Courseiva

Splunk Core Certified Power User SPLK-1003 (SPLK-1002) — Questions 376–450

475 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 7

Page 7
376
MCQhard

A lookup definition is correctly configured, but when used in a search, no results are returned. The lookup file exists and contains data. What is the most likely cause?

A.The lookup file has too many fields.
B.The lookup definition has the wrong case sensitivity setting.
C.The lookup file is in JSON format but the definition expects CSV.
D.The search time field extraction for the matching field is disabled.
AnswerB

If case_sensitive_match is set incorrectly (e.g., false when it should be true), mismatches occur.

Why this answer

Case sensitivity mismatch is a common issue: if the lookup definition expects exact case but the search field has different case, no match occurs. Option A is unlikely as too many fields do not prevent matching. Option C, disabling field extraction, would affect other parts but not lookup matching directly.

Option D, format mismatch, would cause an error, not silently return no results.

Full explanation →
377
Multi-Selectmedium

Which TWO of the following are valid aggregation functions in the `stats` command? (Choose 2)

Select 2 answers
A.median
B.sum
C.earliest
D.list
E.distinct_count
.last
AnswersB, D

Sum is a valid aggregation function in `stats` that calculates the total of numeric values.

Why this answer

The `stats` command in Splunk supports many aggregation functions, including `sum()` and `list()`. `sum()` calculates the total of numeric values for each group, while `list()` returns a multivalue list of all values for a field. Option B is correct because `sum` is a valid aggregation function in `stats`. Option D is correct because `list` is also a valid function.

Other options: `median` is not a valid `stats` function (it is available only in `eventstats` or `streamstats`); `earliest` and `distinct_count` are also valid, but the question asks for two specific correct answers, and `sum` and `list` are the intended choices.

Exam trap

Splunk often tests the distinction between valid `stats` functions and those that are only available in `eventstats` or `streamstats`, such as `median()` and `mode()`, leading candidates to incorrectly select them for `stats`.

Full explanation →
378
Multi-Selecthard

Which TWO of the following are valid ways to reference a macro in a search?

Select 2 answers
A.$macro_name(arg1, arg2)$
B.macro_name:arg1, arg2
C.`macro_name(arg1, arg2)`
D.`macro_name arg1 arg2`
E.| macro_name(arg1, arg2)
AnswersC, D

Backticks with parentheses and comma-separated arguments.

Why this answer

In Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Exam trap

The trap here is that candidates confuse the backtick macro syntax with the dollar-sign token syntax used in dashboards or the pipe command syntax, leading them to select invalid options like A or E.

Full explanation →
379
MCQhard

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

A.`transaction user,ip,action maxspan=10m`
B.`transaction user maxspan=10m`
C.`transaction user maxpause=30s`
D.`transaction user mvcount=3`
AnswerB

Groups by user within a 10-minute window, allowing the sequence to be verified later.

Why this answer

`transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Exam trap

Splunk often tests the misconception that `transaction` requires all specified fields to match exactly, leading candidates to include `action` in the transaction fields, which would incorrectly split the three different actions into separate transactions.

How to eliminate wrong answers

Option A is wrong because including `ip` and `action` in the `transaction` fields means the transaction will only group events that share the exact same `ip` and `action` values, which would prevent grouping the three different actions (login, privilege escalation, file access) together since they have different `action` values. Option C is wrong because `maxpause=30s` sets a maximum idle time between events in the transaction, but does not enforce a total time limit of 10 minutes; the attack pattern requires all three events to occur within 10 minutes, not just a 30-second pause between them. Option D is wrong because `mvcount=3` is not a valid parameter for the `transaction` command; `mvcount` is used with `stats` or `eventstats` to count multivalue fields, not to group events into transactions.

Full explanation →
380
MCQeasy

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

A.sort=_time
B.Use option `timeordered=true`
C.transaction automatically sorts by time
D.No sorting needed; events are indexed in order
AnswerC

transaction groups and orders events by _time within each group.

Why this answer

`transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed.

Option D (timeordered) is not a valid option.

Full explanation →
381
MCQhard

In a dashboard panel, a table shows event counts by source. The user wants to click on a sourcetype to drill down to a new search showing all events from that source. Which token-based drilldown approach is correct?

A.Use a custom JavaScript to navigate.
B.Set a drilldown action to 'form' and submit the token.
C.Set a drilldown action to 'link' with a URL that includes the sourcetype.
D.Set a drilldown action to 'search' with a search string containing $row.sourcetype$.
AnswerD

Correct. Using a 'search' action with a search string that includes $row.sourcetype$ passes the clicked value dynamically and runs a new search for events from that source.

Why this answer

Using $row.sourcetype$ in a drilldown search string passes the clicked value dynamically. Option A is wrong because custom JavaScript is unnecessary and not the recommended token-based approach. Option B is wrong because 'form' action submits form inputs, not simply a token with the clicked value.

Option C is wrong because a static link URL cannot dynamically pass the clicked sourcetype.

Exam trap

The key trap is confusing drilldown actions: 'search' with tokens like $row.sourcetype$ is the correct method for this scenario, not 'link' or 'form'.

Full explanation →
382
MCQmedium

An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?

A.Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds
B.Use `append` to combine the two sourcetypes and then `search` for the pattern
C.Use `eventstats` to compute counts by sessionID and then filter
D.Use `stats` with values() and a by clause on sessionID
AnswerA

Transaction groups events sharing the sessionID field and limits the span to 5 seconds, allowing pattern detection.

Why this answer

The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.

Exam trap

Splunk often tests the misconception that `stats` or `eventstats` can perform event correlation, but these commands aggregate data and lose the individual event sequence required for time-ordered correlation within a specific window.

How to eliminate wrong answers

Option B is wrong because `append` simply concatenates results from two searches without any correlation logic; it does not group events by session ID or enforce a time window. Option C is wrong because `eventstats` computes aggregate statistics (like counts) but does not group individual events into transactions or enforce a 5-second span. Option D is wrong because `stats` with `values()` and a `by` clause aggregates field values per session ID but loses the individual event sequence and time ordering needed to detect a failed login followed by an error within 5 seconds.

Full explanation →
383
MCQmedium

Refer to the exhibit. An admin configures acceleration for the Network_Traffic data model as shown. A user runs a search using the data model over the last 60 days. Why might the search be slower for data older than 7 days?

A.The data model is not compatible with acceleration
B.The summary_range is set to 30d, so only data within 30 days is accelerated
C.The earliest_time is set to -7d@d, so the acceleration index only covers the last 7 days
D.The search must use the `| datamodel` command to benefit from acceleration
AnswerC

Correct: Only data after -7d@d is accelerated.

Why this answer

The `earliest_time` parameter in the acceleration configuration is set to -7d@d, meaning the acceleration summary is built only for data from the last 7 days. Searches querying older data must scan raw events, which is slower. Option A is incorrect because summary_range controls how long to keep accelerated data, not the time range covered.

Option B misstates the summary_range: it is set to 30d, not that data within 30 days is accelerated. Option D is incorrect; the datamodel command is not required to use acceleration; acceleration is transparently applied when using the data model.

Full explanation →
384
MCQeasy

When creating a saved search that runs every hour and sends an email alert when the count of errors exceeds 10, which action must be configured in addition to the search logic?

A.Add an email alert action in the saved search settings.
B.Include '| alert' command in the search string.
C.Create a lookup table to store error counts.
D.Enable summary indexing for the search.
AnswerA

Alert actions such as email must be configured to trigger notifications.

Why this answer

Saved searches that trigger alerts require at least one alert action (e.g., email) to be defined in the saved search settings. Option B is incorrect because the `| alert` command is not used in search strings for saved search alerts. Option C is incorrect because a lookup table is not required for alerting.

Option D is incorrect because summary indexing is unrelated to sending email alerts.

Full explanation →
385
MCQeasy

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

A.It limits the number of events in a transaction to 5.
B.It limits the total time span of each transaction to 5 minutes.
C.It pauses the search for 5 minutes between transactions.
D.It closes the transaction if there is no new event from the same clientip within 5 minutes.
AnswerD

Correct: maxpause is the inactivity timeout.

Why this answer

maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Full explanation →
386
Multi-Selecthard

An admin is troubleshooting a saved search that uses the `| `my_macro` command. The macro definition is `stats count by $1$`. The saved search is scheduled to run hourly. Which of the following issues could cause the saved search to fail? (Choose three.)

Select 3 answers
A.The macro argument passed in the saved search contains a space without quotes
B.The macro definition includes a pipe at the start but the invocation also includes a pipe
C.The saved search's time range is set to 'All time'
D.The macro is not shared to the app where the saved search is stored
E.The saved search has a cron schedule that overlaps with another saved search
AnswersA, B, D

If the macro argument contains a space without quotes, it will be parsed incorrectly.

Why this answer

Options A, B, and D are correct. A: If the macro argument contains a space without quotes, it will be parsed incorrectly. B: If the macro definition includes a pipe at the start but the invocation also includes a pipe, the double pipe causes a syntax error.

D: If the macro is not shared to the app where the saved search is stored, the saved search cannot access it. C: 'All time' time range is not a direct cause of failure. E: Overlap might cause skip but not necessarily failure.

Full explanation →
387
Multi-Selectmedium

A security analyst needs to correlate authentication events from multiple Windows domain controllers to identify failed logon attempts from a specific user account, and then enrich the results with the user's department and manager from an HR database. Which TWO Splunk features should the analyst use?

Select 2 answers
A.Time-based lookup
B.Data model acceleration
C.Subsearch
D.Lookup definition
E.Calculated field
AnswersB, D

Data models can normalize and accelerate searches across multiple sources.

Why this answer

Data model acceleration (B) is correct because it pre-computes and indexes authentication event data from multiple Windows domain controllers, enabling fast, efficient correlation of failed logon attempts for a specific user. Lookup definition (D) is correct because it allows the analyst to define a lookup that enriches the authentication events with the user's department and manager from an external HR database, mapping fields like username to the HR data.

Exam trap

The trap here is that candidates often confuse subsearch (C) with lookup definition (D) for enrichment, not realizing that subsearches are for dynamic filtering, not static field mapping from an external source, and that data model acceleration (B) is specifically designed for high-performance correlation across multiple data sources, not just a simple search optimization.

Full explanation →
388
MCQmedium

An organization uses the Splunk Common Information Model (CIM) to normalize data from various sourcetypes. After onboarding a new firewall vendor, the data is not populating the Network Traffic data model. Which of the following is the most likely cause?

A.The sourcetype is not included in the 'Network Traffic' data model acceleration.
B.The appropriate CIM tags have not been assigned to the new sourcetype.
C.The data is being indexed into a custom index that is not monitored by the data model.
D.The fields in the firewall data do not match the data model field names exactly.
AnswerB

CIM uses tags like 'network' or 'traffic' to map events to data models.

Why this answer

The Splunk CIM uses tags to map sourcetypes to specific data models. Without the appropriate CIM tags (such as 'network' or 'traffic'), the data will not populate the Network Traffic data model, even if the sourcetype is included in data model acceleration or indexed into any index. Option A is incorrect because data model acceleration includes all sourcetypes unless explicitly excluded, but tagging is still required for data model population.

Option C is irrelevant because custom indexes do not affect CIM mapping; tagging is the key factor. Option D is incorrect because the CIM normalizes fields via tags and field aliases—exact field name match is not required if proper tags are assigned.

Full explanation →
389
MCQhard

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

A.The transaction should group by user instead of src.
B.The case statement does not set stage for events that don't match either pattern.
C.The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.
D.The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.
AnswerD

Searching stage="*" does not match multivalue fields; it matches a literal asterisk. Should use `where isnotnull(stage)`.

Why this answer

The `search stage="*"` command filters out all transactions because `stage` is a multivalue field created by the `transaction` command. In Splunk, a multivalue field cannot be matched with a simple wildcard search like `stage="*"`; this search only returns events where `stage` is a single literal asterisk. To search for any value in a multivalue field, you must use `mvcount(stage)>0` or `search stage=*` (without quotes).

Exam trap

Splunk often tests the subtle difference between `field="*"` (literal asterisk) and `field=*` (wildcard) in the context of multivalue fields, tricking candidates into thinking a quoted wildcard works the same as an unquoted one.

How to eliminate wrong answers

Option A is wrong because the search already groups by `src` (source IP), which is the correct field for detecting brute-force attacks from the same IP; grouping by `user` would miss attacks where the same IP tries multiple usernames. Option B is wrong because the `case` statement does set `stage` for events that match either pattern (failed or successful login), and events that don't match either pattern are irrelevant to the attack detection and can be ignored. Option C is wrong because `mvcount(stage)>2` and `mvcount(stage)>=2` are not mutually exclusive; the condition `mvcount(stage)>2 AND mvcount(stage)>=2` is redundant but not logically incorrect—it would still match transactions with 3 or more events, but the real issue is that the preceding `search` command eliminates all transactions before this condition is evaluated.

Full explanation →
390
Multi-Selectmedium

Which THREE of the following are best practices for creating saved searches?

Select 3 answers
A.Save the search without scheduling it to avoid resource usage.
B.Set an appropriate time range to limit the data scanned.
C.Use the `summary` indexing feature for searches that run frequently.
D.Avoid specifying a time range to use the default.
E.Use descriptive names that indicate the purpose of the search.
AnswersB, C, E

Limiting time range improves performance.

Why this answer

Setting an appropriate time range in a saved search limits the volume of data that Splunk must scan, reducing resource consumption and improving search performance. Without a bounded time range, the search may scan all available data, which can lead to excessive CPU and memory usage, especially in large deployments.

Exam trap

Splunk often tests the misconception that omitting a time range is acceptable because Splunk will use a 'reasonable default,' but in reality the default is often 'All time,' which is the most resource-intensive option.

Full explanation →
391
MCQeasy

Refer to the exhibit. What will this search return?

A.A list of events with status 404.
B.A time-based chart with a line for each host showing count of 404 events per time period.
C.A table with columns for each host and a row for each time bucket showing count of 404 errors.
D.A bar chart of total 404 errors per host.
AnswerB

timechart by host produces a time series chart with lines per host.

Why this answer

The search uses `timechart` with `by host`, which produces a time-based chart where each host is a separate series (line) showing the count of events where `status=404` over each time bucket. The `count` function aggregates the number of 404 events per time period, and the `by host` clause splits the results into separate lines per host. Option B correctly describes this output.

Exam trap

Splunk often tests the distinction between `timechart` (time-based series) and `chart` or `stats` (non-time-based aggregation), leading candidates to confuse a time-series chart with a static table or bar chart.

How to eliminate wrong answers

Option A is wrong because the search does not return a raw list of events; it aggregates counts over time using `timechart`, so individual events are not displayed. Option C is wrong because `timechart` produces a time-based chart (line or column) with time on the x-axis, not a table with rows for each time bucket and columns for each host; a table would require `chart` or `stats` with `by` and `span`. Option D is wrong because `timechart` with `by host` does not produce a bar chart of total counts per host; it shows counts over time, not a single aggregated total per host.

Full explanation →
392
Multi-Selecteasy

Which THREE are components of the Common Information Model (CIM) in Splunk?

Select 3 answers
A.Tags
B.Data models
C.Lookup tables
D.Field extractions
E.Dashboards
AnswersA, B, D

Tags are used to categorize events into CIM data model tags.

Why this answer

The three components of the Common Information Model (CIM) in Splunk are Tags (A), Data Models (B), and Field Extractions (D). Tags are used to define the CIM data model's data source types and event types. Data Models provide the framework for the CIM, defining normalized fields and relationships.

Field extractions are necessary to map raw data to the CIM fields. Lookup tables (C) and dashboards (E) are not part of the CIM; they may be used in conjunction with CIM but are not core components.

Full explanation →
393
MCQmedium

An automatic lookup is configured in props.conf and transforms.conf, but the expected fields are not appearing in search results. Which is the first thing to verify?

A.Verify the transforms.conf definition for the lookup
B.Run a search using the lookup command manually to test
C.Verify that the source field is extracted at search time
D.Verify that the user has read permissions on the lookup table
AnswerA

Incorrect configuration in transforms.conf (e.g., wrong filename, source/dest fields) is the most common cause.

Why this answer

The first step to troubleshoot an automatic lookup is to verify the transforms.conf definition, ensuring that the lookup table name, file path, and field mappings are correctly specified. Option B is incorrect because manually running the lookup command is a diagnostic step that comes after verifying the configuration. Option C is incorrect because the source field extraction is not directly related to automatic lookup functionality; the lookup is based on field values, not extraction.

Option D is incorrect because read permissions on the lookup table would typically cause an error message, not a silent failure of fields appearing.

Full explanation →
394
MCQmedium

An admin configured an automatic lookup but events for mysourcetype are not being enriched. What is the most likely problem?

A.The lookup file is too large and memory limit is exceeded.
B.The match_type should be 'EXACT' instead of 'WILDCARD'.
C.The LOOKUP stanza in props.conf is missing the input field specification.
D.The lookup is defined in transforms.conf but not referenced in any search.
AnswerB

For direct field matching, EXACT is appropriate; WILDCARD is for pattern matching.

Why this answer

The WILDCARD match_type requires the event value to contain wildcard characters or be matched glob-style; typical exact matches require EXACT match_type. Option C is possible but the syntax can omit INPUT if the field names match. Options A and D are less likely.

Full explanation →
395
MCQhard

A search produces a field 'count'. You need to find the event with the maximum count. Which approach is correct?

A.| eventstats max(count) as maxcount | where count = maxcount
B.Both B and C work.
C.| sort -count | head 1
D.| stats max(count) as maxcount
AnswerA, C

Correct. This approach computes the maximum count across all events and adds it as a field to each event via `eventstats`, then filters to keep only events where the original count equals that maximum. It returns all events with the highest count, preserving full event data.

Why this answer

Both options A and C are valid approaches to find the event with the maximum count. Option A uses `eventstats` to compute the maximum count and adds it to each event, then filters events where the count equals the maximum. This returns all events that share the maximum count, preserving full event data.

Option C sorts events in descending order by count and takes the first event with `head 1`, returning one event with the maximum count. If multiple events tie for the maximum, `head 1` returns only one, but it still correctly identifies an event with the maximum count. Option D (`stats max(count) as maxcount`) returns only the maximum value, not the event details, so it is incorrect.

Option B is not a valid search command; it is a self-referential statement, and thus incorrect.

Exam trap

Splunk often tests the distinction between `eventstats` and `stats`, and the behavior of `sort` with ties. Candidates may incorrectly think only `eventstats` can find the event with the max, but `sort -count | head 1` is also acceptable for retrieving one event with the maximum count. The trick is that `head 1` limits the result to a single event, which might be acceptable depending on the requirement.

How to eliminate wrong answers

Option B is wrong because it is a meta-option that claims both B and C work, but Option D does not work for finding the event with the maximum count (it only returns the max value as a single row, losing the event context). Option C is wrong because while `| sort -count | head 1` does return the event with the highest count, it is not the only correct approach; Option A is also correct, and the question asks for 'which approach is correct' — both A and C are valid, but Option B incorrectly claims that both B and C work (B is not a valid approach itself). Option D is wrong because `| stats max(count) as maxcount` produces a single-row result with only the maximum count value, not the original event data, so you cannot identify which event had that count.

Full explanation →
396
MCQeasy

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

A.maxspan=30m, maxpause=5m
B.maxspan=10m, maxpause=30m
C.maxspan=1h, maxpause=10m
D.maxspan=30m, maxpause=10m
AnswerD

Correctly sets total duration and inactivity timeout.

Why this answer

The maxspan parameter sets the maximum total duration of the transaction, while maxpause sets the inactivity timeout. Option D correctly specifies maxspan=30m (to cover the maximum session length) and maxpause=10m (to close the transaction after 10 minutes of inactivity).

Full explanation →
397
MCQeasy

An analyst runs a search with the command 'lookup region_lookup region_code OUTPUT region_name'. The events have a region_code field with values like 'us-east' and 'eu-west'. The lookup file contains 'US-EAST' and 'EU-WEST'. The lookup returns no results. What is the most likely cause?

A.The lookup file format is incorrect
B.The default_match setting prevents missing matches
C.The match_type is WILDCARD but no wildcards used
D.The case_sensitive_match is set to true
E.The max_match setting limits results
AnswerD

Case sensitivity causes mismatches between uppercase and lowercase values.

Why this answer

The lookup is case-sensitive ('Case_sensitive_match = true'), and the event fields have lowercase values while the lookup file has uppercase, causing no match.

Full explanation →
398
MCQeasy

Refer to the exhibit. What is the purpose of the eval command in this search?

A.It replaces the status field with the category.
B.It adds a temporary field that is not retained after stats.
C.It converts the status field to a string.
D.It creates a new field 'status_category' based on the numeric status code, grouping into three categories.
AnswerD

Correctly describes the eval case usage

Why this answer

The eval command creates a new field 'status_category' by evaluating a CASE expression that maps numeric HTTP status codes (e.g., 200, 404, 500) into three descriptive categories: 'OK', 'Client Error', and 'Server Error'. This is a common pattern for enriching raw data with human-readable labels without altering the original 'status' field. The correct answer is D because the search explicitly defines the new field based on the status code values.

Exam trap

Splunk often tests the distinction between creating a new field versus modifying an existing field, and candidates mistakenly think eval replaces the original field when it actually adds a new one.

How to eliminate wrong answers

Option A is wrong because the eval command does not replace the 'status' field; it creates a new field 'status_category' while leaving the original 'status' field intact. Option B is wrong because the new field 'status_category' is not temporary; it persists after the stats command since stats can aggregate over any existing fields, including those created by eval. Option C is wrong because the 'status' field is already a numeric type (as shown in the CASE comparisons with numbers), and eval does not convert it to a string; instead, it creates a new string field 'status_category' from the numeric values.

Full explanation →
399
MCQmedium

An organization is implementing the Splunk Common Information Model (CIM) to normalize data. They have a source that provides event data with field names `src_ip` and `dst_ip`. To map these to CIM fields, which knowledge object should be created?

A.A tag to tag events with `src_ip` and `dst_ip` as network traffic
B.A field extraction to rename `src_ip` to `src` and `dst_ip` to `dest`
C.A field alias to create `src` from `src_ip` and `dest` from `dst_ip`
D.A calculated field to set `src=src_ip` and `dest=dst_ip`
AnswerC

Correct: Field aliases are designed for this purpose.

Why this answer

Field aliases allow mapping source-specific field names (src_ip, dst_ip) to CIM-standard field names (src, dest) without modifying raw data. Option A (tags) are for categorization, not field mapping. Option B (field extraction) extracts new fields but cannot rename existing ones.

Option D (calculated fields) compute new fields from expressions, but simple renaming is better handled by aliases.

Full explanation →
400
Multi-Selectmedium

Which TWO statements correctly describe the behavior of the transaction command in Splunk?

Select 2 answers
A.It is not recommended for use with large datasets because it consumes too much memory.
B.It merges all fields from all events into a single event, with the last event's field value taking precedence.
C.It can concatenate the raw text of all events in the transaction into a single event.
D.It automatically calculates the duration of each transaction as the difference between the first and last event timestamps.
E.It can close a transaction based on a change in a specific field value or after a specified timeout.
AnswersC, E

The transaction command can combine raw event text from all related events into one event.

Why this answer

The transaction command can be configured with the `mvraw` option to concatenate the raw text of all events in the transaction into a single event. This is useful when you need to preserve the full log lines of a correlated sequence, such as a multi-step user session or a series of API calls.

Exam trap

The trap here is that candidates often confuse the transaction command's field merging behavior (which creates multivalue fields) with the `stats values()` function, or assume duration is automatically calculated without the `duration` option, leading them to select option B or D incorrectly.

Full explanation →
401
MCQeasy

A search returns duplicate events for the same user. The analyst wants to keep only the first occurrence of each user based on timestamp. Which sequence of commands is best?

A.sort -_time | dedup user
B.dedup user
C.dedup user | sort _time
D.sort _time | dedup user
AnswerD

Sort ascending puts earliest first, then dedup keeps the first (earliest) per user.

Why this answer

It first sorts events by timestamp in ascending order (oldest first), then applies `dedup user` to keep only the first occurrence of each user. Since `dedup` retains the first event it encounters for each field value, sorting by `_time` ensures that the earliest event for each user is kept, satisfying the requirement to keep only the first occurrence based on timestamp.

Exam trap

Splunk often tests the order of operations in piped commands, specifically that `sort` must precede `dedup` to control which event is kept, and that `-` before a field name reverses the sort order, which candidates may misinterpret.

How to eliminate wrong answers

Option A is wrong because `sort -_time` sorts in descending order (newest first), so `dedup user` would keep the most recent event for each user, not the first occurrence. Option B is wrong because `dedup user` without any sort operates on the raw order of events as they arrive from the index, which is not guaranteed to be chronological, so it may not keep the earliest event for each user. Option C is wrong because `dedup user` is applied before sorting, so the dedup operation sees events in their raw order and may discard the earliest event; the subsequent `sort _time` only reorders the remaining events but cannot recover the discarded first occurrence.

Full explanation →
402
MCQeasy

A user wants to add a field showing the average value of a numeric field `latency` for each host, without reducing the number of events. Which command should be used?

A.eval
B.stats
C.eventstats
D.streamstats
AnswerC

`eventstats` adds the average latency per host to each event without reducing the number of events.

Why this answer

The `eventstats` command is correct because it calculates aggregate statistics (like average) over a field and appends the result as a new field to every event, preserving the original event count. Unlike `stats`, which reduces the dataset to one row per group, `eventstats` enriches each event with the computed value without removing any events.

Exam trap

The trap here is that candidates often confuse `eventstats` with `stats` because both compute aggregates, but `stats` reduces events while `eventstats` does not, and Splunk tests this distinction by explicitly stating 'without reducing the number of events' in the question.

How to eliminate wrong answers

Option A is wrong because `eval` creates or modifies fields on a per-event basis using expressions, but it cannot compute aggregate statistics like an average across multiple events. Option B is wrong because `stats` computes aggregate statistics but reduces the number of events to one row per group (e.g., per host), which violates the requirement to keep all events. Option D is wrong because `streamstats` computes running or cumulative statistics over a sequence of events, not a global average per host, and it would produce incorrect results if events are not sorted properly.

Full explanation →
403
MCQeasy

A dashboard developer wants to create a single-value visualization that shows the current server status from a lookup table. Which Splunk command should be used to retrieve the lookup data in a real-time context?

A.inputlookup
B.outputlookup
C.lookup
D.geostats
AnswerC

lookup can be used in real-time searches to enrich events.

Why this answer

The `lookup` command retrieves field values from a lookup table and can be used in a real-time context to enrich events or display current status. Unlike `inputlookup`, which loads the entire lookup table as events, `lookup` works within the search pipeline, allowing it to match against live data and return the most recent lookup values for a single-value visualization.

Exam trap

The trap here is that candidates confuse `inputlookup` (which loads the entire table as events) with `lookup` (which enriches events in the pipeline), leading them to choose `inputlookup` for a real-time single-value display when it actually returns all rows as separate events, not a single aggregated value.

How to eliminate wrong answers

Option A is wrong because `inputlookup` loads the entire lookup table as search events, which is not suitable for real-time context and would require additional processing to extract a single value. Option B is wrong because `outputlookup` writes data to a lookup table, not retrieves it, making it irrelevant for displaying current server status. Option D is wrong because `geostats` is used for geospatial statistical aggregation, not for retrieving lookup data, and it does not operate on lookup tables.

Full explanation →
404
MCQhard

A security analyst is trying to normalize authentication data from multiple sources using CIM. After mapping sourcetypes to the Authentication data model, the CIM acceleration dashboard shows no data. The data model acceleration is enabled and has completed building. What is the most likely cause?

A.The data model acceleration is not enabled.
B.The tags for the sourcetypes are not correctly assigned to the data model.
C.The field extractions for the sourcetypes do not align with CIM field names.
D.The permissions on the data model are incorrect.
AnswerC

Correct: CIM requires exact field name matches; mismatched extractions cause no data in the data model.

Why this answer

The CIM data model relies on field extractions that match the CIM field names exactly. If the field extractions for the sourcetypes do not align with CIM field names, the data model will not populate with data, even if acceleration is enabled and completed. Tags (option B) are not required if sourcetypes are mapped appropriately; permissions (option D) affect visibility, not data population; and acceleration being enabled (option A) is stated as true.

Full explanation →
405
MCQeasy

A company needs to enrich search results with additional fields from a CSV file. Which method should they use to define the lookup table so that it is available in all searches?

A.Define the lookup in props.conf with an automatic lookup stanza.
B.Use the inputlookup command in a search.
C.Define the lookup in transforms.conf with a filename and field mapping.
D.Use the lookup command with the file path.
E.Use the eval command with the lookup function directly in search.
AnswerC

Correct. The lookup table file and format must be defined in transforms.conf with a filename and field mapping to be available for use in searches.

Why this answer

To make a lookup table available in all searches, the lookup definition must be created in transforms.conf. This file defines the lookup table filename, field mapping, and other properties. Once defined, the lookup can be used with the lookup command, the inputlookup command, or automatic lookups configured in props.conf.

Option C correctly identifies this requirement.

Full explanation →
406
MCQmedium

The search returns unexpected results, including IP addresses that are not in the expected format (e.g., '127.0.0.1' appears as '27.0.0.1'). What is the most likely cause?

A.The regex pattern is incorrect; it should use \b for word boundaries.
B.The top command is modifying the extracted ip field.
C.The rex command must be placed before the index search.
D.The rex command extracts the first match only; some events may have multiple IPs and the first one is not the full IP.
AnswerD

If the raw contains something like '127.0.0.1' preceded by a digit, the regex might match a subset. But more likely, rex extracts first occurrence; if IP is part of a larger string, it might be incomplete.

Why this answer

The `rex` command, by default, extracts only the first match of a regex pattern from each event. If an event contains multiple IP addresses, `rex` captures the first occurrence, which may be truncated if the regex pattern is not anchored properly or if the IP appears in a context where leading digits are separated (e.g., '127.0.0.1' might be preceded by a character that causes the regex to match starting at '27.0.0.1'). This is a common behavior in Splunk when using `rex` without the `max_match` parameter.

Exam trap

Splunk often tests the misconception that `rex` extracts all matches by default, leading candidates to overlook the need for `max_match` or proper regex anchoring when dealing with multiple values in a single event.

How to eliminate wrong answers

Option A is wrong because using `\b` for word boundaries would not fix the issue of extracting a truncated IP; the problem is about the first match being incomplete, not about boundary detection. Option B is wrong because the `top` command aggregates counts of field values and does not modify the extracted `ip` field itself; it only displays frequencies. Option C is wrong because the `rex` command can be placed anywhere in the search pipeline after the initial data retrieval; it does not need to be before the index search, and placing it earlier would not change the extraction behavior.

Full explanation →
407
Multi-Selecteasy

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Select 2 answers
A.Provides a consistent field naming convention across different data sources.
B.Enables real-time correlation of events across multiple data sources.
C.Reduces indexing volume by summarizing data into CIM-compliant indexes.
D.Defines the sourcetypes for common technologies (e.g., firewall, IDS).
E.Accelerates searches using data model acceleration and tstats.
AnswersA, E

CIM standardizes fields like 'user', 'src', 'dest' for similar events.

Why this answer

The Splunk Common Information Model (CIM) provides two key benefits: (A) It normalizes data from different sources into a consistent field naming convention, making it easier to search across diverse data sources. (E) It supports data model acceleration, which speeds up searches using the tstats command on CIM-compliant data models. Option B is incorrect because real-time correlation is not a direct feature of CIM; CIM standardizes fields but does not perform correlation. Option C is incorrect because CIM does not reduce indexing volume; indexing is independent of CIM.

Option D is incorrect because CIM does not define sourcetypes; sourcetypes are defined at input time.

Full explanation →
408
MCQmedium

In a dashboard, a bar chart shows sales by region. The user wants to click on a bar and have a table filter to show only that region's details. Which drilldown technique should be used?

A.Enable drilldown in the bar chart and set the search to automatically apply the clicked field
B.Configure a form input dropdown and set default value from drilldown
C.Set a token using $click.value$ in the drilldown and add a dependency on the token in the table search
D.Use a static filter with a predefined list of regions
AnswerC

Tokens capture the clicked value and can be used in dependent searches to filter results.

Why this answer

In Splunk dashboards, drilldowns can set tokens using $click.value$ to capture the clicked field value. By setting a token in the drilldown of the bar chart (e.g., token = region_selection with value = $click.value$), the table search can then reference this token (e.g., index=... region=$region_selection$) to filter dynamically. Option A is incorrect because simply enabling drilldown without token setup does not pass the value to another panel.

Option B is incorrect because form input dropdowns are for user input, not for capturing drilldown clicks. Option D is incorrect because a static filter cannot respond to user clicks.

Full explanation →
409
MCQmedium

A security analyst creates a timechart of login failures by source IP. The chart shows expected spikes, but the top 5 IPs account for <10% of all failures. The analyst suspects a DDoS attack using spoofed IPs. Which visualization type would BEST highlight the distribution of failures across all IPs?

A.Pie chart
B.Treemap
C.Scatter plot
D.Stacked column chart
AnswerB

Treemaps effectively show proportions of many categories.

Why this answer

A treemap is the best choice because it uses nested rectangles to represent the proportional contribution of each source IP to the total login failures, making it easy to visually identify the distribution across all IPs, even when no single IP dominates. Unlike other chart types, a treemap can efficiently display hundreds of IPs without cluttering the view, which is critical when the top 5 IPs account for less than 10% of failures, indicating a highly distributed attack pattern.

Exam trap

Splunk often tests the misconception that a pie chart is always the best for showing proportions, but the trap here is that a pie chart fails when there are many small slices, making it impossible to discern the distribution of failures across all IPs in a highly distributed attack.

How to eliminate wrong answers

Option A is wrong because a pie chart becomes unreadable when there are many slices (e.g., hundreds of IPs), and it cannot effectively show the distribution of failures across all IPs when no single IP has a large share. Option C is wrong because a scatter plot is designed to show the relationship between two numerical variables (e.g., time vs. count), not the proportional distribution of a categorical variable like source IP. Option D is wrong because a stacked column chart is best for showing the composition of a whole over time, but it becomes cluttered and loses clarity when there are many categories (IPs) with small values, and it does not highlight the distribution across all IPs at a single point in time.

Full explanation →
410
Multi-Selecthard

Which TWO of the following are true about the `transaction` command? (Choose 2)

Select 2 answers
A.Transactions can be started based on a specific field value using the `startswith` option.
B.It outputs one event per input event, adding duration and eventcount fields.
C.The `by` clause is mandatory to define how to group events.
D.It groups events that share common field values and occur within a specified time window.
E.The `maxpause` option defines the maximum allowed time gap between events in the same transaction.
AnswersD, E

Correct as is.

Why this answer

The `transaction` command groups events that share common field values (specified by the `by` clause when used) and that occur within a specified time window, typically set by `maxspan` or using the default span. Option E is correct because the `maxpause` option defines the maximum allowed time gap between consecutive events in the same transaction; if the gap exceeds `maxpause`, a new transaction is started. Option C is incorrect because the `by` clause is not mandatory; without it, the command groups all events into a single transaction, which can be useful in certain scenarios.

Options A and B are incorrect as originally stated.

Exam trap

A common misconception is that the `by` clause is mandatory for the `transaction` command. However, it is optional; omitting it groups all events into one transaction. Another misconception is that `startswith` operates on field values, when it operates on raw event text.

Additionally, `transaction` outputs one event per transaction, not per input event.

Full explanation →
411
MCQeasy

In the CIM, which field is commonly used to identify the user responsible for an authentication event?

A.dest
B.user
C.src_user
D.src
AnswerB

The user field is standard in CIM Authentication data model.

Why this answer

In the CIM Authentication data model, the standard field for identifying the user responsible for an authentication event is 'user'. This field contains the username of the account involved. Option B (user) is correct.

Option A (dest) typically refers to the destination endpoint. Option C (src_user) is not a standard field in the CIM Authentication data model; the source user is usually captured in the 'user' field. Option D (src) refers to the source IP address.

Full explanation →
412
MCQmedium

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

A.`append [search sourcetype=app_log]` then sort by session_id
B.`transaction session_id maxspan=30m`
C.`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`
D.`join type=inner session_id [search sourcetype=app_log]` after a search on web_access
AnswerB

Transaction groups events by session_id within 30 minutes, fulfilling both requirements.

Why this answer

The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. However, `transaction` does not automatically require events from both sourcetypes; grouping is based solely on the session_id field. To ensure each transaction contains at least one event from both `web_access` and `app_log`, you would need to add a subsequent filter, such as `| where mvcount(sourcetype) > 1`.

Nevertheless, option B is the correct construct because it groups events by session_id within the time window, and the additional requirement can be applied afterward. The other options fail to enforce the 30-minute window or the presence of both sourcetypes.

Exam trap

Splunk often tests the distinction between `transaction` and `stats` or `join`; the trap here is that candidates mistakenly think `stats` can group events with time constraints, but `stats` lacks the ability to enforce a `maxspan` or require events from multiple sourcetypes within the same group.

How to eliminate wrong answers

Option A is wrong because `append` simply adds results from a second search to the main results without any grouping or correlation logic; it does not group events by session_id or enforce a 30-minute span. Option C is wrong because `stats values(*) as * by session` aggregates all fields into multivalue lists but does not enforce a time window or require that each group contains events from both sourcetypes; it also renames fields in a way that loses sourcetype context. Option D is wrong because `join type=inner` on `session_id` performs a field-based join that requires exact matches on the session_id field, but it does not impose a 30-minute time constraint and does not group events into a single transaction; it merely pairs matching events row-by-row.

Full explanation →
413
MCQmedium

A Splunk admin is tasked with creating a dashboard that shows the average response time per server over the last hour, updated every 60 seconds. The data comes from a sourcetype 'app_log' with fields: server, response_time. The admin wants to use a single search with a timechart and set the dashboard's time range picker to 'Last 60 minutes'. However, the chart shows only one data point (the average for the entire hour) instead of per-minute intervals. What is the most likely cause and solution?

A.The dashboard uses a summary index; switch to a base search
B.The search is not set to real-time; change to a real-time search
C.The dashboard time range picker is set to 'All time'; change to 'Last 60 minutes'
D.The timechart command does not have a span specified; add | timechart span=1m avg(response_time) by server
AnswerD

Specifying span=1m creates per-minute buckets.

Why this answer

The `timechart` command without an explicit `span` defaults to a single bucket for the entire search time range when the range is fixed (e.g., 'Last 60 minutes'). By adding `span=1m`, you force the command to create 1-minute buckets, producing a data point per minute. This is the most direct fix for the described behavior.

Exam trap

Splunk often tests the default behavior of `timechart` without a `span`, tricking candidates into thinking the issue is with the time range picker or search mode rather than the missing span parameter.

How to eliminate wrong answers

Option A is wrong because a summary index would not cause a single data point; summary indexes store pre-aggregated data, but the issue here is the lack of a span in the timechart, not the data source. Option B is wrong because a real-time search is not required; the dashboard already updates every 60 seconds via the refresh setting, and the time range 'Last 60 minutes' is a fixed window, not real-time. Option C is wrong because the question explicitly states the dashboard's time range picker is set to 'Last 60 minutes', so changing it to the same value would have no effect.

Full explanation →
414
MCQmedium

Which of the following searches correctly computes the average response time per host?

A.index=main | stats mean(response_time) by host
B.index=main | stats average(response_time) by host
C.index=main | eventstats avg(response_time) by host
D.index=main | stats avg response_time by host
AnswerA

`mean()` is an alias for `avg()` and correctly computes the average per host.

Why this answer

The `stats` command with `mean(response_time)` calculates the arithmetic mean of the response_time field, and the `by host` clause groups the calculation per host, producing the average response time for each host. This is the standard Splunk syntax for computing averages in a grouped statistics table.

Exam trap

The trap here is that candidates may confuse `eventstats` with `stats` or use incorrect function names like `average`, leading them to choose options that either do not produce a summary table or use invalid Splunk syntax.

How to eliminate wrong answers

Option B is wrong because `average` is not a valid stats function in Splunk; the correct function name is `avg` or `mean`. Option C is wrong because `eventstats` adds the computed value as a new field to each event rather than producing a summary table, so it does not return a distinct list of hosts with their average response times. Option D is wrong because the syntax `stats avg response_time by host` is missing parentheses around the field name; Splunk requires `avg(response_time)` to correctly parse the function argument.

Full explanation →
415
MCQeasy

A security team needs to group login events for the same user within a 5-minute window. Which transaction option should be used to limit the time between consecutive events?

A.maxspan
B.maxpause
C.startswith
D.endswith
AnswerB

maxpause limits the idle time between events in a transaction.

Why this answer

(maxpause) is correct because maxpause limits the maximum time between consecutive events in a transaction. Option A (maxspan) limits the total duration of the transaction from first to last event. Option C (startswith) defines a condition to start a transaction.

Option D (endswith) defines a condition to end a transaction.

Full explanation →
416
MCQhard

A large lookup file with 10 million rows is used in a search that joins with main index data. The search is slow. Which optimization should be applied first?

A.Use 'lookup local=true' to reduce time.
B.Add a filter on the lookup using a subsearch.
C.Convert the lookup to a KV store collection.
D.Use 'inputlookup' instead of 'lookup'.
AnswerC

KV store is optimized for large datasets and lookups.

Why this answer

Converting a large lookup to a KV store collection significantly improves performance by enabling indexed lookups, reducing the time needed for join operations. Option A is incorrect because 'lookup local=true' only controls where the lookup file is searched (local versus peers), not its performance. Option B is incorrect because adding a filter using a subsearch adds overhead and is not an optimization; it can make the search slower.

Option D is incorrect because 'inputlookup' loads the entire lookup into memory, which for 10 million rows would be slow and memory-intensive, not a performance improvement.

Full explanation →
417
MCQeasy

A developer wants to debug a slow Splunk search that uses multiple eval and where commands. The search returns correct results but takes 2 minutes. The developer wants to identify which parts of the search are slow. The environment is a single instance Splunk with moderate data. What should the developer do?

A.Manually check the search in the Job Manager after it completes.
B.Limit the time range to 1 minute and run the search.
C.Run the search with the 'search job inspector' option enabled.
D.Add comments to the search to track progress.
AnswerC

Provides per-command timing information.

Why this answer

The Search Job Inspector provides detailed per-command execution statistics, including time spent, number of results, and memory usage for each pipe segment. This allows the developer to pinpoint exactly which `eval` or `where` command is causing the slowdown, without altering the search logic or time range.

Exam trap

The trap here is that candidates confuse the Job Manager (which shows high-level job status) with the Search Job Inspector (which provides granular per-command profiling), or mistakenly believe that reducing the time range or adding comments will help identify performance bottlenecks.

How to eliminate wrong answers

Option A is wrong because the Job Manager only shows overall job metadata (e.g., total run time, result count, disk usage) and does not break down performance per search command. Option B is wrong because limiting the time range to 1 minute changes the dataset size and may mask the actual slow command; it also does not provide per-command timing. Option D is wrong because comments are ignored by the search parser and have no effect on performance measurement; they do not generate any timing or profiling data.

Full explanation →
418
MCQmedium

Refer to the exhibit. Which statement about this search is true?

A.It fails because iplocation requires a lookup table to be defined.
B.It uses iplocation to add geographical information about the destination IP.
C.It only includes events where src_ip is a valid IP address.
D.It adds geographical info based on src_ip and then aggregates bytes by dest_ip and country.
AnswerD

Correct interpretation of the search

Why this answer

The search uses `iplocation` to add geographical fields (like Country, City) based on the `src_ip` field, then renames `src_ip` to `src` and uses `stats` to aggregate bytes by `dest_ip` and the newly added `Country` field. This matches option D exactly.

Exam trap

The trap here is that candidates often confuse which IP address (source vs. destination) is being geolocated, or assume `iplocation` filters out invalid IPs, when in fact it only enriches events without removing any.

How to eliminate wrong answers

Option A is wrong because `iplocation` does not require a predefined lookup table; it uses a built-in MaxMind GeoIP database. Option B is wrong because the search applies `iplocation` to `src_ip`, not the destination IP (`dest_ip`). Option C is wrong because `iplocation` does not filter events; it only adds geographical fields to events that have a valid IP in `src_ip`, but events with invalid IPs are not excluded from the search results.

Full explanation →
419
Multi-Selecthard

Which TWO of the following are valid reasons to use transaction instead of stats for event correlation?

Select 2 answers
A.When you need to preserve the full events for each group.
B.When working with very large datasets.
C.When you need to enforce a time window between events.
D.When you need faster search performance.
E.When events come from different sourcetypes.
AnswersA, C

transaction returns all original events within each group.

Why this answer

Options A and C are correct. The transaction command is used when you need to preserve the full events for each group (A), which stats does not do (it produces statistical results). Additionally, transaction allows you to enforce a time window between events, such as maxspan or maxpause (C).

Option B is false because stats is more efficient for very large datasets; transaction can be resource-intensive. Option D is false because stats typically provides faster performance due to lower overhead. Option E is false because both commands can handle events from multiple sourcetypes; that is not a distinguishing factor.

Full explanation →
420
MCQhard

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

A.One transaction with 5 events, avg duration ~50s
B.One transaction with 5 events, avg duration ~10s
C.Multiple transactions, each with fewer events, avg duration less than 10s
D.No transactions created because events are out of order
AnswerC

Correct. Events are split into multiple transactions because the random timestamps are spread beyond 10 seconds. Each transaction has fewer events and average duration less than 10s.

Why this answer

The search uses `transaction` with `maxspan=10s`. The random timestamps are spread over up to 100 seconds, so events that are more than 10 seconds apart cannot be in the same transaction. Thus, the events will be split into multiple transactions, each containing a subset of the events.

The average duration of these transactions will be well under 10 seconds, making option C correct. Option A is incorrect because not all 5 events can fit into one 10-second window. Option B is incorrect for the same reason.

Option D is incorrect because transactions are still created for events that do fall within a 10-second window.

Exam trap

Candidates often assume that `maxspan` prevents transactions entirely, but it actually splits events into multiple transactions.

Full explanation →
421
Multi-Selecteasy

Which TWO of the following commands can be used to find the most frequent value of a field within each group?

Select 2 answers
A.stats mode(field) by group
B.stats list(field) by group | eval top = mvindex('list', 0)
C.streamstats mode(field) by group
D.stats values(field) by group
E.eventstats mode(field) by group
AnswersA, E

stats mode returns the mode for each group.

Why this answer

`stats mode(field) by group` directly computes the most frequent value (mode) of the specified field for each group defined by the `by` clause. The `mode()` function is specifically designed to return the value that appears most often, making it the simplest and most accurate command for this task.

Exam trap

The trap here is that candidates often confuse `list()` or `values()` with `mode()`, or incorrectly think `streamstats` can replace `stats` for grouped final aggregation, when `streamstats` is designed for cumulative calculations across events, not per-group final results.

Full explanation →
422
Multi-Selectmedium

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Select 2 answers
A.stats
B.timechart
C.eventstats
D.timewrap
E.appendcols
AnswersB, D

Generates time-series data

Why this answer

B is correct because `timechart` is the primary command for creating time-series aggregations, allowing you to split data into time buckets and apply statistical functions. D is correct because `timewrap` is specifically designed to compare time periods (e.g., current week vs. previous week) by wrapping the time-series data into separate series for each period, enabling side-by-side visualization.

Exam trap

Splunk often tests the misconception that `stats` or `eventstats` can replace `timechart` for time-based comparisons, but only `timechart` provides the necessary time-bucketing, and `timewrap` is the dedicated command for period-over-period wrapping.

Full explanation →
423
MCQmedium

An analyst notices that a timechart command with 'by host' shows only 10 hosts even though there are 50 distinct hosts. What could be the reason?

A.The visualization is set to 'Pie' which only shows top 10.
B.The search is using 'join' to combine data.
C.The 'useother' parameter is set to false.
D.The 'limit' parameter is set to 10 by default.
AnswerD

timechart by default shows only the top 10 series unless limit is explicitly set higher or to 0.

Why this answer

By default, the `timechart` command sets the `limit` parameter to 10, which limits the number of series (columns) displayed to the top 10 by count. Even though there are 50 distinct hosts, only the top 10 will appear. Option A is incorrect because the visualization type (Pie) does not change the number of series shown by `timechart`; the limit is set in the `timechart` command itself.

Option B is incorrect because `join` is not related to limiting the number of hosts. Option C is incorrect because the `useother` parameter, when set to `false`, suppresses the 'OTHER' series but does not change how many top series are shown — that is still controlled by `limit` (default 10). The default for `useother` is `true`, so the absence of an 'OTHER' series alone might suggest a non‑default setting, but the underlying reason only 10 hosts appear is the `limit` value.

Full explanation →
424
MCQmedium

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

A.`index=main | stats count by $1$, $2$`
B.`index=main | | stats count by user, action`
C.`index=main | mysearch(user, action)`
D.`index=main | stats count by user, action`
AnswerD

Correct. The macro expansion correctly substitutes `user` for $1$ and `action` for $2$, yielding `stats count by user, action`.

Why this answer

The macro invocation `| `mysearch(user, action)` expands by replacing `$1$` with `user` and `$2$` with `action` in the definition `stats count by $1$, $2$`, resulting in `| stats count by user, action`. Option A incorrectly leaves the placeholders unreplaced. Option B has an extra pipe symbol, which would cause a syntax error.

Option C does not expand the macro; it just references the macro name literally.

Full explanation →
425
MCQmedium

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

A.Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.
B.Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.
C.Increase maxspan to 24h to capture all potential purchases.
D.Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.
AnswerA

Correct: stats list maintains event order per session and naturally handles multiple purchases and any time span.

Why this answer

Using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of the transaction command. Option B (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window. Option C (increase maxspan to 24h) would still break on multiple purchases and increase memory usage.

Option D (group by user_id) loses session distinction and may merge separate sessions.

Full explanation →
426
MCQhard

An organization has implemented the Splunk Common Information Model (CIM) for their security data. They have mapped several sourcetypes to the Authentication data model and enabled data model acceleration. However, the CIM dashboard shows no data even though searches against the raw data return results. The admin checks the data model acceleration settings and sees that the acceleration is enabled and has completed building. What is the most likely issue?

A.The field extractions for the sourcetypes do not align with CIM field names.
B.The index where the data is stored is not included in the data model acceleration.
C.The data model has not been assigned the correct permissions.
D.The tags for the sourcetypes are not correctly assigned to the data model.
AnswerA

Correct: Mismatched field names cause the data model to remain empty.

Why this answer

The Splunk Common Information Model (CIM) relies on field name alignment between the data and the CIM data model. If the field extractions for the sourcetypes do not produce the exact field names expected by the Authentication data model (e.g., 'user', 'action', 'src_ip'), the data model will not populate. Option B is incorrect because data model acceleration includes all indexes by default unless explicitly excluded.

Option C is incorrect because permissions affect who can see the data model, not whether it populates with data. Option D is incorrect because tags are optional when sourcetypes are mapped directly via props.conf; CIM data models can use sourcetype mapping without tags.

Full explanation →
427
MCQmedium

A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?

A.Specify exact field names instead of wildcards
B.Use `transaction *id, nullif=null`
C.Increase maxopentxn in limits.conf
D.Replace transaction with stats
AnswerA

Transaction matches fields exactly; wildcards slow down because Splunk must evaluate multiple fields.

Why this answer

Using specific field names instead of wildcards reduces the overhead of matching multiple fields, improving transaction performance. Option B is invalid syntax; `nullif` is not a transaction option here. Option C increases limits but does not address the root cause of wildcard inefficiency.

Option D changes the approach to `stats`, which may not preserve transaction boundaries.

Full explanation →
428
MCQmedium

Refer to the exhibit. A user runs this search expecting to see the top 5 departments by count, but the results show all departments. What is the error?

A.The limit parameter in top should be written before the field name
B.The sort command should be placed before stats
C.The inputlookup should be used with a subsearch
D.The top command already calculates a count, so stats is unnecessary and can cause conflict
AnswerD

Using both may result in showing all departments because top may operate on the stats output incorrectly.

Why this answer

The top command already calculates a count and sorts, so using stats before top is redundant and can cause unexpected results. The correct approach is to use 'top limit=5 department' directly on the inputlookup without stats.

Full explanation →
429
MCQhard

A search needs to find events where the same user logged in from more than 3 different IP addresses within a 5-minute window. Which combination of commands is most efficient?

A.`| streamstats count by user src_ip | where count > 3`
B.`| timechart span=5m limit=0 values(src_ip) by user | eval count=mvcount(values(src_ip)) | where count > 3`
C.`| stats count by user, src_ip | where count > 3`
D.`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`
AnswerD

Efficiently groups events by user within a 5-minute window and then counts distinct IP addresses.

Why this answer

The `transaction` command groups events by `user` within a 5-minute window (`maxspan=5m`), then `eval distinct_ip=mvcount(src_ip)` counts the unique IP addresses in that transaction. This directly answers the requirement of finding users who logged in from more than 3 different IPs within a 5-minute window, and it is efficient because `transaction` handles the time-bounded grouping natively without needing to pre-aggregate or use subsearches.

Exam trap

The trap here is that candidates often choose `streamstats` or `stats` because they are familiar with counting, but they fail to realize that those commands count events per user+IP pair rather than distinct IPs per user within a time window, which is the core requirement.

How to eliminate wrong answers

Option A is wrong because `streamstats` with `count by user src_ip` counts occurrences of each user+src_ip pair, not distinct IPs per user; it would require a user to have more than 3 events from the same IP, which is not the requirement. Option B is wrong because `timechart` with `values(src_ip) by user` creates a time-based chart that can miss events if the time range is not perfectly aligned to 5-minute buckets, and it is less efficient due to the need to generate a table and then evaluate `mvcount`. Option C is wrong because `stats count by user, src_ip` counts events per user+IP pair, not distinct IPs per user within a time window; it would require a user to have more than 3 events from the same IP, and it ignores the 5-minute window entirely.

Full explanation →
430
MCQhard

A macro is defined as `mysearch` with definition `index=main | stats count by $source_type$`. The macro is invoked as `| `mysearch(access_combined)` but the search never finishes. What is the likely issue?

A.The macro definition contains a syntax error
B.The macro argument should not be in quotes
C.The macro definition uses a named argument but the invocation passes an unnamed argument
D.The macro definition requires a filter before the stats command
AnswerC

Correct: Named arguments require name=value syntax.

Why this answer

The macro definition uses `$source_type$` which is a named argument. In the invocation `| `mysearch(access_combined)``, the argument is passed positionally without the argument name. For named arguments, the invocation must specify the argument name, like `source_type=access_combined`.

This mismatch causes the macro to treat `$source_type$` as a literal string instead of substituting the passed value, leading to the search never finishing because it's probably looking for a field that doesn't exist. Option B is incorrect because the quotes are not the issue; the problem is the positional vs. named argument mismatch. Option A is incorrect because there is no syntax error in the definition.

Option D is incorrect because a filter is not required before stats.

Full explanation →
431
Drag & Dropmedium

Order the steps to set up a data input for monitoring a log file in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Adding a file monitor involves selecting the input type, specifying the file, and configuring source type and index.

Full explanation →
432
MCQhard

An admin creates a dashboard with a timechart panel that drills down to a search for that time range. The drilldown search works but does not include the time range. What is the likely cause?

A.The drilldown is set to 'search' without including tokens for time.
B.The timechart uses a fixed time range in the search string.
C.The dashboard's time input is disabled.
D.The drilldown is configured to use 'range' token but the panel's time range is not passed.
AnswerA

If the drilldown is a static search (no tokens), it does not inherit the time range from the dashboard panel.

Why this answer

When a drilldown is configured as a simple search without tokens to pass the time range, the time range from the panel is not inherited. The drilldown performs a search using the default time range (e.g., All time) instead of the panel's time range. To include the time range, tokens like $earliest$ and $latest$ must be added to the drilldown search string.

Options B, C, and D are incorrect: B would maintain the time if fixed, C affects the dashboard overall but not necessarily the panel's drilldown, and D would actually pass the time range correctly.

Full explanation →
433
MCQeasy

A search uses transaction to group login and logout events. What happens if a user has multiple logins before logging out?

A.The search will fail due to overlapping transactions.
B.The transaction will include the first login and all events until the first logout.
C.It will create multiple transactions for each login.
D.It will ignore the first login and start at the last login.
AnswerB

startswith begins at the first match, ends at first endswith after that.

Why this answer

The transaction command with startswith/endswith groups events from the first occurrence of the start condition to the first occurrence of the end condition. If a user logs in multiple times before logging out, the transaction will include only the first login event and all subsequent events (including subsequent logins) until the first logout event. Subsequent login events are included in the same transaction but do not start new transactions.

Therefore, the correct answer is B. Option A is incorrect because the search does not fail; it simply groups events as described. Option C is incorrect because only one transaction is created for that user, not multiple.

Option D is incorrect because the first login is not ignored; it is the start of the transaction.

Full explanation →
434
MCQhard

A team uses a lookup to enrich web logs with customer region. The lookup is file-based and updated daily. Some events are not being enriched even though the lookup file has matching keys. What could be the issue?

A.The lookup file exceeds the maximum size.
B.The lookup file is not sorted.
C.The lookup definition uses the wrong timestamp format.
D.The lookup file has leading or trailing spaces in key fields.
AnswerD

Extra spaces prevent exact matches; stripping spaces is recommended.

Why this answer

Leading or trailing spaces in the lookup file's key field or the search event's field will cause matching to fail silently. Splunk requires exact string matches for lookups, so extra spaces prevent the lookup key from being found. Option A (maximum file size) is incorrect because exceeding maximum size would typically cause an error or truncated results, not a silent failure of matching.

Option B (file not sorted) is incorrect because file-based lookups do not require sorting; sorting is only needed for time-based lookups or certain efficient memory modes but not for basic matching. Option C (wrong timestamp format) is irrelevant because this lookup is for region enrichment based on a key field, not a time-based lookup.

Full explanation →
435
MCQhard

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

A.The engineer lacks permissions to read the lookup.
B.The lookup file is not in the correct directory.
C.The lookup file has a .csv extension but contains other data.
D.The lookup definition name does not match the filename.
AnswerD

The engineer used the filename, but `inputlookup` expects the lookup definition name.

Why this answer

The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Exam trap

The trap here is that candidates assume `inputlookup` uses the filename directly, but Splunk requires the lookup definition name, which may differ from the filename.

How to eliminate wrong answers

Option A is wrong because the engineer is running the command from a search head and the lookup file is in the app's lookups directory, which is accessible by default to users with appropriate roles; permission issues would typically produce an error message, not an empty result. Option B is wrong because the file is explicitly stated to exist in $SPLUNK_HOME/etc/apps/search/lookups/, which is the correct directory for app-level lookups. Option C is wrong because a CSV file containing non-CSV data would cause parsing errors or malformed results, not a silent empty result set.

Full explanation →
436
Multi-Selectmedium

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Select 2 answers
A.mvcount
B.maxspan
C.maxpause
D.keepevicted
E.maxevents
AnswersB, E

Indirectly limits events by time.

Why this answer

maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Full explanation →
437
MCQmedium

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

A.The search fails with an error
B.No fields are added
C.city and country are set to empty strings
D.city and country are set to 'NotFound'
AnswerD

default_match defines the fallback value for unmatched fields.

Why this answer

The lookup definition in the exhibit sets `default_match='NotFound'`, and `OUTPUTNEW` adds fields only if they are not already present. When no match occurs, the default values 'NotFound' are used for both `city` and `country`. Option A is incorrect because the search does not fail; it continues with the default values.

Option B is incorrect because fields are still added with default values. Option C is incorrect because the default_match overrides any default empty string behavior.

Full explanation →
438
Multi-Selecteasy

Which TWO of the following are limitations of the transaction command in Splunk?

Select 2 answers
A.It cannot be used inside an eval statement.
B.It only works with indexed fields.
C.It defaults to a maximum of 1000 events per transaction.
D.It cannot correlate events from multiple sourcetypes.
E.It can consume significant memory and processing resources.
AnswersC, E

The default maxevents is 1000.

Why this answer

The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.

Exam trap

The trap here is that candidates often assume the transaction command can only use indexed fields or cannot cross sourcetypes, but Splunk's transaction command is flexible with any search-time field and can correlate across multiple sourcetypes, making options B and D common distractors.

Full explanation →
439
MCQmedium

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

A.The lookup file must be uploaded via the UI instead of placed manually
B.The search head must be configured as a lookup server
C.A lookup definition must be added to transforms.conf
D.The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory
AnswerC

The lookup definition tells Splunk how to use the file.

Why this answer

When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Exam trap

Splunk often tests the misconception that simply placing a lookup file in the correct directory is enough, when in fact the transforms.conf definition is the critical missing piece that registers the lookup for use.

How to eliminate wrong answers

Option A is wrong because uploading via the UI is not mandatory; placing the lookup file manually in the correct directory is acceptable as long as the transforms.conf definition exists. Option B is wrong because the search head does not need to be configured as a lookup server; lookups are resolved locally on the search head or via distributed lookup configuration, not by designating the search head as a server. Option D is wrong because the default lookup directory is $SPLUNK_HOME/etc/system/lookups, but placing the file there alone is insufficient without the corresponding transforms.conf entry to define the lookup.

Full explanation →
440
MCQmedium

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

A.File-based CSV lookup
B.External lookup
C.KV Store lookup
D.Geospatial lookup
AnswerA

CSV lookups are loaded into memory and fast for moderate sizes.

Why this answer

A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Exam trap

The trap here is that candidates often choose KV Store lookup (Option C) because it supports dynamic updates, but they overlook that for small, frequently reloaded static datasets, a file-based CSV lookup is faster due to its in-memory caching and lack of network dependency.

How to eliminate wrong answers

Option B is wrong because an external lookup requires a network call to an external script or API, which introduces latency and is slower than a local in-memory lookup. Option C is wrong because a KV Store lookup, while dynamic, uses a key-value store that requires network I/O to the KV Store service, adding overhead compared to a local CSV file. Option D is wrong because a geospatial lookup is designed for geographic coordinates and spatial queries, not for correlating IP addresses with a simple list of known malicious IPs.

Full explanation →
441
MCQhard

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

A.Use the append command to combine the two event types after separate searches.
B.Add maxevents=1000 to the transaction command to limit event count.
C.Increase maxpause to 10 minutes to allow more events per transaction.
D.Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.
AnswerD

Using stats with values and where reduces memory overhead and improves performance.

Why this answer

Using stats and where is more efficient than transaction. Transaction holds all events in memory until the transaction is closed, which is memory-intensive when dealing with many events like 500 servers. The stats command can group events by src_ip, then the where command can filter for pairs of EventCode 4625 and 4624 within the same group.

This approach leverages streaming capabilities and reduces memory overhead. Option A is incorrect because the append command does not correlate events by source IP; it merely concatenates results from two separate searches. Option B is incorrect because adding maxevents=1000 (already default) limits the number of events per transaction but does not address the underlying memory consumption issue of transaction.

Option C is incorrect because increasing maxpause to 10 minutes would allow more events per transaction, making the search even slower and more prone to timeout.

Full explanation →
442
MCQhard

A team wants to correlate events from different sourcetypes (web, db) on a common `sessionid`. They use `transaction sessionid` across both sourcetypes. The results show that some transactions are missing events. What is the most likely cause?

A.The search is running at 'info' level instead of 'verbose'
B.Timestamps from different sourcetypes are misaligned
C.maxevents is set too low
D.sessionid field has different names in each sourcetype
AnswerB

Correct. When sourcetypes have different timestamp formats or time zones, events may be incorrectly ordered or fall outside the default transaction window, causing some events to be missing from the transaction.

Why this answer

Sourcetypes may have different timestamp formats or time zones, causing events to be incorrectly sorted out of the transaction window. Option C (maxevents) would truncate but not miss events. Option D (field name) is unlikely.

Option A (search time level) is not relevant.

Full explanation →
443
MCQhard

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

A.Increase maxevents to 200 and increase search timeout
B.Remove maxpause and set maxspan to 60m
C.Reduce maxevents to 10 to limit resource usage
D.Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately
AnswerD

Using stats is more memory-efficient and does not have maxevents limits; it can aggregate all events per order without eviction, and performance improves because it avoids the overhead of tracking open transactions.

Why this answer

The `transaction` command is resource-intensive and can cause timeouts and missing data when `maxevents` is exceeded. Increasing `maxevents` (A) would worsen performance. Removing `maxpause` and increasing `maxspan` (B) does not address the `maxevents` limit and may keep transactions open longer.

Reducing `maxevents` (C) would exacerbate missing orders. Replacing `transaction` with `stats ... list() by order_id` groups fields without holding open transactions, avoiding the `maxevents` constraint and reducing resource usage, thus addressing both missing orders and performance issues.

Full explanation →
444
MCQmedium

A search is producing results that include both internal and external traffic. The analyst wants to approximate the number of distinct destination IPs for internal traffic only, where internal IPs fall within the 10.0.0.0/8 range. Which approach is most efficient?

A.Use | search src_ip=10.* | stats dc(dest_ip)
B.Use | rex field=src_ip to extract first octet and then filter
C.Use | eval internal=if(cidrmatch("10.0.0.0/8", src_ip),1,0) | stats dc(dest_ip) by internal
D.Use | where cidrmatch("10.0.0.0/8", src_ip) | stats dc(dest_ip)
AnswerD

Efficient subnet matching with cidrmatch

Why this answer

It uses `where cidrmatch("10.0.0.0/8", src_ip)` to efficiently filter events to only those with source IPs in the 10.0.0.0/8 range before passing them to `stats dc(dest_ip)`. This approach leverages Splunk's built-in CIDR matching function, which performs a bitwise comparison on the IP address, and applies the filter early in the pipeline, reducing the dataset for the distinct count operation. It is the most efficient as it avoids unnecessary evaluations or string operations on non-matching events.

Exam trap

The trap here is that candidates often choose Option C because they think `eval` with `by` is equivalent to filtering, but they overlook that it processes all events and computes an unnecessary group for external traffic, making it less efficient than a simple `where` filter.

How to eliminate wrong answers

Option A is wrong because `src_ip=10.*` uses a wildcard string match, which is inefficient and can match IPs like 10.0.0.1 but also incorrectly match IPs like 100.0.0.1 or 10.0.0.256 (if present), and it does not respect the subnet mask of /8; it also does not filter out external traffic before the stats command. Option B is wrong because using `rex` to extract the first octet and then filtering requires an extra parsing step and still only checks the first octet (e.g., 10.x.x.x), which does not guarantee the IP is within the 10.0.0.0/8 range (e.g., 10.255.255.255 is valid, but a simple first-octet check would also include 10.0.0.0/8 correctly, but it is less efficient and more error-prone than CIDR matching). Option C is wrong because while it uses `cidrmatch` correctly, it creates a field `internal` for every event and then uses `stats dc(dest_ip) by internal`, which computes distinct counts for both internal=1 and internal=0, wasting resources on external traffic; the analyst only wants internal traffic, so filtering with `where` is more efficient than grouping and discarding the external group.

Full explanation →
445
MCQeasy

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

A.The sourcetype filter is excluding some events.
B.The stats command is not correctly summing the counts.
C.The maxspan is too short to capture all events for each clientip.
D.The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.
AnswerD

maxevents=5 limits the number of events per transaction, causing fragmentation.

Why this answer

The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Exam trap

The trap here is that candidates often assume `maxevents` only limits the number of events per transaction but forget that exceeding this limit causes the creation of additional transactions for the same grouping field, leading to duplicate identifiers in aggregated output.

How to eliminate wrong answers

Option A is wrong because the sourcetype filter is not excluding events; the search returns results, so all relevant events are present. Option B is wrong because the `stats` command correctly sums counts; the issue is that multiple transactions are created for the same `clientip`, not a miscalculation. Option C is wrong because the `maxspan` is not mentioned in the search; the problem is caused by `maxevents=5`, not by a time-based constraint.

Full explanation →
446
MCQmedium

An IT administrator notices that a lookup table used to enrich firewall logs is not updating correctly. The lookup file is stored in $SPLUNK_HOME/etc/apps/search/lookups/. What is the most likely cause if the lookup is defined as a 'file-based lookup' with automatic lookup?

A.The lookup file is too large (over 100 MB)
B.The lookup is not referenced in any search
C.The lookup filename contains a space character
D.The lookup file permissions are set to read-only
AnswerC

Spaces in lookup filenames are not supported by Splunk.

Why this answer

Splunk does not support spaces in lookup filenames. A space in the filename causes the lookup to fail. Option C is correct.

Full explanation →
447
MCQhard

A search analyst wants to calculate the average transaction time for each user and then find users whose average transaction time exceeds the overall average. Which approach is most efficient?

A.Use eventstats to add overall average, then stats by user, then where condition
B.Use stats by user to get avg, then appendpipe to add overall avg, then eval
C.Use transaction to group events, then stats
D.Use stats by user, then eventstats to add overall avg, then where
AnswerD

Efficient: stats reduces data, eventstats adds overall average.

Why this answer

It first uses `stats by user` to compute per-user average transaction times, then uses `eventstats` to append the overall average across all users to each row, allowing a direct `where` comparison. This approach is efficient because `eventstats` adds the global aggregate without requiring a separate subsearch or additional data pass, minimizing resource usage.

Exam trap

Splunk often tests the distinction between `eventstats` and `appendpipe`, where candidates mistakenly choose `appendpipe` thinking it adds a global aggregate, but it actually runs a subsearch that is less efficient and can produce incorrect results if not used carefully.

How to eliminate wrong answers

Option A is wrong because using `eventstats` before `stats by user` would compute the overall average on raw events, not on per-user averages, leading to an incorrect comparison. Option B is wrong because `appendpipe` runs a subsearch that re-scans the entire dataset, which is inefficient and redundant compared to using `eventstats` in a single pass. Option C is wrong because `transaction` is designed to group events into transactions based on session IDs or time windows, not to compute per-user averages efficiently, and it consumes significant memory and processing overhead.

Full explanation →
448
MCQmedium

A search using `tstats` to query a data model returns results but is slow. Which of the following is the most likely cause?

A.The data model contains too many fields.
B.The data model is not accelerated.
C.The search includes a `where` clause on a non-indexed field.
D.The search uses `from` instead of `index`.
AnswerB

Without acceleration, tstats runs against the raw data and can be slow.

Why this answer

When a data model is accelerated, Splink pre-computes and stores summaries of the data in a TSIDX index, allowing `tstats` to query these summaries very quickly. If the data model is not accelerated, `tstats` must scan the raw data in the index, which is significantly slower. Therefore, the most likely cause of slow `tstats` performance is that the data model lacks acceleration.

Exam trap

Splunk often tests the misconception that `tstats` always uses acceleration or that a `where` clause on a non-indexed field is the primary cause of slowness, when in fact the absence of acceleration is the most common and impactful reason for poor `tstats` performance.

How to eliminate wrong answers

Option A is wrong because a data model with many fields can slow down acceleration or search, but `tstats` queries the accelerated summary (TSIDX) which is optimized for many fields; the primary performance bottleneck is the lack of acceleration, not field count. Option C is wrong because a `where` clause on a non-indexed field would not affect `tstats` performance when querying an accelerated data model, as `tstats` operates on the TSIDX index where all fields are indexed; the slowness is due to the absence of acceleration, not the `where` clause. Option D is wrong because `tstats` can use either `from` (to reference a data model) or `index` (to reference a raw index), and using `from` is the correct syntax for querying a data model; the slowness is not caused by using `from` but by the data model not being accelerated.

Full explanation →
449
Multi-Selectmedium

Which TWO best practices should be followed when creating saved searches that use macros? (Select exactly 2.)

Select 2 answers
A.Define macros globally so they are accessible by all saved searches.
B.Use static time ranges in macros to avoid unexpected time shifts.
C.Escape special characters in macro arguments to ensure correct parsing.
D.Include inline comments in macro definitions to document the logic.
E.Avoid using subsearches inside macros to prevent performance issues.
AnswersC, E

Unescaped special characters can alter the search syntax unexpectedly.

Why this answer

Options C and E are correct. For option C, escaping special characters in macro arguments is essential to prevent parsing errors when the macro is expanded. For option E, avoiding subsearches inside macros is a best practice because subsearches can significantly impact performance, especially when the macro is used in multiple saved searches.

Option A is not a best practice; defining macros globally can lead to namespace conflicts and it's often better to scope macros to a specific app. Option B is not recommended because static time ranges in macros limit flexibility; it's better to pass time range as an argument. Option D is not a best practice because inline comments in macro definitions can cause issues if not properly escaped and can make the macro definition harder to maintain.

Full explanation →
450
MCQmedium

A search includes `... | eval day=strftime(_time, "%A") | stats count by day | sort count`. The results show Monday has the highest count. The analyst wants to confirm that the timezone is correctly applied. Which command should be added before the eval to ensure the day calculation uses the local timezone?

A.`... | eval day=strptime(_time, "%A") | ...`
B.`... | fields + _time, day | ...`
C.`... | eval _time=_time + (your_tz_offset*3600) | eval day=strftime(_time, "%A") ...`
D.`... | convert ctime(_time) | eval day=strftime(_time, "%A") ...`
E.`... | eval _time=relative_time(_time, "-0@d") | eval day=strftime(_time, "%A") ...`
AnswerC

Correct: adjusting _time by timezone offset before extracting day.

Why this answer

The `strftime` function uses the server's timezone by default, which may not match the local timezone. By manually adding the timezone offset (in seconds) to `_time` before the `eval`, you shift the epoch timestamp to reflect the local time, ensuring that `strftime` calculates the correct day of the week. This is a common workaround when the search head's timezone differs from the user's local timezone.

Exam trap

Splunk often tests the misconception that `strftime` automatically respects the user's local timezone, when in fact it uses the search head's timezone setting, requiring manual offset adjustment for accurate local-time calculations.

How to eliminate wrong answers

Option A is wrong because `strptime` is used to parse a string into an epoch timestamp, not to format a timestamp into a day name; using it here would cause an error or incorrect results. Option B is wrong because `fields + _time, day` only retains those fields and does not adjust the timezone; it does not affect how `strftime` interprets the timestamp. Option D is wrong because `convert ctime(_time)` converts the epoch timestamp to a human-readable string (ctime format), but does not change the underlying timezone applied by `strftime`; it would break the subsequent `strftime` call.

Option E is wrong because `relative_time(_time, "-0@d")` truncates the timestamp to the start of the current day (midnight) without any timezone offset, so it does not correct for timezone differences and may shift the day incorrectly.

Full explanation →
Page 5

Page 6 of 7

Page 7

All pages

1234567

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Advanced Searching and StatisticsMacros, Saved Searches and CIMAdvanced Visualization and LookupsTransactions and Event Correlation
See all domains with question counts →