Courseiva
← Back to Splunk Core Certified Power User SPLK-1003 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Splunk Core Certified Power User SPLK-1003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
SPLK-1002
exam code
Splunk
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related SPLK-1002 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Advanced Searching and Statistics practice questions

Targeted SPLK-1002 practice covering Advanced Searching and Statistics.

Macros, Saved Searches and CIM practice questions

Sharpen your SPLK-1002 knowledge of Macros, Saved Searches and CIM.

Advanced Visualization and Lookups practice questions

Practise SPLK-1002 questions linked to Advanced Visualization and Lookups.

Transactions and Event Correlation practice questions

Transactions and Event Correlation practice questions for SPLK-1002.

SPLK-1002 fundamentals practice questions

Practise SPLK-1002 questions linked to SPLK-1002 fundamentals.

SPLK-1002 scenario practice questions

Targeted SPLK-1002 practice covering SPLK-1002 scenario.

SPLK-1002 troubleshooting practice questions

Practise SPLK-1002 questions linked to SPLK-1002 troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice
Full question →

Refer to the exhibit. What is the most likely cause of this error?

Exhibit

Search command:
| inputlookup geo_lookup
| search src_ip="10.0.0.1"
| table src_ip, city, country

Error: "Error in 'inputlookup' command: Could not find lookup table 'geo_lookup'"
Question 2hardmulti select
Full question →

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Network Topology
splunk btool checkapp=searchdebug# transforms.conf[region_lookup]filename = regions.csvcase_sensitive_match = falsemax_matches = 5default_match = Unknown# props.conf[access_combined]
Question 3easymultiple choice
Full question →

Refer to the exhibit. What is the purpose of the eval command in this search?

Exhibit

index=web | eval status_category=case(status>=500, "Server Error", status>=400, "Client Error", 1=1, "Other") | stats count by status_category
Question 4hardmultiple choice
Full question →

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Exhibit

transforms.conf:
[lookup_user_info]
filename = user_info.csv
max_matches = 1
default_match = UNKNOWN

user_info.csv headers: User_ID, Department
Events have field: user_id (lowercase)
Question 5mediummultiple choice
Full question →

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Exhibit

Refer to the exhibit.
```
index=web sourcetype=access_combined
| rex "(?<ip>\d+\.\d+\.\d+\.\d+) (?<method>\w+) (?<uri>[^ ]+)"
| stats count by uri, method
| sort - count
| head 5
```
Question 6mediummultiple choice
Full question →

Refer to the exhibit. What is the purpose of this configuration?

Exhibit

[mytransaction]
fields = clientip, userid
maxspan = 1h
maxpause = 10m
Question 7hardmultiple choice
Full question →

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Exhibit

macro definition: eval $field$ = if(isnull($field$), "" , $field$)
Question 8mediummultiple choice
Full question →

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

Exhibit

index=main sourcetype=syslog
| rex field=_raw "User (?<user>\w+) logged in from (?<ip>\d+\.\d+\.\d+\.\d+)"
| search ip="10.0.*"
| table user, ip
Question 9mediummultiple choice
Full question →

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

Exhibit

Refer to the exhibit.
```
sourcetype=access_combined | transaction clientip maxspan=30m | where mvcount(method) > 3 | stats count by clientip
```
Question 10easymultiple choice
Full question →

The exhibit shows a search that reads a lookup file. Which of the following must be true for this search to work correctly?

Exhibit

Refer to the exhibit.

| inputlookup server_status.csv
| where status="down"
| stats count by location
| sort - count
Question 11mediummultiple choice
Full question →

Refer to the exhibit. Which statement about this search is true?

Exhibit

index=network sourcetype=firewall | fields src_ip, dest_ip, action, bytes | iplocation src_ip | stats sum(bytes) as total_bytes by dest_ip, Country | sort - total_bytes | head 10
Question 12mediummultiple choice
Full question →

Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?

Exhibit

index=web sourcetype=access_combined | transaction clientip maxspan=30m maxpause=5m | table clientip, duration, eventcount | where duration > 600
Question 13hardmultiple choice
Full question →

Refer to the exhibit. This search returns an error. What is the most likely cause?

Exhibit

index=web sourcetype=access_combined 
| stats count by status, uri_path 
| eval status_group=case(status>=500,"5xx", status>=400,"4xx", status>=300,"3xx", status>=200,"2xx") 
| timechart span=1h count by status_group
Question 14hardmultiple choice
Full question →

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

Exhibit

| makeresults count=5
| eval _time=_time + (random()%100)
| eval session="ses1"
| transaction session maxspan=10s
| eval duration=last(_time)-first(_time)
| stats avg(duration)
Question 15hardmultiple choice
Full question →

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

Exhibit

index=security sourcetype=firewall | eval src_ip=if(isnull(src_ip), nat_ip, src_ip) | transaction src_ip, dest_port maxspan=5m maxpause=1m | search eventcount>10 | table src_ip, dest_port, duration, eventcount

These SPLK-1002 practice questions are part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style SPLK-1002 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.