for src_ip 10.0.0.1 only, not all source IPs.

Option B is incorrect because it describes transactions of all firewall events, but the start and end conditions restrict the events filtered. Option C is incorrect because it reverses the start and end conditions (start with deny, end with allow) whereas the search specifies start with allow and end with deny.

Full explanation →

308

MCQhard

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

A.keepopen=true

B.keepevicted=true

C.closed=true

D.partial=true

AnswerB

Correct. keepevicted=true retains transactions that are closed due to maxpause.

Why this answer

The keepevicted=true option retains transactions that are closed due to maxpause (i.e., evicted transactions). This ensures that partial but potentially relevant transactions are not discarded and appear in the results. The closed=true option is not a valid parameter for the transaction command.

Full explanation →

309

MCQeasy

Which transaction option should be used to ensure that a transaction does not exceed a total duration of 10 minutes?

A.endswith="end"

B.maxpause=10m

C.startswith="start"

D.maxspan=10m

AnswerD

Correct. maxspan= sets the maximum total duration allowed for a transaction from start to end.

Why this answer

The correct option is D (maxspan=10m) because maxspan sets the maximum total duration of a transaction from start to end. Option A (endswith) defines the ending event, not duration. Option B (maxpause) limits the maximum pause between events within a transaction.

Option C (startswith) defines the starting event. Therefore, maxspan is used to ensure the entire transaction does not exceed 10 minutes.

Full explanation →

310

Multi-Selecthard

A saved search that runs every hour is showing 'No results' in its history, but the same search when run manually returns results. Which two of the following are likely causes? (Choose TWO.)

Select 2 answers

A.The saved search's acceleration is outdated.

B.The user who created the saved search has been deleted.

C.The saved search uses a macro that has a typo in its definition.

D.The index being searched is not available at the scheduled time.

E.The saved search uses a different time range than the manual search.

AnswersD, E

Correct: Temporary index unavailability at the scheduled time results in no data.

Why this answer

Options D and E are correct. Scheduled searches use a specific time range (e.g., 'Last 1 hour') while manual searches often use 'All time' or different presets, leading to different result sets (E). If the index being searched is unavailable at the scheduled time, no results can be returned (D).

Option A is incorrect because outdated acceleration would show old data, not empty results. Option B is incorrect; deleting the user does not cause empty results—usually a permissions error occurs. Option C is incorrect; a macro typo would likely cause an error, not silently return no results.

Full explanation →

311

MCQmedium

A security analyst needs to find the top 10 users with the most failed login attempts from the linux_secure sourcetype. Which SPL command is most efficient for this task?

A.index=main sourcetype=linux_secure "Failed password" | top limit=10 user

B.index=main sourcetype=linux_secure "Failed password" | stats count by user | sort 10 -count

C.index=main sourcetype=linux_secure "Failed password" | stats count by user | sort -count | head 10

D.index=main sourcetype=linux_secure | regex _raw="Failed password" | stats count by user | top limit=10

AnswerA

The `top` command is optimized for finding top values and is efficient for this scenario.

Why this answer

The `top` command in SPL is specifically designed to return the most frequent values of a field, and the `limit=10` parameter directly restricts the output to the top 10 results. This approach is more efficient than using `stats count` followed by `sort` and `head` because `top` performs the aggregation and ranking in a single operation, reducing processing overhead. The search also correctly filters for 'Failed password' events within the `linux_secure` sourcetype, ensuring only failed login attempts are considered.

Exam trap

Splunk often tests the misconception that `stats count by user | sort -count | head 10` is functionally equivalent to `top limit=10 user`, but the trap is that `top` is more efficient and is the idiomatic Splunk command for this task, while the multi-command approach is less optimal and may be penalized in performance-sensitive scenarios.

How to eliminate wrong answers

Option B is wrong because `sort 10 -count` is invalid syntax; the `sort` command requires the field name and direction (e.g., `sort -count`), and the limit must be applied via `head` or the `limit` parameter in `top`. Option C is wrong because while it produces the correct result, it is less efficient than option A; it requires two separate commands (`stats` then `sort` then `head`) instead of the single `top` command, and the `head 10` is redundant if `top limit=10` is used. Option D is wrong because it uses `regex _raw="Failed password"` instead of a simple search term, which is less efficient; Splunk's indexed search for a literal string is faster than applying a regex to the raw event data, and the `top limit=10` at the end is redundant since `stats count by user` already aggregated the data, making the `top` command unnecessary.

Full explanation →

312

MCQhard

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

A.index=main earliest=-24h | timechart span=1h dc(user) as unique_users

B.index=main earliest=-24h | timechart span=1h values(user)

C.index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

D.index=main earliest=-24h | timechart span=1h count by user

AnswerA

dc(user) gives distinct count of users per hour with timechart.

Why this answer

It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Exam trap

The trap here is confusing `count` (total events) with `dc()` (distinct values), and assuming `values()` or `count by user` can produce a unique user count per time period.

How to eliminate wrong answers

Option B is wrong because `values(user)` returns a multivalue list of users per hour, not a count of unique users. Option C is wrong because `stats dc(user) by _time` groups by raw event timestamps, not hourly buckets, and then `timechart` cannot properly aggregate pre-grouped data, leading to incorrect results. Option D is wrong because `count by user` counts events per user per hour, not the number of unique users; it produces a separate series for each user rather than a single count of distinct users.

Full explanation →

313

MCQeasy

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

A.fields - _raw, _time

B.fields + user_id, _time

C.fields - * except user_id

D.fields user_id, _time

AnswerD

Correct: this keeps only the necessary fields.

Why this answer

The 'fields' command with a positive list (without '+' or '-') sets the field list to exactly those specified, keeping only user_id and _time. This reduces memory usage significantly before the transaction command, which typically needs _time and a grouping field like user_id. Option A is incorrect because removing _raw and _time but keeping other fields does not sufficiently reduce fields; transaction requires _time.

Option B is incorrect because 'fields +' adds fields to the existing set, not replacing them, so it does not reduce memory. Option C is incorrect because 'fields - * except user_id' removes all fields except user_id, but also removes _time, which is essential for the transaction command to correlate events based on time.

Full explanation →

314

Multi-Selecthard

Which THREE of the following are valid uses of the stats command? (Select three.)

Select 3 answers

A.Calculating the average of a field across all events.

B.Finding the earliest timestamp for each category.

C.Grouping events by a categorical field and counting them.

D.Creating a time-based chart with multiple series.

E.Enriching events with fields from an external lookup.

AnswersA, B, C

Stats avg() computes average

Why this answer

The `stats` command in Splunk is used to perform statistical aggregations on search results. Option A is correct because `stats avg(field)` calculates the arithmetic mean of a specified field across all events in the result set. Option B is correct because `stats earliest(_time) by category` returns the minimum timestamp for each distinct value of the category field, which is a standard use of the `earliest()` function.

Option C is correct because `stats count by category` groups events by the categorical field and returns the number of events in each group, a fundamental aggregation pattern.

Exam trap

Splunk often tests the distinction between `stats` and `timechart`; the trap here is that candidates see 'time-based chart' and incorrectly assume `stats` can produce it, but `timechart` is the only command that automatically bins events into time buckets and supports multiple series via the `by` clause.

Full explanation →

315

MCQhard

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

A.Define a field alias in props.conf: `FIELDALIAS-action = action as action`

B.Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

C.Create a custom data model that includes the field 'action' with the vendor values.

D.Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

AnswerA

This maps the vendor field 'action' to the CIM field 'action'.

Why this answer

The CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing a calculated field or custom data model, not realizing that when the vendor field name and values already align with the CIM field, a simple field alias is the correct and efficient approach.

How to eliminate wrong answers

Option B is wrong because it uses a calculated field to transform the vendor values into different strings ('allowed', 'blocked', 'dropped'), which would break CIM normalization since the CIM 'action' field expects values like 'accept', 'deny', 'drop' (or 'allowed', 'blocked', 'dropped' depending on the CIM version, but the question states the vendor values are already correct). Option C is wrong because creating a custom data model is unnecessary and overly complex; the CIM already defines the 'action' field, and the goal is to map the vendor data into the existing CIM model, not create a new one. Option D is wrong because tagging is used for event type classification and search-time filtering, not for field value normalization; tags do not map field values to CIM fields.

Full explanation →

316

MCQmedium

An analyst wants to create a visualization showing the average response time by hour over the past day, with each server in a separate line. Which command should they use?

A.`... | timechart span=1h avg(response_time) by server`

B.`... | timechart avg(response_time) by server`

C.`... | chart avg(response_time) by hour, server`

D.`... | stats avg(response_time) by hour, server`

AnswerA

Correctly uses timechart with 1-hour intervals and splits by server.

Why this answer

It uses `timechart` with a span of 1 hour to create a time-based chart, averaging response time and splitting by server, resulting in separate lines per server over the past day. Option B is incorrect because omitting `span=1h` means Splunk may use a default span that might not be exactly one hour, and the request specifically required hourly intervals. Option C uses `chart` which is not time-based and would produce a non-time chart, not a line chart over time.

Option D uses `stats` which outputs a tabular result, not a visualization.

Full explanation →

317

MCQhard

A search uses a subsearch to retrieve a list of user IDs, and then the main search uses IN operator to filter events. The subsearch is expected to return up to 10,000 values. What is a potential limitation and how can it be addressed?

A.The subsearch returns only 10,000 results by default; use | head 50000 in subsearch.

B.The subsearch default limit is 50,000; no change needed.

C.The subsearch default limit is 10,000; to include more, use the | fields values command in the subsearch to return all values.

D.The subsearch default limit is 100,000; no change needed.

AnswerC

Fields values collapses duplicates and can exceed row limit

Why this answer

The default limit for results returned by a subsearch in Splunk is 10,000. When using the `IN` operator in the main search, the subsearch must provide all necessary values; if more than 10,000 values are expected, the `| fields values` command can be used in the subsearch to override this limit and return all distinct values, as it bypasses the default result count restriction.

Exam trap

The trap here is that candidates often confuse the default subsearch result limit (10,000) with the main search result limit (50,000) or assume that increasing the limit with `| head` is the correct solution, when in fact the `| fields values` command is the proper method to return all values from a subsearch without hitting the row limit.

How to eliminate wrong answers

Option A is wrong because the default subsearch limit is 10,000, not 10,000 results by default that can be increased with `| head 50000`; using `| head` would only limit results further, not expand them, and the correct approach is to use `| fields values` to return all values. Option B is wrong because the default subsearch limit is 10,000, not 50,000; stating no change is needed is incorrect when the subsearch is expected to return up to 10,000 values, as this is exactly the default limit and may still be insufficient if the subsearch returns exactly 10,000 values (the limit is applied before the subsearch completes). Option D is wrong because the default subsearch limit is 10,000, not 100,000; no change is needed is also incorrect for the same reason as option B.

Full explanation →

318

MCQmedium

A team develops multiple dashboards that share common search logic. What is the best practice for managing these searches?

A.Create a saved search for each dashboard.

B.Use a single saved search that all dashboards reference.

C.Embed the search strings directly in each dashboard.

D.Use macros to define reusable search fragments.

AnswerD

Correct: Macros centralize common logic, improving maintainability and consistency.

Why this answer

Macros allow reusable search fragments that can be used across multiple dashboards, reducing duplication and simplifying maintenance. Embedding search strings directly in each dashboard (option C) causes duplication and is hard to maintain. Creating a saved search for each dashboard (option A) still duplicates logic.

Using a single saved search that all dashboards reference (option B) may not be flexible enough for different dashboard requirements. Therefore, macros are the best practice.

Full explanation →

319

MCQhard

A security team has a saved search that runs every 5 minutes and looks for 'FAILED' events in Windows Security logs. The search uses a macro 'failed_logins' defined as: `define failed_logins() [search index=windows sourcetype=WinEventLog:Security EventCode=4625]`. Recently, the team noticed that the search is returning no results even though there are failed login events. What is the most likely issue?

A.The macro definition includes empty parentheses 'failed_logins()' but is being called without parentheses, causing Splunk to treat it as a different macro.

B.The macro does not have read permissions for the security team.

C.The macro must be called with backticks like `failed_logins` instead of pipe.

D.The sourcetype field is using a wildcard, which is deprecated.

AnswerA

The macro is defined with parentheses, so it expects to be called with parentheses even if no arguments. Alternatively, define without parentheses.

Why this answer

The macro is defined with parentheses 'failed_logins()', indicating it expects an argument, but when it is called in the saved search, it is likely called without parentheses (e.g., `failed_logins`). In Splunk, a macro defined with parentheses must be called with parentheses even if no arguments are passed; otherwise, Splunk treats it as a different macro. This causes the search to not expand the macro, leading to no results.

Option B is incorrect because permissions are not the issue if it worked before. Option C is incorrect because macros can be called with a pipe, not backticks. Option D is incorrect because wildcards in sourcetype are allowed.

Full explanation →

320

MCQeasy

A team wants to create a dashboard that displays daily user activity over the past 30 days. The underlying data is voluminous (hundreds of millions of events per day). They need the dashboard to load quickly. The admin considers two options: using a summary index with a scheduled search to pre-compute the daily counts, or using data model acceleration on a CIM data model. Which approach is most appropriate for this specific requirement?

A.Use data model acceleration because it automatically updates and is easier to set up.

B.Use neither; instead, use report acceleration on the dashboard search.

C.Use both to ensure data availability.

D.Use a summary index because it allows custom summarization and reduces license usage.

AnswerD

Correct: Summary indexes pre-compute results, significantly reducing query time and resource consumption.

Why this answer

A summary index pre-computes exactly the needed daily counts, reducing search time and license usage. Data model acceleration still queries the full dataset and may be less efficient for custom aggregation. Using both adds complexity.

Report acceleration on the dashboard search still queries the full data.

Full explanation →

321

MCQeasy

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

A.Create a saved search that uses tokens to parameterize the query.

B.Use an eval statement to define a variable that holds the query.

C.Define a macro with arguments using backticks and $arg$ syntax.

D.Use a lookup definition with parameters to filter results.

AnswerC

Macros with arguments allow a reusable search fragment with parameter substitution.

Why this answer

The correct method is to define a macro with arguments using backticks and $arg$ syntax (Option C). Macros are designed for reusable search components that can accept parameters. Option A (saved search with tokens) is typically used in dashboards to pass values at runtime, not for creating reusable search fragments.

Option B (eval statement) defines a variable but does not create a reusable search component. Option D (lookup definition) is used for enriching events with external data, not for defining search logic.

Full explanation →

322

Matchingmedium

Match each Splunk index time field to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

The hostname or IP of the data source

The file, script, or input that generated the event

The type of data, determines parsing behavior

The name of the index where the event is stored

The timestamp of the event

Why these pairings

Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Full explanation →

323

MCQhard

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

A.Replace the search with | where closed_txn=0.

B.Increase maxpause to 30m.

C.Remove the final search command and instead filter on closed_txn=0.

D.Remove the keepevicted=true option.

AnswerC

With keepevicted=true, evicted (unclosed) transactions have closed_txn=0; filtering on that shows all failed login attempts.

Why this answer

The original search includes a final search command that filters for successful logins. To see all failed login attempts that did not lead to a success, you need to capture evicted transactions (those that closed without success). The most efficient way is to remove the final search command and filter on closed_txn=0.

Option A is incorrect because replacing the search with where closed_txn=0 without removing the final filter would still filter out evicted transactions. Option B is incorrect because increasing maxpause may still not capture all failures and could delay results. Option D is incorrect because removing keepevicted=true would discard the evicted transactions, which are exactly the failures you want to see.

Full explanation →

324

MCQhard

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

A.`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`

B.`| transaction session_id maxspan=30m | search status=failure`

C.`| transaction session_id maxspan=30m | where status=failure`

D.`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`

AnswerB

Yes, because after transaction, the resulting events have fields from all constituent events; if any constituent had status=failure, the transaction event will have that field. The search filters for transactions that contain at least one such event.

Why this answer

After transaction, you can use `where` with a subsearch or use `search` to filter based on fields within the transaction. Specifically, `search` can be used after transaction to filter events that contain a certain field-value pair.

Full explanation →

325

MCQmedium

A large e-commerce company uses Splunk to monitor their web application. They have a query that uses the transaction command to group related events into transactions based on session ID and a 30-minute max pause. The query runs slowly and often times out. The environment has 10 indexers with 4 CPU cores each. The search is run over the last 7 days. Which of the following is the best course of action to improve performance?

A.Use the eval command to create a transaction ID field and then use stats to group events.

B.Reduce the max pause to 15 minutes to limit the number of events in each transaction.

C.Replace the transaction command with a combination of stats and streamstats commands.

D.Increase the number of indexers to 20 to distribute the load.

AnswerC

Using stats and streamstats is more efficient than transaction and can achieve similar grouping results.

Why this answer

The `transaction` command is resource-intensive because it groups events by a field (session ID) and a max pause, requiring significant memory and processing to correlate events across the entire search time range. Replacing it with `stats` and `streamstats` is more efficient because `stats` can aggregate events by session ID without the overhead of transaction boundaries, and `streamstats` can compute running totals or windows within each session, leveraging distributed processing across indexers. This approach reduces memory pressure and avoids the timeout issue by using streaming operations that scale better with large datasets.

Exam trap

Splunk often tests the misconception that reducing the max pause or adding hardware (more indexers) is the best fix, when the real issue is replacing the inefficient `transaction` command with more scalable streaming commands like `stats` and `streamstats`.

How to eliminate wrong answers

Option A is wrong because using `eval` to create a transaction ID field and then `stats` to group events does not inherently improve performance; it still requires a similar grouping operation and does not address the core inefficiency of the `transaction` command's memory overhead. Option B is wrong because reducing the max pause to 15 minutes may limit transaction size but does not fundamentally reduce the computational cost of the `transaction` command, which still must evaluate event boundaries and maintain state for each session across the entire search window. Option D is wrong because increasing the number of indexers to 20 distributes the search load but does not optimize the query itself; the `transaction` command's performance bottleneck is often in the search head's memory and processing, not just indexing capacity, and adding indexers may not resolve timeouts if the command is inherently inefficient.

Full explanation →

326

Multi-Selecthard

Which TWO features are available for customizing dashboards in Splunk's Simple XML?

Select 2 answers

A.Using HTML in a panel to embed custom JavaScript.

B.Using CSS to change the color of all panels.

C.Automatically refreshing panels using token 'refresh'.

D.Adding drilldown actions to tables and charts.

E.Creating multiple dashboard versions for different user roles.

AnswersC, D

The 'refresh' token triggers auto-refresh.

Why this answer

Options C and D are correct. C: The 'refresh' token in Simple XML allows automatic panel refreshing without user interaction. D: Drilldown actions can be added to tables and charts to enable interactivity, such as linking to other dashboards or searches.

A is incorrect because HTML panels in Simple XML cannot embed custom JavaScript; they only support basic HTML. B is incorrect because CSS customization in Simple XML is limited to the dashboard level, not individual panels, and color changes require CSS files or inline styles. E is incorrect because Splunk does not support multiple dashboard versions per user role; role-based access is managed via permissions, not separate dashboard versions.

Full explanation →

327

Multi-Selecthard

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Select 2 answers

A.Use the 'fields' command to limit fields before transaction.

B.Use the 'keepevicted' option to free memory.

C.Use the 'stats' command with values() and range() instead of transaction if possible.

D.Use the 'local' parameter to process on a single indexer.

E.Increase the maxspan value to reduce the number of transactions.

AnswersA, C

Correct: reduces memory per event.

Why this answer

Options A and C are correct. Using the 'fields' command before 'transaction' limits the data to only relevant fields, reducing memory and processing overhead. Option C is correct because the 'stats' command with functions like values() and range() can often replace 'transaction' for event correlation, avoiding the resource-intensive transaction command.

Option B is incorrect because 'keepevicted' is used to retain evicted transactions but does not free memory or optimize performance. Option D is incorrect because using the 'local' parameter restricts processing to a single indexer, which can actually harm performance by eliminating parallelism. Option E is incorrect because increasing 'maxspan' expands the time window, potentially increasing the number of events per transaction and worsening performance.

Full explanation →

328

MCQeasy

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

A.`nunique($field$)` defined as `stats dc($field$) as distinct_count`

B.`nunique($1$)` defined as `stats dc($1$) as distinct_count`

C.`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

D.`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

AnswerB

Correct: Uses positional argument and no leading pipe.

Why this answer

The correct macro definition is option B because it uses a positional argument ($1$) and does not include a leading pipe. In Splunk, macros are invoked as part of a pipe chain, so the definition should not start with a pipe. Positional arguments are standard and do not require predefined argument names, whereas named arguments must be defined in the macro properties.

Option A fails because it uses a named argument ($field$) without defining it, making it invalid. Options C and D incorrectly include a leading pipe at the start of the definition, which would cause a syntax error when the macro is expanded within a pipe.

Full explanation →

329

MCQhard

Refer to the exhibit. What does the final result represent?

A.Users who log on more than twice on average.

B.Hours where the total logon count is more than double the average.

C.Hours where any user's logon count is more than double the average for that hour.

D.Users who have a logon count greater than twice their personal average.

AnswerC

Correct: per hour, per user comparison to hour average

Why this answer

The `eventstats` command calculates a per-hour average logon count across all users. The `where` clause then filters for events where a specific user's logon count for that hour is more than double that hourly average. This directly matches option C: hours where any user's logon count exceeds twice the average for that hour.

Exam trap

The trap here is that candidates confuse `eventstats ... by hour` (which computes a global average per hour) with a per-user average, leading them to incorrectly select option D or A.

How to eliminate wrong answers

Option A is wrong because the query does not compute a per-user average across all hours; it compares each user's hourly count to the hourly average, not a user's average. Option B is wrong because the comparison is against the average logon count for that specific hour, not the total logon count for the hour; the `where` clause checks `logon_count > 2 * avg_logons`, which is a per-user value, not a total. Option D is wrong because the average used is the hourly average across all users, not the user's own personal average; `eventstats` with `by hour` computes a global average per hour, not per user.

Full explanation →

330

MCQhard

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

A.The lookup file is not in CSV format.

B.The 'like' function requires a wildcard pattern with '%' but the field value may have leading/trailing spaces or the pattern is case-sensitive.

C.The stats command only counts events where role=admin, but the role field is already filtered.

D.The search command runs before the eval command.

AnswerB

like() is case-sensitive; also if user has spaces, pattern may not match.

Why this answer

The 'like' function in Splunk uses SQL-style pattern matching where '%' matches any sequence of characters. If the lookup file contains 'admin1' and 'admin2', but the search uses 'like(role, "admin%")', leading/trailing spaces in the field values or case sensitivity (e.g., 'Admin1' vs 'admin1') would cause the pattern to fail, returning zero results. Option B correctly identifies this as the most likely reason because Splunk's 'like' is case-sensitive by default and does not trim spaces.

Exam trap

Splunk often tests the misconception that 'like' is case-insensitive or automatically handles spaces, leading candidates to overlook the need for explicit trimming or case normalization.

How to eliminate wrong answers

Option A is wrong because Splunk lookups can be in CSV format or other formats like KV store; a non-CSV format would cause a different error (e.g., 'Error opening lookup file'), not silently return zero results. Option C is wrong because the stats command counts events based on the filtered results; if the role field is already filtered to only admin values, stats would still count those events, not return zero. Option D is wrong because the search command runs before the eval command in the pipeline order, but that does not cause zero results; the eval command would still process the filtered events correctly.

Full explanation →

331

MCQhard

A transaction that groups events by field 'session_id' sometimes produces transactions that contain events from multiple distinct sessions due to session_id reuse over time. What is the best way to ensure transactions are correctly separated?

A.Use 'transaction session_id maxevents=1' to stop after one event.

B.Use 'transaction session_id mvlist=_raw' to include raw data.

C.Use 'transaction session_id maxspan=30m' to limit the time window.

D.Use 'transaction session_id startswith="new_session" endswith="end_session"'.

AnswerC

Correct: Time window separates reused IDs.

Why this answer

Adding a maxspan limits the time window, preventing events from reused session IDs that are widely separated in time from merging into the same transaction. Options A, B, and D do not address the reuse issue effectively: A limits events per transaction but doesn't separate sessions, B includes raw data but doesn't separate, D uses start/end markers which may not be present for all sessions.

Full explanation →

332

MCQhard

A team wants to create a custom visualization that requires JavaScript and CSS modifications. Which Splunk feature should be used?

A.Splunk Web Framework

B.Simple XML dashboard

C.Dashboard studio

D.Custom visualization framework

AnswerD

This framework supports custom JS/CSS visualizations.

Why this answer

The Custom Visualization Framework (option D) is the correct choice because it is the only Splunk feature that allows developers to create entirely new visualizations using JavaScript and CSS. This framework provides the necessary APIs and hooks to register custom visualization types that can then be used in dashboards, whereas the other options either restrict customization or do not support custom JavaScript/CSS modifications.

Exam trap

The trap here is that candidates often confuse the Custom Visualization Framework with Dashboard Studio or Simple XML, assuming that those tools support arbitrary JavaScript/CSS customization, when in fact they only allow configuration of existing components.

How to eliminate wrong answers

Option A is wrong because the Splunk Web Framework is a broader platform for building custom web applications and does not specifically provide a structured way to create custom visualizations with JavaScript and CSS for use within Splunk dashboards. Option B is wrong because Simple XML dashboards are declarative and do not support embedding custom JavaScript or CSS directly; they rely on predefined visualization types. Option C is wrong because Dashboard Studio is a modern, drag-and-drop interface that uses predefined visualization components and does not allow custom JavaScript/CSS modifications for creating new visualizations.

Full explanation →

333

MCQhard

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

A.It limits the total number of transactions in the search results.

B.It limits the number of transactions that can be open simultaneously in memory.

C.It limits the number of events per transaction.

D.It limits the time span of open transactions.

AnswerB

Correct. `maxopentxn` limits the number of transactions that can be open simultaneously in memory. When the limit is reached, the oldest idle transaction is closed to free memory.

Why this answer

The `maxopentxn` parameter in the `transaction` command limits the number of transactions that can be open at the same time in memory. Once this limit is reached, the transaction with the longest idle time is closed forcefully. This prevents excessive memory usage when many transactions are in progress.

It does not directly limit the total number of transactions in the final results, nor does it limit events per transaction or time span of open transactions.

Exam trap

A common trap is confusing `maxopentxn` with `maxtxn`, which limits the total number of transactions in the output. `maxopentxn` is a memory management setting, not a result limiter.

Full explanation →

334

MCQhard

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

A.The max_matches setting should be 0

B.The filename should include the full path

C.The stanza name should be 'geo_ip' without brackets

D.The match_type should be 'match_type = cidr' without brackets

AnswerD

It should be a setting, not a stanza header.

Why this answer

In Splunk's transforms.conf, the 'match_type' is a setting within a stanza, not a stanza name itself. The bracket syntax [match_type = cidr] incorrectly defines a new stanza. The correct syntax is to place 'match_type = cidr' as a line under the [geo_ip] stanza.

Full explanation →

335

MCQhard

An administrator runs a transaction command that groups events by a customer ID but notices that some transactions are missing expected events. The log shows that the events are present and within the maxpause. What could be the reason?

A.Events are from different hosts or sources.

B.The startswith and endswith are conflicting.

C.The fields option is missing.

D.The maxpause value is too short.

AnswerA

By default, transaction groups by host, source, and sourcetype; events from different hosts are not grouped.

Why this answer

The transaction command, by default, groups events not only by the specified 'by' fields but also by host, source, and sourcetype. If events for the same customer ID originate from different hosts or sources, they are treated as separate transactions. This explains why some transactions are missing expected events despite the events being present and within the maxpause.

Option A correctly identifies this common pitfall. Option B is incorrect because startswith and endswith define transaction boundaries and do not conflict here. Option C is incorrect because the 'fields' option is not required; without it, the default grouping includes host and source, which causes the issue.

Option D is incorrect because the maxpause is explicitly stated to be adequate.

Full explanation →

336

Drag & Dropmedium

Order the steps to create a data model in Splunk in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Data models are created by defining hierarchical objects with constraints and fields.

Full explanation →

337

MCQhard

A search `index=main | eval weekday=strftime(_time,"%A") | stats count by weekday | sort - count` shows that Monday has the highest count. However, the user suspects that Monday data is double-counted due to timezone offset. What should be done to investigate?

A.Use `date_wday` field which is based on the local time by default if configured.

B.Use `strftime(_time,"%w")` instead of %A to avoid string comparison issues.

C.Apply `| convert timeformat="%A" tz=US/Mountain _time as weekday` to adjust timezone.

D.Use `eval weekday=strftime(_time + timezone_offset, "%A")` with a fixed offset.

AnswerA

Correct. The `date_wday` field is automatically generated based on the local timezone setting, so it accurately reflects the day of the week in the user's timezone without additional calculations.

Why this answer

The `date_wday` field is automatically computed based on the local timezone defined in the Splunk configuration, so it reflects the correct day of the week in the user's timezone, avoiding issues with UTC-based `_time`. Option B is wrong because `strftime(_time,"%w")` returns the day of the week as a number (0=Sunday, 6=Saturday), which still depends on UTC `_time` and does not solve the timezone issue. Option C is not the most straightforward approach because manually specifying a timezone with `convert` requires knowing the correct timezone for each event, which is not practical.

Option D is wrong because adding a fixed offset does not account for daylight saving time or varying timezones across events.

Full explanation →

338

MCQmedium

You are a Splunk power user working for a healthcare organization. You have created a visualization that shows patient wait times by department over the last 30 days. The chart uses a timechart command with a 'stacked' option. Recently, the chart started showing negative values for some departments, which is impossible because wait times cannot be negative. You have verified that the raw data is correct and contains only positive wait times. The search is: index=healthcare sourcetype=patient_wait | timechart span=1d avg(wait_time) by department. The chart is displayed as a stacked area chart. The negative values appear only for a few departments sporadically. You suspect the issue is related to how null values are handled. What could be causing the negative values?

A.The timechart command is using 'limit=0' which causes overcounting of series.

B.There is a counting error in the search due to overlapping time ranges from data indexing delays.

C.The use of 'other' category in stacked charts can cause negative values when there are many series.

D.The 'stacked' option is misinterpreting null values as negative.

AnswerD

Stacked charts can interpret nulls as negative for series with gaps.

Why this answer

In stacked area charts, when there are null values (missing data points), the stacking algorithm can misinterpret them as negative values, causing the chart to show negative areas. This is a known behavior in Splunk's stacked area visualization. Option A is wrong because 'limit=0' in timechart controls the maximum number of series displayed, not the handling of null values.

Option B is wrong because overlapping time ranges from indexing delays would cause duplication, not negative values. Option C is wrong because the 'other' category aggregates low-value series and does not cause negative values; it is unrelated to null value misinterpretation.

Full explanation →

339

MCQeasy

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

A.index=main | transaction user_id maxpause=15m | stats avg(duration)

B.index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

C.index=main | transaction user_id maxpause=15 | stats avg(_time)

D.index=main | transaction user_id maxspan=15m | stats avg(duration)

AnswerA

Correct: transaction adds duration, stats averages it.

Why this answer

The transaction command with maxpause=15m groups events by user_id and adds a duration field. The stats command then calculates the average duration.

Full explanation →

340

MCQeasy

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

A.... | transaction user maxspan=600 maxevents=100

B.... | transaction user maxpause=120

C.... | transaction user maxspan=600 startswith="login" endswith="logout"

D.... | transaction user maxspan=600

AnswerD

Correct: maxspan sets a 10-minute window.

Why this answer

'maxspan=600' limits the transaction time window to 600 seconds (10 minutes), which meets the requirement of grouping events within 10 minutes for each user. There's no need for startswith/endswith as all authentication events should be included. Option A is incorrect because 'maxevents=100' may truncate transactions with more than 100 events.

Option B is incorrect because 'maxpause=120' only sets a pause threshold but does not enforce a total time limit; transactions could exceed 10 minutes if events continue with short pauses. Option C is incorrect because using startswith and endswith restricts the transaction to only those that begin with 'login' and end with 'logout', potentially excluding other authentication events like failures.

Full explanation →

341

Multi-Selecteasy

Which THREE of the following are valid Splunk search commands?

Select 3 answers

A.regex

B.dedup

C.sort

D.filter

E.parse

AnswersA, B, C

`regex` is a valid command to filter events using a regular expression.

Why this answer

The `regex` command is a valid Splunk search command that filters search results by applying a Perl-compatible regular expression (PCRE) to raw events or specific fields. It is commonly used to extract or match patterns within event data, such as IP addresses or error codes, and is distinct from the `rex` command which extracts fields.

Exam trap

Splunk often tests the distinction between real Splunk commands and plausible-sounding but non-existent commands like `filter` or `parse`, which candidates might confuse with similar functions in other tools or programming languages.

Full explanation →

342

MCQeasy

A security analyst needs to find all events where the field 'status' is either 'error' or 'critical', and then count the number of events per source IP. Which search is correct?

A.index=security (status=error OR status=critical) | stats count by src_ip

B.index=security status=error AND status=critical | stats count by src_ip

C.index=security | where status=error OR status=critical | stats count by src_ip [CORRECT]

D.index=security status=error OR status=critical | stats count by src_ip

AnswerA, C

Correct syntax: parentheses group OR conditions, then stats count.

Why this answer

Both A and C return events where status is error or critical. A does this at search time and is the most efficient. C uses the where command, which is valid but less efficient.

B is incorrect because AND requires both statuses. D lacks parentheses and is evaluated incorrectly.

Exam trap

Splunk often tests parentheses and search-time filtering vs where. Both A and C produce correct results, but A is best practice. Do not mistake efficiency differences for correctness.

How to eliminate wrong answers

Option B is wrong because it uses 'AND' between the two status conditions, which would require an event to have both 'error' AND 'critical' simultaneously in the same field, which is impossible and returns zero results. Option C is wrong because it uses the 'where' command after the initial index filter, which is less efficient and not necessary; the 'where' command is typically used for more complex expressions, but here the OR condition can be handled directly in the search string. Option D is wrong because it lacks parentheses around the OR condition, which can lead to incorrect evaluation order; without parentheses, the search might be interpreted as 'index=security status=error' OR 'status=critical', potentially returning events from other indexes if 'status=critical' matches elsewhere.

Full explanation →

343

MCQeasy

Which SPL command can be used to create a new field based on a conditional evaluation, such as setting a status field to 'critical' if a numeric threshold is exceeded?

A.| makemv

B.| rex field=_raw

C.| eval status=if(value>100,"critical","normal")

D.| convert status=if(value>100,"critical","normal")

AnswerC

Eval with if performs conditional assignment

Why this answer

The `eval` command in SPL is used to create new fields or modify existing ones by evaluating expressions. The `if()` function within `eval` allows conditional logic, making `| eval status=if(value>100,"critical","normal")` the correct syntax to create a new field 'status' that is set to 'critical' when the numeric field 'value' exceeds 100, and 'normal' otherwise.

Exam trap

Splunk often tests the distinction between `eval` (for field creation and computation) and `convert` (for data type conversion), leading candidates to mistakenly choose `convert` for conditional logic due to its similar syntax.

How to eliminate wrong answers

Option A is wrong because `makemv` is used to split a single multivalue field into separate values, not to create a field based on conditional evaluation. Option B is wrong because `rex field=_raw` is used for extracting fields using regular expressions from the `_raw` event data, not for conditional field creation. Option D is wrong because `convert` is used for type conversion (e.g., converting strings to numbers or timestamps), not for conditional logic; the syntax `convert status=if(...)` is invalid and would produce an error.

Full explanation →

344

MCQmedium

A systems engineer creates a summary index using a saved search that runs every 30 minutes. The summary index aggregates data from multiple sourcetypes. After a week, the engineer notices that the summary index contains duplicate events for certain time ranges. What is the most likely cause?

A.The macro used in the saved search includes a time zone conversion that shifts events.

B.The saved search schedule is set to run at the wrong time.

C.The summary index acceleration is enabled, causing automatic re-summarization.

D.The summary index time range extends beyond the schedule interval, causing overlapping windows.

AnswerD

For example, if the search runs every 30 minutes but covers a 1-hour window, each event is summarized twice.

Why this answer

If the summary index time range extends beyond the schedule interval, overlapping windows cause duplicate events. Option A: time zone conversion would not create duplicates. Option B: schedule timing might cause missed data, not duplicates.

Option C: summary index acceleration does not cause duplicates.

Full explanation →

345

Matchingmedium

Match each Splunk role to its typical permission level.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Full access to system configuration and all data

Can create and share knowledge objects, run searches

Can run searches and create personal knowledge objects

Allows deletion of search results and events

Allows access to Splunk REST endpoints

Why these pairings

Splunk roles determine user permissions: admin grants full access, power allows most features except administrative functions, and user restricts to own data and basic searches.

Full explanation →

346

MCQeasy

What is the MOST likely reason the search returns no results?

A.The user does not have permission to read the lookup.

B.The lookup definition is not configured.

C.The CSV file has no header row.

D.The `inputlookup` command expects the definition name, not the filename.

AnswerD

Use `| inputlookup usertable`.

Why this answer

The `inputlookup` command in Splunk expects the lookup definition name as its argument, not the filename of the CSV file. If a user specifies the filename (e.g., `| inputlookup myfile.csv`) instead of the lookup definition name (e.g., `| inputlookup my_lookup`), Splunk will not find the lookup and returns no results. This is a common mistake because the command syntax requires the logical name defined in the lookup table configuration, not the physical file path.

Exam trap

Splunk often tests the distinction between the `inputlookup` command (which requires the definition name) and the `lookup` command (which can accept either a definition name or a filename in certain contexts), leading candidates to incorrectly assume both commands accept filenames.

How to eliminate wrong answers

Option A is wrong because if the user lacked read permission, Splunk would typically return an error message about permissions, not silently return no results. Option B is wrong because if the lookup definition were not configured, the `inputlookup` command would fail with an error indicating the definition does not exist, rather than returning zero results. Option C is wrong because a missing header row in the CSV file would cause the lookup to load data with default field names (e.g., field1, field2) or produce a warning, but it would still return rows of data, not zero results.

Full explanation →

347

Multi-Selecteasy

Which three statements about the transaction command are correct? (Choose three.)

Select 3 answers

A.The transaction command automatically adds an 'eventcount' field.

B.The transaction command requires a startswith or endswith parameter.

C.The transaction command can only correlate events within the same sourcetype.

D.The transaction command automatically adds a 'duration' field.

E.The transaction command can be used with events from different indexes.

AnswersA, D, E

Correct. The transaction command adds an ‘eventcount’ field that counts the number of events in each transaction.

Why this answer

Options A, D, and E are correct. The transaction command automatically adds the 'eventcount' and 'duration' fields to each result. It can also correlate events from different indexes, as it uses fields like ‘_time’ and a group-by field; there is no restriction that all events must come from the same index.

Option B is false because startswith/endswith are optional; transaction can also use a field-based group (e.g., by session_id). Option C is false because transaction can correlate events from different sourcetypes.

Full explanation →

348

Drag & Dropmedium

Arrange the steps to create a new index in Splunk in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Full explanation →

349

MCQeasy

A search produces a table with many rows. Which visualization type is best suited to show the distribution of a single field's values?

A.Area chart

B.Pie chart

C.Scatter chart

D.Line chart

AnswerB

Pie charts show parts of a whole, ideal for distribution of a single field.

Why this answer

A pie chart effectively shows the proportional distribution of a single field's values across categories. Area charts, scatter charts, and line charts are better suited for showing trends over time or relationships between variables, not distribution of a single field.

Full explanation →

350

MCQhard

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

A.Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions

B.Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results

C.Keep the current search but increase maxspan to 30m

D.Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`

AnswerA

This captures any order within 5 minutes, then filter for both actions.

Why this answer

The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Full explanation →

351

Multi-Selecthard

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Select 2 answers

A.It improves the ability to correlate events from different technologies.

B.It enables searching across different data sources with common field names.

C.It improves search performance by pre-aggregating data.

D.It provides built-in security monitoring use cases.

E.It eliminates the need for custom field extractions.

AnswersA, B

By standardizing field names, CIM makes it easier to correlate events across different data sources.

Why this answer

The Common Information Model (CIM) provides a standardized set of field names and event tags across different data sources, enabling correlation of events from disparate technologies (e.g., firewalls, IDS, endpoints) using common fields like 'dest_ip', 'src_ip', 'user', and 'action'. This normalization allows Splunk to join or relate events that share the same CIM-compliant fields, making it possible to build coherent security or operational stories across heterogeneous data.

Exam trap

The trap here is that candidates confuse the CIM's normalization role with performance optimization or built-in security content, leading them to select options about pre-aggregation or pre-built use cases, which are actually features of other Splunk components like data model acceleration or Splunk Security Essentials.

Full explanation →

352

MCQeasy

A company's security team uses Splunk to monitor firewall logs. They have a lookup file named 'threat_intel.csv' containing 10,000 IP addresses classified by threat level. The lookup is used in a dashboard that shows the number of blocked connections from high-threat IPs over the past 24 hours. Recently, the dashboard has become slow, taking over 30 seconds to load. The lookup file is updated every 15 minutes via a script that replaces the entire file. The search currently uses: `index=firewall | lookup threat_intel.csv src_ip OUTPUT threat_level | where threat_level="high" | stats count`. Which of the following is the MOST efficient way to improve dashboard performance?

A.Restrict the search to a smaller time range, such as the last hour.

B.Use the lookup with local=t to force it to run on the search head only.

C.Convert the lookup to a KV store collection with an index on src_ip.

D.Increase the lookup cache size in limits.conf.

AnswerC

KV store handles concurrent reads and writes efficiently, ideal for frequently updated lookups.

Why this answer

Converting the lookup to a KV Store collection with an index on `src_ip` allows Splunk to perform efficient key-value lookups without loading the entire 10,000-row CSV into memory on every search. The KV Store uses an indexed data structure, which dramatically reduces lookup time compared to a file-based lookup that must be fully scanned each time, especially when the file is replaced every 15 minutes and the search runs over a 24-hour window.

Exam trap

The trap here is that candidates often assume reducing the time range or caching will fix performance, but the real bottleneck is the file-based lookup's linear scan of 10,000 rows, which is only resolved by switching to an indexed KV Store collection.

How to eliminate wrong answers

Option A is wrong because reducing the time range to the last hour does not address the root cause of slow lookups; the performance bottleneck is the file-based lookup scanning 10,000 IPs, not the volume of events. Option B is wrong because using `local=t` forces the lookup to execute only on the search head, which does not improve performance—it may even worsen it by bypassing distributed lookup execution across indexers. Option D is wrong because increasing the lookup cache size in `limits.conf` only caches previously looked-up values within a single search; it does not help when the lookup file is replaced every 15 minutes, as the cache is invalidated on each file change, and the initial load still requires scanning the entire CSV.

Full explanation →

353

MCQmedium

The search returns a timechart with multiple series but the series colors are all the same. What is the most likely reason?

A.The 'timechart' command cannot handle multiple series from a lookup

B.The number of distinct description values exceeds the default color palette

C.The lookup should be performed before the eval

D.The 'eval' command is misspelled (status=code instead of status_code?)

E.The lookup is not working correctly

AnswerB

When there are more than 10 series, colors repeat, making them indistinguishable.

Why this answer

If the number of distinct description values exceeds the default color palette (typically 10), colors will repeat. This is a common issue with many series.

Full explanation →

354

MCQeasy

A Splunk administrator wants to create a static lookup table from a search result. Which approach is recommended?

A.Use the `outputlookup` command to save the search result as a CSV file.

B.Use `inputlookup` to write to a CSV file.

C.Use the `lookup` command to create the file.

D.Manually copy the results into a spreadsheet and upload as CSV.

AnswerA

outputlookup writes the result set to a lookup file in the specified directory.

Why this answer

The outputlookup command is designed to save search results directly to a CSV file in the lookups directory. Option B is manual and error-prone. Option C, inputlookup, reads a lookup file.

Option D, lookup, applies a lookup but does not create a file.

Full explanation →

355

MCQmedium

Which command returns the list of all sourcetypes in a specific index?

A.| sourcetype count index=main

B.| eventtype count index=main

C.| metasearch index=main sourcetype=*

D.| metadata type=sourcetypes index=main

AnswerD

`metadata` with `type=sourcetypes` lists all sourcetypes in the index.

Why this answer

The `| metadata` command with `type=sourcetypes` retrieves a list of all sourcetypes present in a specified index, along with their earliest and latest timestamps. This command queries the index metadata directly, making it the appropriate tool for listing sourcetypes within a given index.

Exam trap

Splunk often tests the distinction between commands that return metadata summaries (`| metadata`) versus commands that return raw events or statistical aggregations, leading candidates to choose `| metasearch` or malformed `| sourcetype count` commands instead of the correct metadata approach.

How to eliminate wrong answers

Option A is wrong because `| sourcetype count` is not a valid SPL command; it appears to be a malformed attempt to use `| stats count by sourcetype`, which would count events per sourcetype but not list all sourcetypes in an index. Option B is wrong because `| eventtype count` is also not a valid command; eventtypes are saved searches or tags, not a direct way to list sourcetypes, and the syntax is incorrect. Option C is wrong because `| metasearch index=main sourcetype=*` is a valid search that returns events matching the pattern, but it does not return a list of distinct sourcetypes; it returns raw events, which is inefficient and not the intended output.

Full explanation →

356

MCQhard

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

A.The transaction closed because there were only 4 events.

B.The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.

C.The transaction closed because the maxopentxn limit was reached.

D.The maxspan of 10 minutes was reached.

AnswerB

Correct: maxpause timeout caused closure.

Why this answer

Since maxpause=5m is specified, the transaction closed 5 minutes after the last event (10:03:00) at approximately 10:08:00, but because maxspan is 10m, the 2-minute duration is well under that. The close was due to the inactivity timeout.

Full explanation →

357

MCQeasy

An analyst wants to remove events that contain the string 'debug' from a log. Which command should be used?

A.| where NOT match(_raw,"debug")

B.| search debug | reverse

C.| search "debug" NOT

D.| search NOT debug

AnswerD

Correct. The `| search NOT debug` command excludes all events containing the string 'debug' from the results. It is the standard and simplest way to remove a specific string from search results in Splunk.

Why this answer

The `| search NOT debug` command filters out all events containing the string 'debug' from the result set. In Splunk, the `NOT` operator before a search term excludes events that match that term, effectively removing them from the output. This is the standard way to exclude a specific string from search results.

Exam trap

The trap here is that candidates often confuse the placement of `NOT` in Splunk syntax, thinking it can be placed after the term like in natural language, or they mistakenly use `where` with regex functions when a simple `NOT` suffices.

How to eliminate wrong answers

Option A is wrong because `| where NOT match(_raw,"debug")` uses the `match` function which expects a regex pattern, not a literal string; it would treat 'debug' as a regex, potentially causing unexpected behavior or errors if the string contains regex metacharacters. Option B is wrong because `| search debug | reverse` first includes only events with 'debug', then reverses the order, which does not remove 'debug' events but instead keeps them and changes their display order. Option C is wrong because `| search "debug" NOT` has incorrect syntax; the `NOT` operator must be placed before the term it negates, not after, and this would likely result in a syntax error or unintended results.

Full explanation →

358

MCQeasy

A security analyst notices that a timechart command is returning too many data points on the x-axis, making the chart unreadable. Which command modification should be used to reduce the number of data points?

A.| timechart partial=f count by host

B.| timechart useother=f count by host

C.| timechart span=1h count by host

D.| timechart limit=5 count by host

AnswerC

Span reduces data point granularity

Why this answer

The `timechart` command automatically bins events into time buckets based on the time range. By default, Splunk chooses a span that can result in many data points. Adding `span=1h` explicitly sets the bucket size to one hour, reducing the number of data points on the x-axis and making the chart readable.

Exam trap

The trap here is that candidates confuse options that control the number of series (like `limit` or `useother`) with options that control the number of time buckets (like `span`), leading them to pick a wrong answer that does not affect the x-axis density.

How to eliminate wrong answers

Option A is wrong because `partial=f` controls whether partial time buckets at the edges of the time range are displayed, not the number of data points. Option B is wrong because `useother=f` prevents grouping of low-count values into an 'Other' category, which affects the y-axis series, not the x-axis data points. Option D is wrong because `limit=5` restricts the number of series (e.g., top 5 hosts) shown, not the number of time buckets on the x-axis.

Full explanation →

359

MCQhard

A security operations center (SOC) uses Splunk to correlate alerts from multiple sources. They have a rule that triggers a transaction when an IDS alert is followed within 5 minutes by a firewall deny event from the same source IP. The search is: `index=security sourcetype=ids OR sourcetype=firewall | transaction src_ip startswith="ids" endswith="firewall" maxspan=5m`. This works well when the deny event occurs after the alert. However, analysts are missing correlations where the firewall deny event occurs slightly before the IDS alert (up to 1 minute before). To capture these out-of-order events without significantly increasing resource usage, what should the analyst do?

A.Use `reverse` before transaction to process events in reverse time order.

B.Increase maxspan to 6 minutes and add `maxevents=2`.

C.Use `sort` with time dimension and then use `eventstats` to mark pairs.

D.Use `transaction src_ip maxspan=6m` without startswith/endswith and then filter for events with both sourcetypes.

AnswerD

Using `transaction src_ip maxspan=6m` without `startswith` and `endswith` groups all events from the same source IP within 6 minutes, regardless of order. This includes the IDS alert and firewall deny pair, which can then be isolated by filtering for both sourcetypes.

Why this answer

Using `transaction src_ip maxspan=6m` without `startswith` and `endswith` groups all events from the same source IP within 6 minutes. This captures the pair regardless of order (IDS alert before firewall or firewall before IDS). A subsequent filter for events with both sourcetypes isolates the desired pair.

This approach does not significantly increase resource usage because the `maxspan` limits the time window. Option B fails because `transaction` still requires the `startswith` event to occur before the `endswith` event; if the firewall deny comes first, the IDS alert is not the start, so no transaction is created. Option A (`reverse`) has no effect as `transaction` internally sorts events by time.

Option C (`sort` and `eventstats`) does not group events into transactions, making it unsuitable for correlation.

Exam trap

The trap is that increasing `maxspan` does not fix out-of-order events when using `startswith` and `endswith`; those conditions enforce chronological order.

Full explanation →

360

MCQmedium

The exhibit shows a search that categorizes HTTP status codes and counts them. If the search returns only three categories, what is the most likely reason?

A.The stats command is filtering out events with null category.

B.The case function has a syntax error that truncates results.

C.The case statement does not cover status codes above 599.

D.Some categories have zero events and are not displayed by default.

AnswerD

stats count by category only shows categories with non-zero counts unless usenull is specified.

Why this answer

The `stats` command in Splunk, by default, only returns results for categories that have at least one event. If a category (e.g., a specific HTTP status code range) has zero matching events, it will not appear in the output. This is a common behavior in aggregation commands, where null or zero-count results are suppressed unless explicitly requested with the `usenull=f` or `fillnull` options.

Exam trap

Splunk often tests the default behavior of `stats` to omit zero-count groups, leading candidates to incorrectly assume that the `case` function is incomplete or that events are being filtered out, rather than recognizing that empty categories are simply not displayed.

How to eliminate wrong answers

Option A is wrong because the `stats` command does not filter out events with null category; it simply does not display categories with zero counts. The `case` function returns a null value for unmatched conditions, but `stats` counts those events under a null category only if `useother=t` or `usenull=t` is specified. Option B is wrong because a syntax error in the `case` function would cause the search to fail entirely or return an error, not truncate results to exactly three categories.

Option C is wrong because HTTP status codes above 599 are not valid per RFC 7231, and the `case` statement is not required to cover them; the question states the search returns only three categories, implying the `case` statement covers all valid codes, but zero events exist for some ranges.

Full explanation →

361

MCQhard

A security analyst wants to create a comparison report showing the count of login failures by user for today versus yesterday. They run: `index=security action=failure | timechart count by user`. This produces a chart of counts over time, but they want separate columns for today and yesterday. How can they achieve this comparison efficiently?

A.Use `| append [search index=security action=failure earliest=-2d@d latest=-1d@d | eval period="yesterday"] | timechart count by user by period`.

B.Use `| eval day=if(_time>=relative_time(now(),"@d"),"today","yesterday") | timechart count by user by day`.

C.Use `| stats count by user _time | xyseries _time user count`.

D.Use `| timechart count by user useother=t` with the time range set to 'Yesterday' and 'Today' in the time picker.

AnswerB

Correctly categorizes events by day and creates separate columns.

Why this answer

The correct approach is to use eval to create a day label (today vs yesterday) based on _time, then use timechart with the user and day fields to produce separate columns for each period. Option B does exactly that. Option A is incorrect because it uses append to combine two searches, but timechart with by period would not produce the desired side-by-side columns and is inefficient.

Option C uses stats and xyseries, which can create a table but is less efficient and does not automatically limit to today and yesterday. Option D is incorrect because timechart with useother=t only groups low-count results into 'OTHER' and does not create separate columns for today and yesterday.

Full explanation →

362

MCQeasy

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

A.Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.

B.Change to `transaction user maxspan=8h` and remove startswith/endswith.

C.Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.

D.Use `transaction user maxspan=8h maxevents=100` and filter manually.

AnswerC

Correct: keepevicted=true outputs incomplete transactions, including those missing logout.

Why this answer

Adding keepevicted=true to the transaction command causes Splunk to output incomplete transactions (those missing the logout event) as evicted transactions. This allows the analyst to see all sessions, including those where the logout was not recorded, preventing missing data. Option A uses stats with time buckets, which does not properly group events into sessions.

Option B removes startswith and endswith, so it would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately. Option D uses maxevents=100, which may still drop sessions if they have many events, and manual filtering is inefficient.

Full explanation →

363

MCQmedium

A search includes a lookup that is used for every event. The lookup file has 500,000 rows. The search is running slowly. Which change could improve performance?

A.Use the stats command instead of lookup

B.Convert the lookup to a KV Store lookup

C.Use the inputlookp command with append=t

D.Increase the max_match in the lookup definition

E.Use the lookup command with output fields limited to needed fields

AnswerE

Specifying only required fields reduces data processing overhead.

Why this answer

Limiting output fields reduces data transfer and can improve lookup performance. KV Store may help but requires extra setup.

Full explanation →

364

MCQmedium

When using the stats command with multiple BY fields, the results show many rows with null values. What is the most likely cause and how can it be reduced?

A.Use | where command to filter out null values

B.Use | stats ... by ... usenull=f

C.Use | eval to replace nulls before stats

D.Use | fillnull value=0 outputfield=count after stats

AnswerB

Prevents null groups from appearing

Why this answer

The `stats` command includes null values in BY fields by default, which can produce many rows with nulls. Using `usenull=f` explicitly tells `stats` to ignore null values in the BY clause, reducing those rows. This parameter is specific to the `stats` command and directly addresses the root cause.

Exam trap

The trap here is that candidates often confuse `usenull=f` with post-processing filters like `where` or `fillnull`, not realizing that the null rows are generated during the `stats` aggregation itself and must be prevented at that stage.

How to eliminate wrong answers

Option A is wrong because the `where` command filters results after `stats` has already processed nulls, which does not reduce the number of rows generated by `stats`; it only hides them from the output. Option C is wrong because using `eval` to replace nulls before `stats` changes the data (e.g., replacing null with a placeholder like 'N/A'), which can alter statistical results and is not the intended way to handle nulls in BY fields. Option D is wrong because `fillnull` is used after `stats` to replace null values in output fields, not to prevent null rows from being created by the BY clause.

Full explanation →

365

MCQeasy

A Splunk user wants to group web server logs into transactions representing a single user visit, where a visit starts with a 'GET' request and ends with a 'POST' request. Which transaction command syntax correctly implements this logic?

A.transaction startswith="GET" endswith="POST" maxevents=2

B.transaction startswith="POST" endswith="GET"

C.transaction startswith="GET" endswith="POST"

D.transaction by src_ip startswith="GET" endswith="POST"

AnswerC

Correct. `transaction startswith="GET" endswith="POST"` groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit without unnecessary constraints.

Why this answer

The `transaction` command with `startswith="GET"` and `endswith="POST"` correctly groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit. Options A and D add unnecessary constraints (`maxevents=2` or `by src_ip`) that alter the intended grouping logic, and option B reverses the start and end events, which does not match the specified visit flow.

Exam trap

Splunk often tests the misconception that `maxevents` is required to limit transaction size, but here the trap is that candidates add unnecessary constraints (like `maxevents=2` or `by src_ip`) that alter the intended grouping logic, or they reverse the `startswith` and `endswith` values, failing to match the required visit flow.

How to eliminate wrong answers

Option A is wrong because `maxevents=2` artificially limits the transaction to exactly two events, which may exclude intermediate events (e.g., additional GETs, POSTs, or other HTTP methods) that occur between the start and end of a real user visit. Option B is wrong because it reverses the start and end conditions (startswith="POST" endswith="GET"), which would group transactions that begin with a POST and end with a GET, the opposite of the required user visit flow. Option D is wrong because adding `by src_ip` groups transactions per source IP, which is unnecessary for the basic logic and could cause transactions to be split incorrectly if the same user visit spans multiple IPs (e.g., due to NAT or proxy) or if multiple users share the same IP.

Full explanation →

366

MCQeasy

An analyst wants to calculate the average response time for each web server, but only for requests that returned status code 200. Which search accomplishes this?

A.index=web sourcetype=access status=200 | sort host | stats avg(response_time)

B.index=web sourcetype=access | eval avg_time=avg(response_time) by host | where status=200

C.index=web sourcetype=access status=200 | stats avg(response_time) by host

D.index=web sourcetype=access | stats avg(response_time) by host | search status=200

AnswerC

Correct order: filter, then stats.

Why this answer

It first filters events with `status=200` (only successful requests), then uses `stats avg(response_time) by host` to compute the average response time per web server. This ensures the aggregation is performed only on the relevant subset of data, matching the requirement precisely.

Exam trap

Splunk often tests the order of operations in Splunk searches, specifically that filtering (with `where` or search terms) must occur before aggregation (`stats`) to affect the computed values, and that `eval` cannot perform aggregate functions like `avg()`.

How to eliminate wrong answers

Option A is wrong because `sort host` before `stats` is unnecessary and does not affect the aggregation; more critically, `stats avg(response_time)` without a `by` clause computes a single overall average, not per host. Option B is wrong because `eval` cannot compute an aggregate function like `avg()` with a `by` clause; `eval` is for per-event calculations, not statistical aggregations, and the `where` clause is placed after the invalid `eval`. Option D is wrong because `stats avg(response_time) by host` is computed on all events (including non-200 status codes), and then `search status=200` attempts to filter after aggregation, but the `status` field is no longer present in the aggregated results, so the filter will return no results or be meaningless.

Full explanation →

367

MCQeasy

Refer to the exhibit. The search returns no transactions even though there are login and logout events in the index. What is the most likely cause?

A.The maxpause value is too short.

B.The startswith and endswith options are mispelled.

C.The sourcetype is incorrect.

D.The transaction command may be timing out due to large data volume.

AnswerD

Without limiting fields, the transaction may consume too much memory, causing the search to be killed.

Why this answer

When the transaction command processes a large volume of data, it may exceed the default memory or time limits, causing the search to complete without returning any results. This is a common issue with transaction, especially when there are many events to correlate. Option A is incorrect because the maxpause value is not specified in the exhibit; if it were too short, events close together might be missed, but no transactions at all suggests a different problem.

Option B is incorrect because any misspelling in startswith or endswith would typically prevent the search from running or cause syntax errors. Option C is incorrect because the sourcetype appears to be present in the events; the issue is not about missing sourcetype.

Full explanation →

368

MCQmedium

A security analyst needs to enrich authentication logs with employee department information stored in a CSV file called 'employees.csv'. The CSV has fields: 'emp_id', 'name', 'department'. The authentication logs contain a field 'user_id' that matches 'emp_id'. Which search correctly enriches the events with the department field?

A.`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department`

B.`index=auth | lookup employees.csv emp_id AS user_id OUTPUT department`

C.`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department, name`

D.`index=auth | inputlookup employees.csv where user_id=emp_id | table *`

AnswerB

Correct syntax: lookup field emp_id is matched to search field user_id, and department is output.

Why this answer

It uses the proper lookup syntax: `lookup <lookup-table> <lookup-field> AS <event-field> OUTPUT <output-field>`. Here, `employees.csv emp_id AS user_id` maps the lookup field `emp_id` to the event field `user_id`, and outputs the `department` field. Option A incorrectly maps `user_id` to `emp_id`, which would look for a lookup field `user_id` and rename it, but the lookup table column is `emp_id`, so it will not match correctly.

Option C has the same mapping error as A, and additionally outputs `name`, which is not required. Option D uses `inputlookup` which returns the contents of the lookup table, not enriching the events with a join.

Full explanation →

369

Multi-Selectmedium

When designing a macro for use across multiple dashboards, which two considerations are important? (Choose TWO.)

Select 2 answers

A.Use token arguments to parameterize the macro.

B.Include absolute time ranges in the macro definition.

C.Use global permissions to allow all roles to use the macro.

D.Define the macro with a description for documentation.

E.Avoid using macros with subsearches.

AnswersA, C

Correct: Token arguments allow the macro to be customized for different contexts.

Why this answer

Options A and C are correct. Permissions must be set to allow cross-app usage. Token arguments (like $index$) enable flexibility.

Absolute time ranges reduce reusability. Subsearches are allowed but not a primary consideration. Descriptions are helpful but not essential.

Full explanation →

370

MCQmedium

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

A.Convert the saved search to a scheduled report.

B.Create a data model summary to pre-aggregate the data.

C.Replace the join with a subsearch.

D.Use the `fields` command to remove unnecessary fields before the join.

AnswerB

Summaries reduce the amount of data scanned.

Why this answer

A data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Exam trap

Splunk often tests the misconception that subsearches are always faster than joins, but in reality, subsearches can be equally or more resource-intensive when dealing with large datasets, and the correct optimization is to pre-aggregate data using data model summaries.

How to eliminate wrong answers

Option A is wrong because converting a saved search to a scheduled report does not change the underlying query logic or data volume; it only changes when the search runs, not how efficiently it executes. Option C is wrong because replacing a join with a subsearch does not inherently improve performance — subsearches can still be resource-intensive and may even degrade performance if they return large result sets. Option D is wrong because while using the `fields` command to remove unnecessary fields before the join can reduce memory usage, it does not address the fundamental issue of joining two large indexes; the join still processes all matching events, and the performance gain is minimal compared to pre-aggregation.

Full explanation →

371

MCQeasy

An alert saved search runs every 5 minutes and is set to trigger when count > 0. The alert keeps triggering repeatedly for the same events. What is the recommended solution?

A.Set the alert to trigger once per hour.

B.Disable the alert and re-enable.

C.Increase the alert throttle period.

D.Change the condition to count > 1.

AnswerC

Correct: Throttling sets a quiet period after a trigger to avoid duplicate alerts.

Why this answer

Increasing the alert throttle period suppresses duplicate alerts for the same events within a defined time window, preventing repeated triggers. Option A reduces frequency but does not address duplicate alerts. Option B does not solve the underlying issue.

Option D may miss legitimate events.

Full explanation →

372

MCQeasy

A security analyst wants to visualize the count of login failures per hour, grouped by source IP. Which SPL command should they use?

A.timechart count by src_ip

B.stats count by _time, src_ip

C.chart count by src_ip over _time

D.eventstats count by src_ip

AnswerA

Correct. timechart automatically bins events by time and groups by src_ip.

Why this answer

Timechart automatically creates a time-based chart and can split by a field using 'by src_ip'. Option B is incorrect because stats produces a table, not a time-based chart, and does not automatically bin by time. Option C is incorrect because chart requires an explicit 'span' to create time-based bins, unlike timechart.

Option D is incorrect because eventstats adds a new field but does not produce a visualization.

Full explanation →

373

MCQhard

A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search: `index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200` This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?

A.The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.

B.The search lacks a `fields` command to include `user_id`, so the transaction fails.

C.The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.

D.The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.

AnswerD

`sum()` in `where` does not aggregate multivalue fields; it returns the sum of the first value.

Why this answer

The `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.

Exam trap

The trap here is that candidates assume `sum(amount)` works directly in a `where` clause after `transaction`, but Splunk requires explicit multivalue field aggregation functions like `mvsum()` to compute totals from grouped events.

How to eliminate wrong answers

Option A is wrong because the `amount<50` filter correctly excludes transactions of exactly $50, but the problem states the search returns no results even though patterns exist; the issue is not about boundary values. Option B is wrong because the `transaction` command automatically groups events by `user_id` and retains all fields from the original events; no `fields` command is needed to include `user_id`. Option C is wrong because the search explicitly looks for patterns within a 1-hour window, and the problem confirms such patterns exist; the `maxspan=1h` is not the cause of zero results.

Full explanation →

374

MCQeasy

To count events by host for the last hour, which search is most efficient?

A.index=* earliest=-1h | stats count by host

B.index=* | stats count by host | where _time > relative_time(now(), "-1h")

C.search index=* | head 1000 | stats count by host

D.sourcetype=access_combined | timechart count by host

AnswerA

Applies time range early, minimizing data scanned.

Why this answer

It uses `index=*` to search all indexes and `earliest=-1h` to restrict the search to the last hour at the index level, which is the most efficient way to filter time. The `stats count by host` then aggregates counts per host without needing to process events outside the time range. This approach leverages Splunk's time-based index pruning, minimizing data scanned.

Exam trap

Splunk often tests the misconception that you can filter time after aggregation (as in Option B) or that limiting results with `head` is equivalent to time-based filtering, when in fact time filters must be applied at search time via `earliest`/`latest` for efficiency and correctness.

How to eliminate wrong answers

Option B is wrong because it retrieves all events (no time filter) and then attempts to filter by `_time` after the `stats` command, which is inefficient and incorrect since `stats` discards the `_time` field unless explicitly retained; the `where` clause would fail or require reprocessing all data. Option C is wrong because `head 1000` arbitrarily limits results to the first 1000 events, which may not represent the last hour and can miss relevant data, making it both inefficient and inaccurate. Option D is wrong because `sourcetype=access_combined` restricts to a specific sourcetype, not all events, and `timechart count by host` is less efficient than `stats` for a simple count by host, as it creates time-based buckets unnecessarily.

Full explanation →

375

MCQeasy

A user wants to see the top 5 most common HTTP methods (field "method") from web access logs, along with their percentage of total. Which search is best?

A.index=web | top method countfield=percent

B.index=web | eventstats count | top method

C.index=web | top method limit=5 showperc=t

D.index=web | stats count by method | sort - count | head 5

AnswerC

Correctly uses top with showperc to display percentages.

Why this answer

`top` with `limit=5` returns the five most common values of the `method` field, and `showperc=t` automatically calculates and displays each value's percentage of the total events. This directly meets the requirement to see the top 5 HTTP methods and their percentages without needing additional commands.

Exam trap

The trap here is that candidates often assume `top` only shows counts and not percentages, or they misuse `countfield` instead of `showperc`, leading them to choose a manual `stats` approach that omits the percentage calculation entirely.

How to eliminate wrong answers

Option A is wrong because `countfield=percent` is not a valid parameter for the `top` command; the correct parameter to display percentages is `showperc=t`. Option B is wrong because `eventstats count` adds a total count to every event, but `top` without `limit=5` defaults to showing 10 results, and it does not automatically calculate percentages unless `showperc=t` is used. Option D is wrong because while it correctly finds the top 5 methods by count, it does not calculate or display the percentage of total for each method, which the question explicitly requires.

Full explanation →

Splunk Core Certified Power User SPLK-1003 (SPLK-1002) — Questions 301–375