Courseiva
← Back to Splunk Core Certified Power User SPLK-1003 questions

Scenario-based practice

Hard Difficulty Questions

Practise Splunk Core Certified Power User SPLK-1003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
SPLK-1002
exam code
Splunk
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related SPLK-1002 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Advanced Searching and Statistics practice questions

Targeted SPLK-1002 practice covering Advanced Searching and Statistics.

Macros, Saved Searches and CIM practice questions

Sharpen your SPLK-1002 knowledge of Macros, Saved Searches and CIM.

Advanced Visualization and Lookups practice questions

Practise SPLK-1002 questions linked to Advanced Visualization and Lookups.

Transactions and Event Correlation practice questions

Transactions and Event Correlation practice questions for SPLK-1002.

SPLK-1002 fundamentals practice questions

Practise SPLK-1002 questions linked to SPLK-1002 fundamentals.

SPLK-1002 scenario practice questions

Targeted SPLK-1002 practice covering SPLK-1002 scenario.

SPLK-1002 troubleshooting practice questions

Practise SPLK-1002 questions linked to SPLK-1002 troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice
Full question →

Refer to the exhibit. What is the most likely cause of this error?

Exhibit

Search command:
| inputlookup geo_lookup
| search src_ip="10.0.0.1"
| table src_ip, city, country

Error: "Error in 'inputlookup' command: Could not find lookup table 'geo_lookup'"
Question 2hardmultiple choice
Full question →

In a dashboard panel, a table shows event counts by source. The user wants to click on a sourcetype to drill down to a new search showing all events from that source. Which token-based drilldown approach is correct?

Question 3hardmultiple choice
Full question →

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

Question 4hardmultiple choice
Full question →

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Question 5hardmultiple choice
Full question →

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Question 6hardmulti select
Full question →

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Network Topology
splunk btool checkapp=searchdebug# transforms.conf[region_lookup]filename = regions.csvcase_sensitive_match = falsemax_matches = 5default_match = Unknown# props.conf[access_combined]
Question 7hardmultiple choice
Full question →

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Exhibit

transforms.conf:
[lookup_user_info]
filename = user_info.csv
max_matches = 1
default_match = UNKNOWN

user_info.csv headers: User_ID, Department
Events have field: user_id (lowercase)
Question 8hardmultiple choice
Full question →

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Question 9hardmultiple choice
Full question →

A data engineer has defined a CIM data model for 'Network_Traffic'. They have also created field aliases using `| fieldaliases` to map custom fields like `src_ip` and `dest_ip` to the CIM fields. When running searches against the data model, some events do not appear. The engineer verified that the tags are correctly applied. What is the most likely remaining issue?

Question 10hardmultiple choice
Full question →

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

Question 11hardmultiple choice
Full question →

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

Question 12hardmultiple choice
Full question →

You are a Splunk consultant for a financial services firm. They have a large lookup table containing customer account numbers and risk scores. This lookup is used in a critical compliance search that runs every hour. The search is failing with a memory error 'The search coordinator stopped the search due to memory usage'. You have already tried increasing the memory limit for the search via limits.conf, but the error persists. The lookup file is a CSV file of 2GB, with approximately 20 million rows. The search is: index=compliance sourcetype=transactions | lookup risk_scores.csv account_id OUTPUT risk_score | stats avg(risk_score) by transaction_type. The search runs on a single search head with 16GB RAM. The lookup is defined as static. What is the most effective optimization to resolve the memory error?

Question 13hardmultiple choice
Full question →

A large e-commerce company runs Splunk Enterprise on a single indexer cluster with four indexers. They have been experiencing slow search performance during peak hours, especially for searches that cover the last 24 hours. The environment uses a default search time range of 'Last 30 days'. The team has noticed that searches often time out or return partial results. They have also observed high CPU usage on the search head during peak times. The company's data volume is approximately 500 GB per day across various sources. They have implemented some search acceleration for data models, but the issue persists. The security team needs to run ad-hoc searches for threat hunting that cover multiple sourcetypes over the last 7 days. Additionally, the search head has a memory limit that is sometimes reached. The security team's searches are complex and involve joins and subsearches. The existing acceleration only covers a few data models. The team is looking for a quick win that does not require significant infrastructure changes. Which course of action would most effectively improve search performance without compromising data completeness?

Question 14hardmultiple choice
Full question →

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Exhibit

macro definition: eval $field$ = if(isnull($field$), "" , $field$)
Question 15hardmultiple choice
Full question →

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Exhibit

Refer to the exhibit.
| timechart span=1h count by host limit=5
Question 16hardmultiple choice
Full question →

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Question 17hardmultiple choice
Full question →

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Question 18hardmultiple choice
Full question →

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Question 19hardmultiple choice
Full question →

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Question 20hardmultiple choice
Full question →

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

These SPLK-1002 practice questions are part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style SPLK-1002 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.