Courseiva

Splunk Core Certified Power User SPLK-1003 (SPLK-1002) — Questions 451–475

475 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 7

451
Multi-Selectmedium

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Select 3 answers
A.... | join type=inner [search index=other]
B.... | map search="search index=other $field$"
C.[return index=main | stats count]
D.[search index=main | stats count]
E.... | append [search index=other]
AnswersB, D, E

map runs a search for each result, effectively a subsearch.

Why this answer

The `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Exam trap

Splunk often tests the distinction between commands that use subsearches (like `append`, `join`, `map`) versus commands that are not valid subsearch syntax (like `return`), and candidates may mistakenly think `return` is a valid subsearch command because it sounds similar to `search` or `output`.

Full explanation →
452
MCQmedium

A user runs a search that returns 1,000,000 results but only sees 5,000 in the Statistics tab. What is the most likely cause?

A.The results are being sampled
B.The stats command is being used without a by clause
C.The time range is too narrow
D.The search command truncates results
AnswerB

Without by, stats collapses all events into one row per function.

Why this answer

The stats command without a 'by' clause aggregates all events into a single row (or by whatever field specified). If no 'by' clause, it returns one row per aggregation, so a small number of rows. Option A is wrong because the search command truncates at 50,000 results by default.

Option C is wrong because time range narrowness would reduce raw events, but here stats shows few rows. Option D is wrong because sampling is not a default behavior.

Full explanation →
453
Multi-Selectmedium

Which TWO of the following are valid ways to correlate events without using the transaction command?

Select 2 answers
A.Using append to combine events from two searches
B.Using join to merge events on transactionID
C.Using sort to order events by transactionID
D.Using eventstats to compute counts per transactionID
E.Using stats ... by transactionID
AnswersD, E

eventstats adds aggregate values to each event, linking them.

Why this answer

Options D and E are correct. Using stats ... by transactionID groups events by a common field and computes aggregate values, effectively correlating events. Using eventstats to compute counts per transactionID adds a calculated aggregate to each event, correlating events with the same transactionID.

Both are valid correlation methods without using the transaction command. Options A and B (append and join) combine results from separate searches but do not correlate events in the same sense, and sort (C) merely orders events.

Full explanation →
454
MCQeasy

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

A.CSV lookup
B.KV Store lookup
C.Time-based lookup
D.External lookup
AnswerC

Time-based lookups are designed for temporal matching.

Why this answer

Time-based lookups use event time to match against time ranges in the lookup table.

Full explanation →
455
Multi-Selecteasy

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Select 2 answers
A.Time-based lookup
B.File lookup
C.CSV lookup
D.External lookup
E.KV Store lookup
AnswersA, E

Time-based lookups are designed for matching against time ranges.

Why this answer

Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Exam trap

The trap here is that candidates often assume all lookup types support time-based matching, but only Time-based and KV Store lookups have native automatic time-based matching capabilities, while file, CSV, and external lookups require manual time filtering.

Full explanation →
456
Multi-Selecthard

Which TWO are correct about saved search permissions and scheduling? (Choose two.)

Select 2 answers
A.A saved search's permissions can be set to 'global' so that any user can run it.
B.Any user can schedule a saved search regardless of role.
C.A saved search that is a report automatically inherits the app's default permissions.
D.When a saved search is scheduled, it runs with the permissions of the owner, not the user who views it.
E.All saved searches are visible to everyone in the app by default.
AnswersA, D

Global permission grants read access to all users.

Why this answer

Options A and D are correct. A saved search's permissions can be set to 'global' so any user can run it. When a saved search is scheduled, it runs with the permissions of the owner, not the user who views it.

Option B is wrong because scheduling a saved search requires the 'schedule_search' capability, which not all users have. Option C is wrong because saved searches inherit permissions from the user who created them, not the app's default. Option E is wrong because saved searches are private to the owner by default.

Full explanation →
457
MCQhard

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

A.`... | stats dc(user) by _time span=1h`
B.`... | timechart span=1h dc(by user)`
C.`... | timechart span=1h dc(user)`
D.`... | eval user=user | timechart span=1h count by user`
E.`... | timechart span=1h sum(count) by user`
AnswerC

Correct: timechart with distinct count of user per hour.

Why this answer

`timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Exam trap

The trap here is that candidates often confuse `dc(user)` (distinct count of users) with `count by user` (count of events per user), leading them to pick option D or E, which answer a different question.

How to eliminate wrong answers

Option A is wrong because `stats dc(user) by _time span=1h` does not use `timechart`, so it will not produce a timechart visualization; it returns a table of distinct user counts per time bucket but lacks the timechart formatting and binning behavior. Option B is wrong because `dc(by user)` is invalid syntax; `dc()` takes a single field argument, not a `by` clause. Option D is wrong because `eval user=user` is redundant and `timechart span=1h count by user` computes the count of events per user, not the distinct count of users.

Option E is wrong because `sum(count) by user` sums the 'count' field per user, which gives total login counts per user, not the number of distinct users.

Full explanation →
458
MCQeasy

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

A.eval domain=mvindex(split(email,"@"),1)
B.eval domain=mvindex(split(email,"@"),0)
C.eval domain=replace(email,".*@(.*)","\1")
D.eval domain=substr(email, indexof(email,"@")+1)
AnswerA

Splits on '@' and takes the second part (index 1) which is the domain.

Why this answer

`split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Exam trap

The trap here is that candidates often confuse the zero-based index of `mvindex` (thinking index 1 is the username) or incorrectly assume `replace` with a regex is the most straightforward approach, when in fact `split` with `mvindex` is the simplest and most reliable method for this exact pattern.

How to eliminate wrong answers

Option B is wrong because `mvindex(...,0)` extracts the username (the part before `@`), not the domain. Option C is wrong because `replace(email,".*@(.*)","\1")` uses a regex that is greedy and may not correctly capture the domain in all cases (e.g., if the email contains multiple `@` symbols or special characters), and `replace` is not the idiomatic Splunk function for this extraction. Option D is wrong because `substr(email, indexof(email,"@")+1)` would extract everything after the `@`, including any trailing whitespace or newline characters, and does not handle cases where the `@` is missing (returns an empty string or error).

Full explanation →
459
MCQhard

Where must the file 'departments.csv' be placed for this lookup definition to work?

A.In any directory under $SPLUNK_HOME.
B.In the $SPLUNK_HOME/etc/apps/search/lookups directory.
C.In the $SPLUNK_HOME/etc/system/lookups directory.
D.In the lookups directory of the same app where the transforms.conf is defined.
AnswerD

Splunk resolves relative filenames within the app's lookups directory.

Why this answer

The filename is relative; Splunk looks for it in the lookups directory of the app where the transforms.conf is defined. Therefore, option D is correct because the file 'departments.csv' must be placed in the lookups directory of the same app where the lookup definition (transforms.conf) resides. Option A is incorrect because $SPLUNK_HOME contains many directories, not specifically lookups.

Option B is incorrect because while the search app's lookups directory could work if transforms.conf is in that app, the definition is not necessarily in the search app. Option C is incorrect because $SPLUNK_HOME/etc/system/lookups is a system-wide lookup directory, but for app-specific definitions, it should be in the app's lookups directory.

Full explanation →
460
Multi-Selectmedium

Which TWO of the following are valid ways to calculate the median of a numeric field?

Select 2 answers
A.eval median = percentile(field, 50)
B.eventstats median(field)
C.stats perc(field, 50)
D.stats p50(field)
E.stats median(field)
AnswersD, E

Correct. `stats p50(field)` is a valid alias for `stats perc50(field)` and calculates the 50th percentile, which is the median.

Why this answer

Options B, D, and E are all valid ways to calculate the median. Option B uses `eventstats median(field)` which adds the median as a new field to each event. Option D uses `stats p50(field)` which is a valid alias for `perc50` and computes the 50th percentile (median).

Option E uses `stats median(field)` directly. Options A and C are invalid because `eval` cannot use `percentile` directly and `perc` is not a valid function.

Exam trap

Splunk often tests the distinction between `eval` and `stats` functions, and candidates mistakenly use `eval` with aggregation functions like `percentile` or confuse the syntax for percentile commands (e.g., `perc`, `p50`) with the correct `perc50` or `percentile` syntax.

Full explanation →
461
MCQmedium

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

A.Use `| top limit=100 user` to get the top 100 users.
B.Add `| where count > 100` after the stats command.
C.Add `| where count > 100` before the stats command.
D.Use `| filter count > 100` after the stats command.
AnswerB

Correctly filters the stats results by the count field.

Why this answer

The `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Exam trap

Splunk often tests the distinction between filtering before aggregation (using `search` or `where` on raw events) versus filtering after aggregation (using `where` on computed fields), and candidates mistakenly place the filter before `stats` or use a nonexistent command like `filter`.

How to eliminate wrong answers

Option A is wrong because `| top limit=100 user` returns the top 100 users by count, not users with a count greater than 100; it does not apply a threshold filter. Option C is wrong because placing `| where count > 100` before the stats command would attempt to filter on a field `count` that does not yet exist, causing an error or no results. Option D is wrong because `filter` is not a valid Splunk command; the correct command for filtering results is `where`, not `filter`.

Full explanation →
462
Drag & Dropmedium

Arrange the steps to configure a lookup table file in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Full explanation →
463
MCQmedium

A company needs to enrich events with lookup data that changes over time, such as daily exchange rates. Which lookup method is most appropriate?

A.Use a KV Store lookup with a time-range filter in the search
B.Use a file lookup without time context
C.Use a time-based lookup with a time_field parameter
D.Use an index-time lookup
AnswerC

Time-based lookups use the event's _time to select the appropriate row, perfect for time-varying reference data.

Why this answer

A time-based lookup with a time_field parameter allows the lookup to return different values based on the event timestamp. Option A is incorrect because a KV Store lookup is not time-aware by default and would require additional logic. Option B is incorrect because a file lookup without time context cannot handle time-varying data.

Option D is incorrect because index-time lookups are static and require reindexing to reflect changes.

Full explanation →
464
MCQeasy

An analyst runs `sourcetype=access_combined | transaction clientip` and notices many single-event transactions. Which option would help close transactions more accurately?

A.Add `endswith="status=200"`
B.Increase maxpause to 1 hour
C.Do nothing; single events are fine
D.Set closedelay=10
AnswerA

endswith ensures transaction closes when a logout or end event occurs.

Why this answer

Adding `endswith` helps define when a transaction should close, reducing false single-event transactions (e.g., 200 status often indicates end). Option B (maxpause) might help but not as targeted. Option C (closedelay) is not valid.

Option D (null) is not helpful.

Full explanation →
465
MCQmedium

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

A.Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.
B.Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.
C.Limit the time range to the last 1 hour instead of 24 hours.
D.Enable search acceleration for the index.
AnswerB

Reduces the amount of data scanned in real time.

Why this answer

Creating a summary index that pre-aggregates error counts by severity every 5 minutes reduces the amount of data scanned in real-time, improving performance without changing the dashboard's output. Option A is wrong because using 'bucket' and 'stats' with streaming commands still requires scanning all raw events; it does not precompute results and may not significantly reduce I/O. Option C is wrong because limiting the time range alters the dashboard's displayed data (e.g., less historical context), which violates the requirement to keep the output unchanged.

Option D is wrong because search acceleration (e.g., data model acceleration) creates summaries for specific data models, not arbitrary field aggregations; it may not target the 'severity' breakdown efficiently and can consume significant resources.

Full explanation →
466
MCQeasy

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

A.timechart span=5min count
B.chart count over _time span=5min
C.stats count by _time span=5min
D.streamstats count span=5min
AnswerA

`timechart` with `span=5min` correctly creates a time series of event counts per 5-minute bucket.

Why this answer

The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Exam trap

Splunk often tests the misconception that `stats` or `chart` can be used with a `span` parameter to create time-based buckets, when in fact only `timechart` (and `bucket` in conjunction with `stats`) supports this syntax for time aggregation.

How to eliminate wrong answers

Option B is wrong because `chart count over _time span=5min` is not valid syntax; `chart` does not support the `span` option and requires a `by` clause to split data, making it unable to produce time-based buckets. Option C is wrong because `stats count by _time span=5min` is invalid; `stats` does not accept a `span` keyword, and grouping by raw `_time` would create a separate count for each unique timestamp, not aggregated intervals. Option D is wrong because `streamstats count span=5min` is invalid; `streamstats` computes running or sliding window statistics and does not support a `span` parameter, nor does it bin events into time intervals.

Full explanation →
467
MCQhard

You are a Splunk consultant for a financial services firm. They have a large lookup table containing customer account numbers and risk scores. This lookup is used in a critical compliance search that runs every hour. The search is failing with a memory error 'The search coordinator stopped the search due to memory usage'. You have already tried increasing the memory limit for the search via limits.conf, but the error persists. The lookup file is a CSV file of 2GB, with approximately 20 million rows. The search is: index=compliance sourcetype=transactions | lookup risk_scores.csv account_id OUTPUT risk_score | stats avg(risk_score) by transaction_type. The search runs on a single search head with 16GB RAM. The lookup is defined as static. What is the most effective optimization to resolve the memory error?

A.Use 'inputlookup' with a 'where' clause to filter the lookup to only relevant account IDs before joining.
B.Split the lookup into multiple smaller files and use multiple lookups in the search.
C.Convert the lookup to a KV store collection and use the 'kv' command in the search.
D.Use 'lookup local=false' in the search to distribute the lookup to indexers.
AnswerC

KV store uses memory-mapped files and is efficient for large lookups.

Why this answer

Converting the static CSV lookup to a KV store collection allows the lookup data to be stored in memory as a key-value store, which is optimized for high-performance lookups and can handle large datasets more efficiently than loading the entire CSV into memory. The KV store uses indexing and can serve lookups without loading the whole file, resolving the memory error. Option A is wrong because using 'inputlookup' with a 'where' clause still loads the entire CSV into memory before filtering, so the memory error persists.

Option B is wrong because splitting the lookup into multiple files does not reduce the total memory required; the search still needs to load all files. Option D is wrong because 'lookup local=false' distributes the lookup to indexers, but the indexers would still need to load the CSV into memory, and the search head coordinates the search, which may still cause memory issues. Converting to KV store is the most effective optimization for this scenario.

Full explanation →
468
MCQmedium

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

A.Add `| where method="GET"` before stats.
B.Replace `stats` with `chart count over uri by method`.
C.Use `top limit=5 uri, method` instead.
D.Add `| stats sum(count) as total by uri` after the existing stats.
E.Change `stats count by uri, method` to `stats count by uri`.
AnswerE

Correct: grouping only by uri gives count per URI.

Why this answer

The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Exam trap

Splunk often tests the distinction between grouping by multiple fields versus a single field, and the trap here is that candidates may think they need an additional stats command (Option D) or a filter (Option A) when simply removing the extra field from the `by` clause is the correct and efficient fix.

How to eliminate wrong answers

Option A is wrong because adding `| where method="GET"` would filter to only GET requests, which does not aggregate across all methods and still groups by URI and method if the stats clause remains unchanged. Option B is wrong because `chart count over uri by method` creates a tabular breakdown of counts per method for each URI, not a single count per URI, and still separates by method. Option C is wrong because `top limit=5 uri, method` returns the top 5 URI-method combinations by count, which is exactly what the original search does, not the top 5 URIs overall.

Option D is wrong because adding `| stats sum(count) as total by uri` after the existing stats would sum the counts for each URI, but the preceding stats already produced separate rows per combination; this would work only if the first stats output is properly structured, but it is an unnecessary extra step when simply removing `method` from the first stats is cleaner and more direct.

Full explanation →
469
MCQhard

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

A.The maxpause value is too high.
B.Events from the two sourcetypes are not in chronological order.
C.The fields option is missing.
D.The startswith and endswith patterns are too broad.
AnswerB

Events must be sorted by time; if sourcetypes have different timestamps, transaction may fail to correlate.

Why this answer

The most likely cause is that events from the two sourcetypes are not in chronological order. The transaction command, by default, requires events to be processed in time order, and if events from different sourcetypes are interleaved or out of sequence, the transaction may fail to match a complete sequence. Option A is incorrect because a high maxpause would make the transaction more likely to match, not less.

Option C is incorrect because the fields option is not required for the transaction to work; it is used to identify the transaction. Option D is incorrect because overly broad patterns would cause too many matches, not too few.

Full explanation →
470
MCQmedium

A user wants to create a report that shows the top 5 sources of errors, excluding a specific source 'host1'. Which SPL is correct?

A.index=main sourcetype=access_combined status>400 NOT host="host1" | top limit=5 source
B.index=main sourcetype=access_combined status>400 | top limit=5 source | where source!="host1"
C.index=main sourcetype=access_combined status>400 | top limit=5 source | search source!="host1"
D.index=main sourcetype=access_combined status>400 | search NOT host=host1 | top limit=5 source
AnswerA

Correctly excludes host1 before top, ensuring accurate top 5.

Why this answer

It filters out 'host1' before the `top` command runs, ensuring that the top 5 sources of errors are calculated from the remaining data. The `NOT host="host1"` clause is placed in the base search, which is the most efficient approach and guarantees that 'host1' is excluded from the statistical aggregation.

Exam trap

Splunk often tests the misconception that filtering after a transforming command like `top` is equivalent to filtering before it, when in reality the aggregation is performed on the entire dataset first, altering the results.

How to eliminate wrong answers

Option B is wrong because the `where` command is applied after `top`, which means the top 5 sources are computed including 'host1', and then 'host1' is removed from the result set; this could leave fewer than 5 results and does not exclude 'host1' from the ranking calculation. Option C is wrong because the `search` command after `top` also filters after the aggregation, suffering from the same issue as Option B, and additionally `search source!="host1"` incorrectly uses the field `source` instead of `host` to filter the host. Option D is wrong because the `search NOT host=host1` is placed after the base search but before `top`, which would work logically, but the syntax is incorrect: `search NOT host=host1` is not valid SPL (the correct syntax is `NOT host="host1"` or `host!="host1"`), and the command is redundant since the base search already has the same filter; however, the primary flaw is that the `search` command is unnecessary and the syntax error makes it invalid.

Full explanation →
471
MCQmedium

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

A.maxspan
B.maxpause
C.mvcount
D.maxevents
AnswerD

Correct: maxevents caps the number of events per transaction.

Why this answer

Maxevents limits the number of events in a transaction. Option A (maxspan) limits the maximum time span of the transaction. Option B (maxpause) limits the maximum pause between events.

Option C (mvcount) is used to count multivalue fields, not to limit event count.

Full explanation →
472
Multi-Selectmedium

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Select 3 answers
A.The original number of events is preserved.
B.It uses less memory than stats.
C.You can use the aggregated field in subsequent commands like where or eval.
D.It is always faster than stats.
E.It allows you to see individual event details alongside aggregate statistics.
AnswersA, C, E

eventstats does not reduce event count.

Why this answer

`eventstats` adds aggregate statistics (like sums or averages) to each original event without reducing the total number of events. Unlike `stats`, which collapses events into a single summary row per group, `eventstats` appends the aggregated value to every matching event, preserving the original event count and structure.

Exam trap

The trap here is that candidates confuse `eventstats` with `stats`, assuming `eventstats` is always faster or more memory-efficient, when in fact it trades off performance and memory for the ability to retain original event context.

Full explanation →
473
MCQhard

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

A.The macro argument should be passed without the `field=` prefix
B.The macro definition contains unescaped commas
C.The macro definition should use positional arguments instead of named
D.The macro definition should include a pipe before `eval`
AnswerB

Correct: Commas in the `if` function must be escaped.

Why this answer

In macro definitions, commas that are part of the code need to be escaped with a backslash because commas are used to separate macro arguments. The `if` function in the macro definition uses commas, and they are not escaped, so the macro expansion is broken. Option A is incorrect; the invocation with `field=` is a valid way to pass named arguments.

Option C is incorrect; named arguments are allowed and not the issue. Option D is incorrect; a leading pipe is not needed inside the macro definition because the invocation already provides a pipe before the macro name.

Full explanation →
474
MCQhard

You are a Splunk administrator for a multi-site deployment with two data centers: primary and remote. Users on the remote site report that a lookup used in a dashboard returns no results for data from their site, but the same lookup works perfectly on the primary site. The lookup is defined with 'local=true' in the transforms.conf. The lookup file is stored on the primary search head. The remote site has its own search head that queries data from both sites. The dashboard search is: index=main | lookup site_mapping.csv site_id OUTPUT location | stats count by location. Users on the remote site see rows with location=null for their data. What is the most likely cause?

A.The lookup is configured to only run on the search head that indexes the data, which is the primary site.
B.The lookup definition needs 'local=false' to be available to remote search heads for distributed searches.
C.The lookup file is not replicated to the remote search head, so it cannot be accessed when local=true.
D.The remote site has a firewall blocking access to the lookup file on the primary search head.
AnswerC

local=true means file must be on the search head running the search.

Why this answer

When 'local=true' is set in transforms.conf, the lookup is only available on the search head where the lookup file resides. Since the remote search head does not have the file, the lookup fails for data processed there, resulting in null values. Option A is incorrect because the lookup is not tied to indexers but to the search head that executes the search.

Option B is incorrect because while 'local=false' would make the lookup available across search heads, the issue is that the current setting prevents access from the remote search head. Option D is incorrect because a firewall blocking access would likely cause a timeout or error, not null values, and would not be specific to a single lookup.

Full explanation →
475
MCQmedium

To find users who logged in from more than 3 different IP addresses, which search is correct?

A.index=auth | stats dc(IP) by user | where dc(IP) > 3
B.index=auth | top limit=3 IP by user
C.index=auth | eval user, IP | dedup user, IP | stats count by user | where count > 3
D.index=auth | stats distinct_count(IP) by user | where distinct_count(IP) > 3
AnswerA

dc counts distinct IPs per user, then filters.

Why this answer

It uses `stats dc(IP) by user` to count distinct IP addresses per user, then filters with `where dc(IP) > 3` to return only users who logged in from more than 3 different IPs. The `dc()` function calculates distinct count, which is exactly what the question requires.

Exam trap

Splunk often tests the distinction between `dc()` (distinct count) and `count` (total occurrences), and the trap here is that candidates may confuse `distinct_count()` (invalid) with `dc()` or think `dedup` followed by `count` achieves the same result, which it does not because it counts duplicates of the pair rather than distinct IPs per user.

How to eliminate wrong answers

Option B is wrong because `top limit=3 IP by user` returns the top 3 IP addresses per user, not a count of distinct IPs, and cannot filter for users with more than 3 distinct IPs. Option C is wrong because `eval user, IP` is invalid syntax (eval requires an expression), and `dedup user, IP` removes duplicate pairs but does not count distinct IPs per user correctly; the subsequent `stats count` counts occurrences, not distinct IPs. Option D is wrong because `distinct_count(IP)` is not a valid SPL function; the correct function is `dc(IP)`, and this search would produce an error.

Full explanation →
Page 6

Page 7 of 7

All pages

1234567

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Advanced Searching and StatisticsMacros, Saved Searches and CIMAdvanced Visualization and LookupsTransactions and Event Correlation
See all domains with question counts →