How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 15 Refer to the Exhibit Practice Questions scenario questions for the SPLK-1003 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SPLK-1003 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Splunk Core Certified Power User SPLK-1003 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Splunk Core Certified Power User SPLK-1003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SPLK-1003

exam code

Splunk

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

Exhibit

Refer to the exhibit.
```
index=main sourcetype=linux_secure
| eval stage=case(
    like(_raw,"%Failed password%"),"failed",
    like(_raw,"%Accepted password%"),"success")
| transaction src maxspan=5m
| search stage="*"
| eval attack=if(mvcount(stage)>2 AND mvcount(stage)>=2 AND mvfind(stage,"failed")!=-1 AND mvfind(stage,"success")!=-1,"yes","no")
| where attack="yes"
```

A
The transaction should group by user instead of src.
Why wrong: Grouping by src (source IP) is appropriate for detecting brute-force from an IP.
B
The case statement does not set stage for events that don't match either pattern.
Why wrong: All events should match at least one condition; if not, stage is null, but that would be filtered by the search stage="*" anyway.
C
The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.
Why wrong: The condition is redundant but not incorrect; it requires at least 3 events (2 fails + 1 success).
D
The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.
Searching stage="*" does not match multivalue fields; it matches a literal asterisk. Should use `where isnotnull(stage)`.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related SPLK-1003 topic practice pages

Advanced Searching and Statistics practice questions

Macros, Saved Searches and CIM practice questions

Advanced Visualization and Lookups practice questions

Transactions and Event Correlation practice questions

SPLK-1003 fundamentals practice questions

SPLK-1003 scenario practice questions

SPLK-1003 troubleshooting practice questions

Practice scenarios

Exhibit

Exhibit

The exhibit shows a search that reads a lookup file. Which of the following must be true for this search to work correctly?

Exhibit

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

Exhibit

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Exhibit

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

Exhibit

Refer to the exhibit. An analyst executes the following search: `| filter_status(status_code=500)`. What will be the result?

Exhibit

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

Exhibit

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Exhibit

Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?

Exhibit

Refer to the exhibit. What is the most likely cause of this error?

Exhibit

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

Exhibit

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

Exhibit

Refer to the exhibit. What happens when a user clicks on a status value in the table?

Exhibit

Refer to the exhibit. A user runs this search expecting to see the top 5 departments by count, but the results show all departments. What is the error?

Exhibit