Splunk Core Certified Power User SPLK-1003 SPLK-1003 Questions 451–500 | Page 7/7

451

MCQmedium

A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?

A.Specify exact field names instead of wildcards

B.Use `transaction *id, nullif=null`

C.Increase maxopentxn in limits.conf

D.Replace transaction with stats

AnswerA

Transaction matches fields exactly; wildcards slow down because Splunk must evaluate multiple fields.

Why this answer

Option C is correct because using specific field names improves performance by avoiding wildcard matching. Option A (increase limits) doesn't address wildcard inefficiency. Option B (use stats) might help but changes approach.

Option D (regex) is not a transaction option.

Full explanation →

452

MCQmedium

Refer to the exhibit. A user runs this search expecting to see the top 5 departments by count, but the results show all departments. What is the error?

A.The limit parameter in top should be written before the field name

B.The sort command should be placed before stats

C.The inputlookup should be used with a subsearch

D.The top command already calculates a count, so stats is unnecessary and can cause conflict

AnswerD

Using both may result in showing all departments because top may operate on the stats output incorrectly.

Why this answer

The top command already calculates a count and sorts, so using stats before top is redundant and can cause unexpected results. The correct approach is to use 'top limit=5 department' directly on the inputlookup without stats.

Full explanation →

453

MCQhard

A search needs to find events where the same user logged in from more than 3 different IP addresses within a 5-minute window. Which combination of commands is most efficient?

A.`| streamstats count by user src_ip | where count > 3`

B.`| timechart span=5m limit=0 values(src_ip) by user | eval count=mvcount(values(src_ip)) | where count > 3`

C.`| stats count by user, src_ip | where count > 3`

D.`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`

AnswerD

Efficiently groups events by user within a 5-minute window and then counts distinct IP addresses.

Why this answer

Option D is correct because the `transaction` command groups events by `user` within a 5-minute window (`maxspan=5m`), then `eval distinct_ip=mvcount(src_ip)` counts the unique IP addresses in that transaction. This directly answers the requirement of finding users who logged in from more than 3 different IPs within a 5-minute window, and it is efficient because `transaction` handles the time-bounded grouping natively without needing to pre-aggregate or use subsearches.

Exam trap

The trap here is that candidates often choose `streamstats` or `stats` because they are familiar with counting, but they fail to realize that those commands count events per user+IP pair rather than distinct IPs per user within a time window, which is the core requirement.

How to eliminate wrong answers

Option A is wrong because `streamstats` with `count by user src_ip` counts occurrences of each user+src_ip pair, not distinct IPs per user; it would require a user to have more than 3 events from the same IP, which is not the requirement. Option B is wrong because `timechart` with `values(src_ip) by user` creates a time-based chart that can miss events if the time range is not perfectly aligned to 5-minute buckets, and it is less efficient due to the need to generate a table and then evaluate `mvcount`. Option C is wrong because `stats count by user, src_ip` counts events per user+IP pair, not distinct IPs per user within a time window; it would require a user to have more than 3 events from the same IP, and it ignores the 5-minute window entirely.

Full explanation →

454

MCQhard

A macro is defined as `mysearch` with definition `index=main | stats count by $source_type$`. The macro is invoked as `| `mysearch(access_combined)` but the search never finishes. What is the likely issue?

A.The macro definition contains a syntax error

B.The macro argument should not be in quotes

C.The macro definition uses a named argument but the invocation passes an unnamed argument

D.The macro definition requires a filter before the stats command

AnswerC

Correct: Named arguments require name=value syntax.

Why this answer

Option B is correct: The definition uses `$source_type$` which is a named argument. In the invocation, the argument is passed positionally. For named arguments, the invocation must specify the argument name, like `source_type=access_combined`.

The positional argument `$1$` would work if defined. So the macro tries to use literal `$source_type$` instead of the passed value. A and C are not likely, D is possible but less specific.

Full explanation →

455

Drag & Dropmedium

Order the steps to set up a data input for monitoring a log file in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Adding a file monitor involves selecting the input type, specifying the file, and configuring source type and index.

Full explanation →

456

MCQhard

An admin creates a dashboard with a timechart panel that drills down to a search for that time range. The drilldown search works but does not include the time range. What is the likely cause?

A.The drilldown is set to 'search' without including tokens for time.

B.The timechart uses a fixed time range in the search string.

C.The dashboard's time input is disabled.

D.The drilldown is configured to use 'range' token but the panel's time range is not passed.

AnswerA

If the drilldown is a static search (no tokens), it does not inherit the time range from the dashboard panel.

Why this answer

Option B is correct because the drilldown search configuration must include tokens to pass the time range; if set to a static search, time range is not inherited. Options A, C, D are possible but less common or specific.

Full explanation →

457

MCQeasy

A search uses transaction to group login and logout events. What happens if a user has multiple logins before logging out?

A.The search will fail due to overlapping transactions.

B.The transaction will include the first login and all events until the first logout.

C.It will create multiple transactions for each login.

D.It will ignore the first login and start at the last login.

AnswerB

startswith begins at the first match, ends at first endswith after that.

Why this answer

Option A is correct because transaction with startswith/endswith will group from the first start to the first end; subsequent start events are ignored if end is not reached. Option B is false because transaction does not create multiple groups. Option C is false because the first start is used.

Option D is false because maxpause may cause eviction but not necessarily.

Full explanation →

458

MCQhard

A team uses a lookup to enrich web logs with customer region. The lookup is file-based and updated daily. Some events are not being enriched even though the lookup file has matching keys. What could be the issue?

A.The lookup file exceeds the maximum size.

B.The lookup file is not sorted.

C.The lookup definition uses the wrong timestamp format.

D.The lookup file has leading or trailing spaces in key fields.

AnswerD

Extra spaces prevent exact matches; stripping spaces is recommended.

Why this answer

Option B is correct. Leading or trailing spaces in the lookup file or search field are a common cause of mismatches. Option A, file not sorted, is not required for lookups.

Option C, size limit, would cause an error or truncation, not silent failure. Option D, timestamp format, is irrelevant for non-time-based lookups.

Full explanation →

459

MCQhard

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

A.The engineer lacks permissions to read the lookup.

B.The lookup file is not in the correct directory.

C.The lookup file has a .csv extension but contains other data.

D.The lookup definition name does not match the filename.

AnswerD

The engineer used the filename, but `inputlookup` expects the lookup definition name.

Why this answer

The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Exam trap

The trap here is that candidates assume `inputlookup` uses the filename directly, but Splunk requires the lookup definition name, which may differ from the filename.

How to eliminate wrong answers

Option A is wrong because the engineer is running the command from a search head and the lookup file is in the app's lookups directory, which is accessible by default to users with appropriate roles; permission issues would typically produce an error message, not an empty result. Option B is wrong because the file is explicitly stated to exist in $SPLUNK_HOME/etc/apps/search/lookups/, which is the correct directory for app-level lookups. Option C is wrong because a CSV file containing non-CSV data would cause parsing errors or malformed results, not a silent empty result set.

Full explanation →

460

Multi-Selectmedium

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Select 2 answers

A.mvcount

B.maxspan

C.maxpause

D.keepevicted

E.maxevents

AnswersB, E

Indirectly limits events by time.

Why this answer

maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Full explanation →

461

MCQmedium

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

A.The search fails with an error

B.No fields are added

C.city and country are set to empty strings

D.city and country are set to 'NotFound'

AnswerD

default_match defines the fallback value for unmatched fields.

Why this answer

Option B is correct because default_match is set to 'NotFound', and OUTPUTNEW adds fields only if they are not already present. In case of no match, the default values 'NotFound' are used for city and country. Option A is incorrect because fields are still added with default values.

Option C is incorrect because default_match overrides null. Option D is incorrect because the search continues successfully.

Full explanation →

462

Multi-Selecteasy

Which TWO of the following are limitations of the transaction command in Splunk?

Select 2 answers

A.It cannot be used inside an eval statement.

B.It only works with indexed fields.

C.It defaults to a maximum of 1000 events per transaction.

D.It cannot correlate events from multiple sourcetypes.

E.It can consume significant memory and processing resources.

AnswersC, E

The default maxevents is 1000.

Why this answer

Option C is correct because the transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.

Exam trap

The trap here is that candidates often assume the transaction command can only use indexed fields or cannot cross sourcetypes, but Splunk's transaction command is flexible with any search-time field and can correlate across multiple sourcetypes, making options B and D common distractors.

Full explanation →

463

MCQmedium

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

A.The lookup file must be uploaded via the UI instead of placed manually

B.The search head must be configured as a lookup server

C.A lookup definition must be added to transforms.conf

D.The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory

AnswerC

The lookup definition tells Splunk how to use the file.

Why this answer

When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Exam trap

Splunk often tests the misconception that simply placing a lookup file in the correct directory is enough, when in fact the transforms.conf definition is the critical missing piece that registers the lookup for use.

How to eliminate wrong answers

Option A is wrong because uploading via the UI is not mandatory; placing the lookup file manually in the correct directory is acceptable as long as the transforms.conf definition exists. Option B is wrong because the search head does not need to be configured as a lookup server; lookups are resolved locally on the search head or via distributed lookup configuration, not by designating the search head as a server. Option D is wrong because the default lookup directory is $SPLUNK_HOME/etc/system/lookups, but placing the file there alone is insufficient without the corresponding transforms.conf entry to define the lookup.

Full explanation →

464

MCQmedium

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

A.File-based CSV lookup

B.External lookup

C.KV Store lookup

D.Geospatial lookup

AnswerA

CSV lookups are loaded into memory and fast for moderate sizes.

Why this answer

A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Exam trap

The trap here is that candidates often choose KV Store lookup (Option C) because it supports dynamic updates, but they overlook that for small, frequently reloaded static datasets, a file-based CSV lookup is faster due to its in-memory caching and lack of network dependency.

How to eliminate wrong answers

Option B is wrong because an external lookup requires a network call to an external script or API, which introduces latency and is slower than a local in-memory lookup. Option C is wrong because a KV Store lookup, while dynamic, uses a key-value store that requires network I/O to the KV Store service, adding overhead compared to a local CSV file. Option D is wrong because a geospatial lookup is designed for geographic coordinates and spatial queries, not for correlating IP addresses with a simple list of known malicious IPs.

Full explanation →

465

MCQhard

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

A.Use the append command to combine the two event types after separate searches.

B.Add maxevents=1000 to the transaction command to limit event count.

C.Increase maxpause to 10 minutes to allow more events per transaction.

D.Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.

AnswerD

Using stats with values and where reduces memory overhead and improves performance.

Why this answer

Option C is correct because using stats with values and filtering with where is less resource-intensive than transaction. Transaction holds all events in memory until the transaction closes, which is especially problematic with many events. Stats operates as a streaming command and uses less memory.

Option A is incorrect because increasing maxpause would allow more events per transaction, making performance worse. Option B is incorrect because append does not correlate events by source IP; it simply combines results. Option D is incorrect because the default maxevents is already 1000, and increasing it would not help if the transaction is timing out due to memory or time limits.

Full explanation →

466

MCQeasy

When using the transaction command to group events, which field is automatically added to the event to indicate the start time of the transaction?

A._time

B.duration

C.None, the transaction command does not add such a field.

D._starttime

AnswerD

Correct: transaction adds _starttime field.

Why this answer

Transaction adds _starttime, _endtime, duration, and eventcount fields. _starttime represents the timestamp of the first event in the transaction.

Full explanation →

467

MCQhard

A team wants to correlate events from different sourcetypes (web, db) on a common `sessionid`. They use `transaction sessionid` across both sourcetypes. The results show that some transactions are missing events. What is the most likely cause?

A.The search is running at 'info' level instead of 'verbose'

B.Timestamps from different sourcetypes are misaligned

C.maxevents is set too low

D.sessionid field has different names in each sourcetype

AnswerB

Transaction relies on _time; if timestamps are inconsistent, events fall outside the transaction window.

Why this answer

Option B is correct because sourcetypes may have different timestamp formats or time zones, causing events to be incorrectly sorted out of the transaction window. Option A (maxevents) would truncate but not miss events. Option C (field name) is unlikely.

Option D (search time level) is not relevant.

Full explanation →

468

MCQhard

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

A.Increase maxevents to 200 and increase search timeout

B.Remove maxpause and set maxspan to 60m

C.Reduce maxevents to 10 to limit resource usage

D.Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately

AnswerD

Using stats is more memory-efficient and does not have maxevents limits; it can aggregate all events per order without eviction, and performance improves because it avoids the overhead of tracking open transactions.

Why this answer

Option B is correct because reducing maxevents to a lower value (e.g., 10) will prematurely close transactions with excessive events, causing missing data. Option A (increasing maxevents) may worsen performance. Option C (removing maxpause) could cause transactions to stay open longer, not fix missing orders.

Option D (using stats) is a common recommendation to replace transaction with a more efficient approach; stats with list() can group fields without holding open transactions, improving performance and avoiding evictions. However, note that missing orders are due to maxevents being reached; stats would not have that limitation and is more efficient. But the question says 'best address missing orders and performance issues.' Option D (replace transaction with stats) is the best long-term solution.

Option A would still risk evictions if orders have more than 50 events, and it increases memory. Option B would worsen the problem. Option C doesn't address the root cause.

So D is correct.

Full explanation →

469

MCQmedium

A search is producing results that include both internal and external traffic. The analyst wants to approximate the number of distinct destination IPs for internal traffic only, where internal IPs fall within the 10.0.0.0/8 range. Which approach is most efficient?

A.Use | search src_ip=10.* | stats dc(dest_ip)

B.Use | rex field=src_ip to extract first octet and then filter

C.Use | eval internal=if(cidrmatch("10.0.0.0/8", src_ip),1,0) | stats dc(dest_ip) by internal

D.Use | where cidrmatch("10.0.0.0/8", src_ip) | stats dc(dest_ip)

AnswerD

Efficient subnet matching with cidrmatch

Why this answer

Option D is correct because it uses `where cidrmatch("10.0.0.0/8", src_ip)` to efficiently filter events to only those with source IPs in the 10.0.0.0/8 range before passing them to `stats dc(dest_ip)`. This approach leverages Splunk's built-in CIDR matching function, which performs a bitwise comparison on the IP address, and applies the filter early in the pipeline, reducing the dataset for the distinct count operation. It is the most efficient as it avoids unnecessary evaluations or string operations on non-matching events.

Exam trap

The trap here is that candidates often choose Option C because they think `eval` with `by` is equivalent to filtering, but they overlook that it processes all events and computes an unnecessary group for external traffic, making it less efficient than a simple `where` filter.

How to eliminate wrong answers

Option A is wrong because `src_ip=10.*` uses a wildcard string match, which is inefficient and can match IPs like 10.0.0.1 but also incorrectly match IPs like 100.0.0.1 or 10.0.0.256 (if present), and it does not respect the subnet mask of /8; it also does not filter out external traffic before the stats command. Option B is wrong because using `rex` to extract the first octet and then filtering requires an extra parsing step and still only checks the first octet (e.g., 10.x.x.x), which does not guarantee the IP is within the 10.0.0.0/8 range (e.g., 10.255.255.255 is valid, but a simple first-octet check would also include 10.0.0.0/8 correctly, but it is less efficient and more error-prone than CIDR matching). Option C is wrong because while it uses `cidrmatch` correctly, it creates a field `internal` for every event and then uses `stats dc(dest_ip) by internal`, which computes distinct counts for both internal=1 and internal=0, wasting resources on external traffic; the analyst only wants internal traffic, so filtering with `where` is more efficient than grouping and discarding the external group.

Full explanation →

470

MCQeasy

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

A.The sourcetype filter is excluding some events.

B.The stats command is not correctly summing the counts.

C.The maxspan is too short to capture all events for each clientip.

D.The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.

AnswerD

maxevents=5 limits the number of events per transaction, causing fragmentation.

Why this answer

Option D is correct because the `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Exam trap

The trap here is that candidates often assume `maxevents` only limits the number of events per transaction but forget that exceeding this limit causes the creation of additional transactions for the same grouping field, leading to duplicate identifiers in aggregated output.

How to eliminate wrong answers

Option A is wrong because the sourcetype filter is not excluding events; the search returns results, so all relevant events are present. Option B is wrong because the `stats` command correctly sums counts; the issue is that multiple transactions are created for the same `clientip`, not a miscalculation. Option C is wrong because the `maxspan` is not mentioned in the search; the problem is caused by `maxevents=5`, not by a time-based constraint.

Full explanation →

471

MCQmedium

An IT administrator notices that a lookup table used to enrich firewall logs is not updating correctly. The lookup file is stored in $SPLUNK_HOME/etc/apps/search/lookups/. What is the most likely cause if the lookup is defined as a 'file-based lookup' with automatic lookup?

A.The lookup file is too large (over 100 MB)

B.The lookup is not referenced in any search

C.The lookup filename contains a space character

D.The lookup file permissions are set to read-only

AnswerC

Spaces in lookup filenames are not supported by Splunk.

Why this answer

Splunk does not support spaces in lookup filenames. A space in the filename causes the lookup to fail. Option B is correct.

Full explanation →

472

MCQhard

A search analyst wants to calculate the average transaction time for each user and then find users whose average transaction time exceeds the overall average. Which approach is most efficient?

A.Use eventstats to add overall average, then stats by user, then where condition

B.Use stats by user to get avg, then appendpipe to add overall avg, then eval

C.Use transaction to group events, then stats

D.Use stats by user, then eventstats to add overall avg, then where

AnswerD

Efficient: stats reduces data, eventstats adds overall average.

Why this answer

Option D is correct because it first uses `stats by user` to compute per-user average transaction times, then uses `eventstats` to append the overall average across all users to each row, allowing a direct `where` comparison. This approach is efficient because `eventstats` adds the global aggregate without requiring a separate subsearch or additional data pass, minimizing resource usage.

Exam trap

Splunk often tests the distinction between `eventstats` and `appendpipe`, where candidates mistakenly choose `appendpipe` thinking it adds a global aggregate, but it actually runs a subsearch that is less efficient and can produce incorrect results if not used carefully.

How to eliminate wrong answers

Option A is wrong because using `eventstats` before `stats by user` would compute the overall average on raw events, not on per-user averages, leading to an incorrect comparison. Option B is wrong because `appendpipe` runs a subsearch that re-scans the entire dataset, which is inefficient and redundant compared to using `eventstats` in a single pass. Option C is wrong because `transaction` is designed to group events into transactions based on session IDs or time windows, not to compute per-user averages efficiently, and it consumes significant memory and processing overhead.

Full explanation →

473

MCQmedium

A search using `tstats` to query a data model returns results but is slow. Which of the following is the most likely cause?

A.The data model contains too many fields.

B.The data model is not accelerated.

C.The search includes a `where` clause on a non-indexed field.

D.The search uses `from` instead of `index`.

AnswerB

Without acceleration, tstats runs against the raw data and can be slow.

Why this answer

When a data model is accelerated, Splink pre-computes and stores summaries of the data in a TSIDX index, allowing `tstats` to query these summaries very quickly. If the data model is not accelerated, `tstats` must scan the raw data in the index, which is significantly slower. Therefore, the most likely cause of slow `tstats` performance is that the data model lacks acceleration.

Exam trap

Splunk often tests the misconception that `tstats` always uses acceleration or that a `where` clause on a non-indexed field is the primary cause of slowness, when in fact the absence of acceleration is the most common and impactful reason for poor `tstats` performance.

How to eliminate wrong answers

Option A is wrong because a data model with many fields can slow down acceleration or search, but `tstats` queries the accelerated summary (TSIDX) which is optimized for many fields; the primary performance bottleneck is the lack of acceleration, not field count. Option C is wrong because a `where` clause on a non-indexed field would not affect `tstats` performance when querying an accelerated data model, as `tstats` operates on the TSIDX index where all fields are indexed; the slowness is due to the absence of acceleration, not the `where` clause. Option D is wrong because `tstats` can use either `from` (to reference a data model) or `index` (to reference a raw index), and using `from` is the correct syntax for querying a data model; the slowness is not caused by using `from` but by the data model not being accelerated.

Full explanation →

474

Multi-Selectmedium

Which TWO best practices should be followed when creating saved searches that use macros? (Select exactly 2.)

Select 2 answers

A.Define macros globally so they are accessible by all saved searches.

B.Use static time ranges in macros to avoid unexpected time shifts.

C.Escape special characters in macro arguments to ensure correct parsing.

D.Include inline comments in macro definitions to document the logic.

E.Avoid using subsearches inside macros to prevent performance issues.

AnswersC, E

Unescaped special characters can alter the search syntax unexpectedly.

Why this answer

Options B and C are correct. Option A is not a best practice; comments inside macros can break if not properly escaped. Option D is not always necessary; scoping macros to an app can be appropriate.

Option E is not a best practice; it is better to pass time range as an argument.

Full explanation →

475

MCQmedium

A search includes `... | eval day=strftime(_time, "%A") | stats count by day | sort count`. The results show Monday has the highest count. The analyst wants to confirm that the timezone is correctly applied. Which command should be added before the eval to ensure the day calculation uses the local timezone?

A.`... | eval day=strptime(_time, "%A") | ...`

B.`... | fields + _time, day | ...`

C.`... | eval _time=_time + (your_tz_offset*3600) | eval day=strftime(_time, "%A") ...`

D.`... | convert ctime(_time) | eval day=strftime(_time, "%A") ...`

E.`... | eval _time=relative_time(_time, "-0@d") | eval day=strftime(_time, "%A") ...`

AnswerC

Correct: adjusting _time by timezone offset before extracting day.

Why this answer

Option C is correct because the `strftime` function uses the server's timezone by default, which may not match the local timezone. By manually adding the timezone offset (in seconds) to `_time` before the `eval`, you shift the epoch timestamp to reflect the local time, ensuring that `strftime` calculates the correct day of the week. This is a common workaround when the search head's timezone differs from the user's local timezone.

Exam trap

Splunk often tests the misconception that `strftime` automatically respects the user's local timezone, when in fact it uses the search head's timezone setting, requiring manual offset adjustment for accurate local-time calculations.

How to eliminate wrong answers

Option A is wrong because `strptime` is used to parse a string into an epoch timestamp, not to format a timestamp into a day name; using it here would cause an error or incorrect results. Option B is wrong because `fields + _time, day` only retains those fields and does not adjust the timezone; it does not affect how `strftime` interprets the timestamp. Option D is wrong because `convert ctime(_time)` converts the epoch timestamp to a human-readable string (ctime format), but does not change the underlying timezone applied by `strftime`; it would break the subsequent `strftime` call.

Option E is wrong because `relative_time(_time, "-0@d")` truncates the timestamp to the start of the current day (midnight) without any timezone offset, so it does not correct for timezone differences and may shift the day incorrectly.

Full explanation →

476

Multi-Selectmedium

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Select 3 answers

A.... | join type=inner [search index=other]

B.... | map search="search index=other $field$"

C.[return index=main | stats count]

D.[search index=main | stats count]

E.... | append [search index=other]

AnswersB, D, E

map runs a search for each result, effectively a subsearch.

Why this answer

Option B is correct because the `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Exam trap

Splunk often tests the distinction between commands that use subsearches (like `append`, `join`, `map`) versus commands that are not valid subsearch syntax (like `return`), and candidates may mistakenly think `return` is a valid subsearch command because it sounds similar to `search` or `output`.

Full explanation →

477

MCQmedium

A user runs a search that returns 1,000,000 results but only sees 5,000 in the Statistics tab. What is the most likely cause?

A.The results are being sampled

B.The stats command is being used without a by clause

C.The time range is too narrow

D.The search command truncates results

AnswerB

Without by, stats collapses all events into one row per function.

Why this answer

Option B is correct: the stats command without a 'by' clause aggregates all events into a single row (or by whatever field specified). If no 'by' clause, it returns one row per aggregation, so a small number of rows. Option A is wrong because the search command truncates at 50,000 results by default.

Option C is wrong because time range narrowness would reduce raw events, but here stats shows few rows. Option D is wrong because sampling is not a default behavior.

Full explanation →

478

Multi-Selectmedium

Which TWO of the following are valid ways to correlate events without using the transaction command?

Select 2 answers

A.Using append to combine events from two searches

B.Using join to merge events on transactionID

C.Using sort to order events by transactionID

D.Using eventstats to compute counts per transactionID

E.Using stats ... by transactionID

AnswersD, E

eventstats adds aggregate values to each event, linking them.

Why this answer

Options A and B are correct. stats can group events by common fields, and eventstats can add aggregated values per event. streamstats is also possible but not listed; join and append are not correlation methods.

Full explanation →

479

MCQeasy

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

A.CSV lookup

B.KV Store lookup

C.Time-based lookup

D.External lookup

AnswerC

Time-based lookups are designed for temporal matching.

Why this answer

Time-based lookups use event time to match against time ranges in the lookup table.

Full explanation →

480

Multi-Selecteasy

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Select 2 answers

A.Time-based lookup

B.File lookup

C.CSV lookup

D.External lookup

E.KV Store lookup

AnswersA, E

Time-based lookups are designed for matching against time ranges.

Why this answer

Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Exam trap

The trap here is that candidates often assume all lookup types support time-based matching, but only Time-based and KV Store lookups have native automatic time-based matching capabilities, while file, CSV, and external lookups require manual time filtering.

Full explanation →

481

Multi-Selecthard

Which TWO are correct about saved search permissions and scheduling? (Choose two.)

Select 2 answers

A.A saved search's permissions can be set to 'global' so that any user can run it.

B.Any user can schedule a saved search regardless of role.

C.A saved search that is a report automatically inherits the app's default permissions.

D.When a saved search is scheduled, it runs with the permissions of the owner, not the user who views it.

E.All saved searches are visible to everyone in the app by default.

AnswersA, D

Global permission grants read access to all users.

Why this answer

Options B and D are correct. Saved searches inherit owner permissions, and scheduling requires the 'schedule_search' capability. Option A is wrong because the default is 'private' for owner.

Option C is wrong because only users with schedule capability can set schedules. Option E is wrong because saving a report inherits the user's permissions, not app-wide.

Full explanation →

482

MCQhard

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

A.`... | stats dc(user) by _time span=1h`

B.`... | timechart span=1h dc(by user)`

C.`... | timechart span=1h dc(user)`

D.`... | eval user=user | timechart span=1h count by user`

E.`... | timechart span=1h sum(count) by user`

AnswerC

Correct: timechart with distinct count of user per hour.

Why this answer

Option C is correct because `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Exam trap

The trap here is that candidates often confuse `dc(user)` (distinct count of users) with `count by user` (count of events per user), leading them to pick option D or E, which answer a different question.

How to eliminate wrong answers

Option A is wrong because `stats dc(user) by _time span=1h` does not use `timechart`, so it will not produce a timechart visualization; it returns a table of distinct user counts per time bucket but lacks the timechart formatting and binning behavior. Option B is wrong because `dc(by user)` is invalid syntax; `dc()` takes a single field argument, not a `by` clause. Option D is wrong because `eval user=user` is redundant and `timechart span=1h count by user` computes the count of events per user, not the distinct count of users.

Option E is wrong because `sum(count) by user` sums the 'count' field per user, which gives total login counts per user, not the number of distinct users.

Full explanation →

483

MCQeasy

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

A.eval domain=mvindex(split(email,"@"),1)

B.eval domain=mvindex(split(email,"@"),0)

C.eval domain=replace(email,".*@(.*)","\1")

D.eval domain=substr(email, indexof(email,"@")+1)

AnswerA

Splits on '@' and takes the second part (index 1) which is the domain.

Why this answer

Option A is correct because `split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Exam trap

The trap here is that candidates often confuse the zero-based index of `mvindex` (thinking index 1 is the username) or incorrectly assume `replace` with a regex is the most straightforward approach, when in fact `split` with `mvindex` is the simplest and most reliable method for this exact pattern.

How to eliminate wrong answers

Option B is wrong because `mvindex(...,0)` extracts the username (the part before `@`), not the domain. Option C is wrong because `replace(email,".*@(.*)","\1")` uses a regex that is greedy and may not correctly capture the domain in all cases (e.g., if the email contains multiple `@` symbols or special characters), and `replace` is not the idiomatic Splunk function for this extraction. Option D is wrong because `substr(email, indexof(email,"@")+1)` would extract everything after the `@`, including any trailing whitespace or newline characters, and does not handle cases where the `@` is missing (returns an empty string or error).

Full explanation →

484

MCQhard

Where must the file 'departments.csv' be placed for this lookup definition to work?

A.In any directory under $SPLUNK_HOME.

B.In the $SPLUNK_HOME/etc/apps/search/lookups directory.

C.In the $SPLUNK_HOME/etc/system/lookups directory.

D.In the lookups directory of the same app where the transforms.conf is defined.

AnswerD

Splunk resolves relative filenames within the app's lookups directory.

Why this answer

Option C is correct. The filename is relative; Splunk looks for it in the lookups directory of the app where the transforms.conf is defined. Option A is not guaranteed; system lookups are global but not the default for app-specific definitions.

Option B could work if the definition is in the search app, but generally it follows the app context. Option D is incorrect as Splunk does not search all directories.

Full explanation →

485

Multi-Selectmedium

Which TWO of the following are valid ways to calculate the median of a numeric field?

Select 2 answers

A.eval median = percentile(field, 50)

B.eventstats median(field)

C.stats perc(field, 50)

D.stats p50(field)

E.stats median(field)

AnswersB, E

eventstats median adds the median value to each event.

Why this answer

Option B is correct because `eventstats median(field)` computes the median of the specified field and adds it as a new field to every event, which is a valid way to calculate the median. Option E is correct because `stats median(field)` directly computes the median of the numeric field and returns a single result, which is the standard method for median calculation in Splunk.

Exam trap

Splunk often tests the distinction between `eval` and `stats` functions, and candidates mistakenly use `eval` with aggregation functions like `percentile` or confuse the syntax for percentile commands (e.g., `perc`, `p50`) with the correct `perc50` or `percentile` syntax.

Full explanation →

486

MCQmedium

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

A.Use `| top limit=100 user` to get the top 100 users.

B.Add `| where count > 100` after the stats command.

C.Add `| where count > 100` before the stats command.

D.Use `| filter count > 100` after the stats command.

AnswerB

Correctly filters the stats results by the count field.

Why this answer

Option B is correct because the `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Exam trap

Splunk often tests the distinction between filtering before aggregation (using `search` or `where` on raw events) versus filtering after aggregation (using `where` on computed fields), and candidates mistakenly place the filter before `stats` or use a nonexistent command like `filter`.

How to eliminate wrong answers

Option A is wrong because `| top limit=100 user` returns the top 100 users by count, not users with a count greater than 100; it does not apply a threshold filter. Option C is wrong because placing `| where count > 100` before the stats command would attempt to filter on a field `count` that does not yet exist, causing an error or no results. Option D is wrong because `filter` is not a valid Splunk command; the correct command for filtering results is `where`, not `filter`.

Full explanation →

487

Drag & Dropmedium

Arrange the steps to configure a lookup table file in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Full explanation →

488

MCQmedium

A company needs to enrich events with lookup data that changes over time, such as daily exchange rates. Which lookup method is most appropriate?

A.Use a KV Store lookup with a time-range filter in the search

B.Use a file lookup without time context

C.Use a time-based lookup with a time_field parameter

D.Use an index-time lookup

AnswerC

Time-based lookups use the event's _time to select the appropriate row, perfect for time-varying reference data.

Why this answer

Option C is correct because a time-based lookup with a time_field parameter allows the lookup to return different values based on the event timestamp. Option A is incorrect because index-time lookups are static and require reindexing. Option B is incorrect because file lookups without time context cannot handle time-varying data.

Option D is incorrect because KV Store lookups are not time-aware by default.

Full explanation →

489

MCQeasy

An analyst runs `sourcetype=access_combined | transaction clientip` and notices many single-event transactions. Which option would help close transactions more accurately?

A.Add `endswith="status=200"`

B.Increase maxpause to 1 hour

C.Do nothing; single events are fine

D.Set closedelay=10

AnswerA

endswith ensures transaction closes when a logout or end event occurs.

Why this answer

Option A is correct because adding `endswith` helps define when a transaction should close, reducing false single-event transactions (e.g., 200 status often indicates end). Option B (maxpause) might help but not as targeted. Option C (closedelay) is not valid.

Option D (null) is not helpful.

Full explanation →

490

MCQmedium

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

A.Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

B.Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.

C.Limit the time range to the last 1 hour instead of 24 hours.

D.Enable search acceleration for the index.

AnswerB

Reduces the amount of data scanned in real time.

Why this answer

Option B is correct because adding a summary index that precomputes the counts by severity and using that in the dashboard reduces the real-time data scan. Option A would not help as it only benefits ad-hoc searches. Option C reduces the number of events but also changes the output (fewer severities).

Option D uses streaming commands which may not reduce disk I/O significantly.

Full explanation →

491

MCQeasy

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

A.timechart span=5min count

B.chart count over _time span=5min

C.stats count by _time span=5min

D.streamstats count span=5min

AnswerA

`timechart` with `span=5min` correctly creates a time series of event counts per 5-minute bucket.

Why this answer

The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Exam trap

Splunk often tests the misconception that `stats` or `chart` can be used with a `span` parameter to create time-based buckets, when in fact only `timechart` (and `bucket` in conjunction with `stats`) supports this syntax for time aggregation.

How to eliminate wrong answers

Option B is wrong because `chart count over _time span=5min` is not valid syntax; `chart` does not support the `span` option and requires a `by` clause to split data, making it unable to produce time-based buckets. Option C is wrong because `stats count by _time span=5min` is invalid; `stats` does not accept a `span` keyword, and grouping by raw `_time` would create a separate count for each unique timestamp, not aggregated intervals. Option D is wrong because `streamstats count span=5min` is invalid; `streamstats` computes running or sliding window statistics and does not support a `span` parameter, nor does it bin events into time intervals.

Full explanation →

492

MCQhard

You are a Splunk consultant for a financial services firm. They have a large lookup table containing customer account numbers and risk scores. This lookup is used in a critical compliance search that runs every hour. The search is failing with a memory error 'The search coordinator stopped the search due to memory usage'. You have already tried increasing the memory limit for the search via limits.conf, but the error persists. The lookup file is a CSV file of 2GB, with approximately 20 million rows. The search is: index=compliance sourcetype=transactions | lookup risk_scores.csv account_id OUTPUT risk_score | stats avg(risk_score) by transaction_type. The search runs on a single search head with 16GB RAM. The lookup is defined as static. What is the most effective optimization to resolve the memory error?

A.Use 'inputlookup' with a 'where' clause to filter the lookup to only relevant account IDs before joining.

B.Split the lookup into multiple smaller files and use multiple lookups in the search.

C.Convert the lookup to a KV store collection and use the 'kv' command in the search.

D.Use 'lookup local=false' in the search to distribute the lookup to indexers.

AnswerC

KV store uses memory-mapped files and is efficient for large lookups.

Why this answer

Option D is correct because converting to KV store reduces memory footprint. Option A is wrong because splitting files increases complexity without resolving memory. Option B is wrong because local=false distributes to indexers but still loads file.

Option C is wrong because inputlookup with where still loads all rows.

Full explanation →

493

MCQmedium

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

A.Add `| where method="GET"` before stats.

B.Replace `stats` with `chart count over uri by method`.

C.Use `top limit=5 uri, method` instead.

D.Add `| stats sum(count) as total by uri` after the existing stats.

E.Change `stats count by uri, method` to `stats count by uri`.

AnswerE

Correct: grouping only by uri gives count per URI.

Why this answer

Option E is correct because the original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Exam trap

Splunk often tests the distinction between grouping by multiple fields versus a single field, and the trap here is that candidates may think they need an additional stats command (Option D) or a filter (Option A) when simply removing the extra field from the `by` clause is the correct and efficient fix.

How to eliminate wrong answers

Option A is wrong because adding `| where method="GET"` would filter to only GET requests, which does not aggregate across all methods and still groups by URI and method if the stats clause remains unchanged. Option B is wrong because `chart count over uri by method` creates a tabular breakdown of counts per method for each URI, not a single count per URI, and still separates by method. Option C is wrong because `top limit=5 uri, method` returns the top 5 URI-method combinations by count, which is exactly what the original search does, not the top 5 URIs overall.

Option D is wrong because adding `| stats sum(count) as total by uri` after the existing stats would sum the counts for each URI, but the preceding stats already produced separate rows per combination; this would work only if the first stats output is properly structured, but it is an unnecessary extra step when simply removing `method` from the first stats is cleaner and more direct.

Full explanation →

494

MCQhard

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

A.The maxpause value is too high.

B.Events from the two sourcetypes are not in chronological order.

C.The fields option is missing.

D.The startswith and endswith patterns are too broad.

AnswerB

Events must be sorted by time; if sourcetypes have different timestamps, transaction may fail to correlate.

Why this answer

Option D is correct because transaction requires events to be in chronological order within the same index and host by default. If events are out of order, they won't be matched. Options A and B are plausible but less common; option C is false.

Full explanation →

495

MCQmedium

A user wants to create a report that shows the top 5 sources of errors, excluding a specific source 'host1'. Which SPL is correct?

A.index=main sourcetype=access_combined status>400 NOT host="host1" | top limit=5 source

B.index=main sourcetype=access_combined status>400 | top limit=5 source | where source!="host1"

C.index=main sourcetype=access_combined status>400 | top limit=5 source | search source!="host1"

D.index=main sourcetype=access_combined status>400 | search NOT host=host1 | top limit=5 source

AnswerA

Correctly excludes host1 before top, ensuring accurate top 5.

Why this answer

Option A is correct because it filters out 'host1' before the `top` command runs, ensuring that the top 5 sources of errors are calculated from the remaining data. The `NOT host="host1"` clause is placed in the base search, which is the most efficient approach and guarantees that 'host1' is excluded from the statistical aggregation.

Exam trap

Splunk often tests the misconception that filtering after a transforming command like `top` is equivalent to filtering before it, when in reality the aggregation is performed on the entire dataset first, altering the results.

How to eliminate wrong answers

Option B is wrong because the `where` command is applied after `top`, which means the top 5 sources are computed including 'host1', and then 'host1' is removed from the result set; this could leave fewer than 5 results and does not exclude 'host1' from the ranking calculation. Option C is wrong because the `search` command after `top` also filters after the aggregation, suffering from the same issue as Option B, and additionally `search source!="host1"` incorrectly uses the field `source` instead of `host` to filter the host. Option D is wrong because the `search NOT host=host1` is placed after the base search but before `top`, which would work logically, but the syntax is incorrect: `search NOT host=host1` is not valid SPL (the correct syntax is `NOT host="host1"` or `host!="host1"`), and the command is redundant since the base search already has the same filter; however, the primary flaw is that the `search` command is unnecessary and the syntax error makes it invalid.

Full explanation →

496

MCQmedium

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

A.maxspan

B.maxpause

C.mvcount

D.maxevents

AnswerD

Correct: maxevents caps the number of events per transaction.

Why this answer

Option B is correct because maxevents limits the number of events in a transaction. Option A (maxspan) limits time, not count. Option C (maxpause) limits idle time.

Option D (mvcount) counts multivalue fields, not events.

Full explanation →

497

Multi-Selectmedium

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Select 3 answers

A.The original number of events is preserved.

B.It uses less memory than stats.

C.You can use the aggregated field in subsequent commands like where or eval.

D.It is always faster than stats.

E.It allows you to see individual event details alongside aggregate statistics.

AnswersA, C, E

eventstats does not reduce event count.

Why this answer

Option A is correct because `eventstats` adds aggregate statistics (like sums or averages) to each original event without reducing the total number of events. Unlike `stats`, which collapses events into a single summary row per group, `eventstats` appends the aggregated value to every matching event, preserving the original event count and structure.

Exam trap

The trap here is that candidates confuse `eventstats` with `stats`, assuming `eventstats` is always faster or more memory-efficient, when in fact it trades off performance and memory for the ability to retain original event context.

Full explanation →

498

MCQhard

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

A.The macro argument should be passed without the `field=` prefix

B.The macro definition contains unescaped commas

C.The macro definition should use positional arguments instead of named

D.The macro definition should include a pipe before `eval`

AnswerB

Correct: Commas in the `if` function must be escaped.

Why this answer

Option C is correct: In macro definitions, commas that are part of the code need to be escaped with a backslash because commas are used to separate macro arguments. The `if` function uses commas, and they are not escaped, so the macro expansion is broken. Option A is not the issue; named arguments are valid.

Option B is incorrect; the invocation with `field=` is correct. Option D is incorrect; a leading pipe is not needed as the macro invocation already provides one.

Full explanation →

499

MCQhard

You are a Splunk administrator for a multi-site deployment with two data centers: primary and remote. Users on the remote site report that a lookup used in a dashboard returns no results for data from their site, but the same lookup works perfectly on the primary site. The lookup is defined with 'local=true' in the transforms.conf. The lookup file is stored on the primary search head. The remote site has its own search head that queries data from both sites. The dashboard search is: index=main | lookup site_mapping.csv site_id OUTPUT location | stats count by location. Users on the remote site see rows with location=null for their data. What is the most likely cause?

A.The lookup is configured to only run on the search head that indexes the data, which is the primary site.

B.The lookup definition needs 'local=false' to be available to remote search heads for distributed searches.

C.The lookup file is not replicated to the remote search head, so it cannot be accessed when local=true.

D.The remote site has a firewall blocking access to the lookup file on the primary search head.

AnswerC

local=true means file must be on the search head running the search.

Why this answer

Option C is correct because local=true requires the file on the search head; remote search head lacks the file. Option A is wrong because the lookup is not tied to indexers. Option B is wrong because firewall is less likely.

Option D is wrong because local=false would change behavior but not the root cause.

Full explanation →

500

MCQmedium

To find users who logged in from more than 3 different IP addresses, which search is correct?

A.index=auth | stats dc(IP) by user | where dc(IP) > 3

B.index=auth | top limit=3 IP by user

C.index=auth | eval user, IP | dedup user, IP | stats count by user | where count > 3

D.index=auth | stats distinct_count(IP) by user | where distinct_count(IP) > 3

AnswerA

dc counts distinct IPs per user, then filters.

Why this answer

Option A is correct because it uses `stats dc(IP) by user` to count distinct IP addresses per user, then filters with `where dc(IP) > 3` to return only users who logged in from more than 3 different IPs. The `dc()` function calculates distinct count, which is exactly what the question requires.

Exam trap

Splunk often tests the distinction between `dc()` (distinct count) and `count` (total occurrences), and the trap here is that candidates may confuse `distinct_count()` (invalid) with `dc()` or think `dedup` followed by `count` achieves the same result, which it does not because it counts duplicates of the pair rather than distinct IPs per user.

How to eliminate wrong answers

Option B is wrong because `top limit=3 IP by user` returns the top 3 IP addresses per user, not a count of distinct IPs, and cannot filter for users with more than 3 distinct IPs. Option C is wrong because `eval user, IP` is invalid syntax (eval requires an expression), and `dedup user, IP` removes duplicate pairs but does not count distinct IPs per user correctly; the subsequent `stats count` counts occurrences, not distinct IPs. Option D is wrong because `distinct_count(IP)` is not a valid SPL function; the correct function is `dc(IP)`, and this search would produce an error.

Full explanation →

Splunk Core Certified Power User SPLK-1003 (SPLK-1003) — Questions 451–500