Untitled

SPLK-1002 Practice Quiz Notes

Section 1: Knowledge-Based Questions (1–50)

Question 1

Question: Which SPL command is used to remove duplicate events based on a specific field?
Options:
  A) stats
  B) dedup
  C) unique
  D) eval
Correct Answer: B) dedup

Question 2

Question: What does the rex command do in Splunk?
Options:
  A) Applies regular expressions to extract fields from raw events
  B) Renames existing fields
  C) Removes unwanted fields from search results
  D) Reorganizes event data into a table
Correct Answer: A) Applies regular expressions to extract fields from raw events

Question 3

Question: Which command is used to calculate statistical aggregations such as count, sum, and average?
Options:
  A) chart
  B) timechart
  C) stats
  D) transaction
Correct Answer: C) stats

Question 4

Question: In Splunk, what is the default time range for a search if no time modifier is specified?
Options:
  A) All time
  B) Last 24 hours
  C) Last 7 days
  D) Last 15 minutes
Correct Answer: D) Last 15 minutes

Question 5

Question: Which of the following best describes a Splunk lookup?
Options:
  A) A saved search that runs on a schedule
  B) A file or table that enriches event data with external information
  C) A dashboard panel that displays search results
  D) A field extraction rule for raw data
Correct Answer: B) A file or table that enriches event data with external information

Question 6

Question: What is the purpose of the eval command in Splunk?
Options:
  A) To evaluate index health
  B) To create or modify fields using an expression
  C) To evaluate field extraction rules
  D) To filter events by field value
Correct Answer: B) To create or modify fields using an expression

Question 7

Question: Which command generates a time-based chart where each data series is a field value?
Options:
  A) chart
  B) stats
  C) timechart
  D) table
Correct Answer: C) timechart

Question 8

Question: What does the transaction command group?
Options:
  A) Events by field value into statistical summaries
  B) Related events into a single event based on shared field values
  C) Events across multiple indexes into a single result set
  D) Raw log lines into structured fields
Correct Answer: B) Related events into a single event based on shared field values

Question 9

Question: Which SPL keyword is used to pass results from one command to another?
Options:
  A) |
  B) >
  C) &&
  D) ;
Correct Answer: A) |

Question 10

Question: What does the fields command do?
Options:
  A) Extracts new fields from raw events
  B) Includes or excludes specified fields from search results
  C) Renames fields in search results
  D) Displays field statistics
Correct Answer: B) Includes or excludes specified fields from search results

Question 11

Question: Which function within eval converts a string to uppercase?
Options:
  A) toupper()
  B) upper()
  C) strtoupper()
  D) capitalize()
Correct Answer: A) toupper()

Question 12

Question: What is a Splunk macro?
Options:
  A) A reusable search string that can accept arguments
  B) A type of dashboard panel
  C) An automated alert rule
  D) A lookup table configuration file
Correct Answer: A) A reusable search string that can accept arguments

Question 13

Question: How is a Splunk macro called in a search?
Options:
  A) @macroname
  B) macroname
  C) $macroname$
  D) #macroname
Correct Answer: B) macroname

Question 14

Question: Which SPL command is used to rename a field?
Options:
  A) alias
  B) rename
  C) label
  D) fieldname
Correct Answer: B) rename

Question 15

Question: What is the difference between chart and timechart?
Options:
  A) chart uses time as the x-axis; timechart allows any field as the x-axis
  B) timechart uses time as the x-axis; chart allows any field as the x-axis
  C) They are identical commands
  D) chart is only for pie charts; timechart is for line charts
Correct Answer: B) timechart uses time as the x-axis; chart allows any field as the x-axis

Question 16

Question: What does the inputlookup command do?
Options:
  A) Writes search results to a lookup file
  B) Reads data from a lookup file into a search
  C) Configures a new lookup definition
  D) Validates lookup table syntax
Correct Answer: B) Reads data from a lookup file into a search

Question 17

Question: Which command is used to write search results to a lookup file?
Options:
  A) inputlookup
  B) outputlookup
  C) writelookup
  D) savelookup
Correct Answer: B) outputlookup

Question 18

Question: What does the iplocation command add to events?
Options:
  A) DNS hostnames for IP addresses
  B) Geographic information based on IP addresses
  C) Port and protocol details for IP connections
  D) Threat intelligence scores
Correct Answer: B) Geographic information based on IP addresses

Question 19

Question: In a scheduled report, what does the 'Trigger condition' control?
Options:
  A) How often the search runs
  B) When an alert action fires based on search results
  C) Which users receive the report
  D) The time range of the search
Correct Answer: B) When an alert action fires based on search results

Question 20

Question: Which of the following is NOT a valid Splunk field extraction method?
Options:
  A) Regular expression (rex)
  B) Delimiter-based
  C) Field alias
  D) Compiled bytecode extraction
Correct Answer: D) Compiled bytecode extraction

Question 21

Question: What is the purpose of the sort command?
Options:
  A) To group events by field
  B) To order search results by one or more fields
  C) To rank fields by frequency
  D) To filter events above a threshold
Correct Answer: B) To order search results by one or more fields

Question 22

Question: Which stats function returns the number of events?
Options:
  A) sum()
  B) count()
  C) total()
  D) num()
Correct Answer: B) count()

Question 23

Question: What is the role of a field alias in Splunk?
Options:
  A) It creates a copy of a field with a new name at search time
  B) It permanently renames a field in the index
  C) It compresses field values for storage
  D) It removes duplicate fields
Correct Answer: A) It creates a copy of a field with a new name at search time

Question 24

Question: What does the where command do, and how does it differ from search?
Options:
  A) where filters events using Boolean expressions; search is only for keywords
  B) where uses eval expressions and works on computed fields; search uses keyword matching
  C) They are equivalent and interchangeable
  D) where only works before stats; search only works after
Correct Answer: B) where uses eval expressions and works on computed fields; search uses keyword matching

Question 25

Question: Which SPL command is most appropriate for finding the top 5 values of a field?
Options:
  A) rare
  B) dedup
  C) top
  D) stats count
Correct Answer: C) top

Question 26

Question: What is the function of the head command?
Options:
  A) Returns the last N events
  B) Returns the first N events
  C) Returns the highest value events
  D) Returns events with non-null field values
Correct Answer: B) Returns the first N events

Question 27

Question: Which of the following correctly uses a time modifier in SPL?
Options:
  A) index=main time=last24h
  B) index=main earliest=-24h latest=now
  C) index=main | time -24h
  D) index=main timerange=-24h
Correct Answer: B) index=main earliest=-24h latest=now

Question 28

Question: What type of knowledge object stores search results to improve performance of repeated searches?
Options:
  A) Lookup table
  B) Summary index
  C) Macro
  D) Report acceleration
Correct Answer: D) Report acceleration

Question 29

Question: Which command creates a new field based on a conditional expression?
Options:
  A) if()
  B) eval with if()
  C) case()
  D) Both B and C
Correct Answer: D) Both B and C

Question 30

Question: What does the rare command display?
Options:
  A) The most common field values
  B) The least common field values
  C) Events with null field values
  D) Events outside a statistical baseline
Correct Answer: B) The least common field values

Question 31

Question: Which Splunk feature allows you to apply a consistent look-and-feel to multiple dashboards?
Options:
  A) App theme
  B) Dashboard CSS
  C) Report styling
  D) Global header
Correct Answer: A) App theme

Question 32

Question: In SPL, what is the correct syntax for a subsearch?
Options:
  A) [search index=main | fields user]
  B) (search index=main | fields user)
  C) {search index=main | fields user}
  D)
Correct Answer: A) [search index=main | fields user]

Question 33

Question: What is the maximum number of results returned by a subsearch by default?
Options:
  A) 500
  B) 1000
  C) 5000
  D) 10000
Correct Answer: B) 1000

Question 34

Question: Which eval function returns the length of a string?
Options:
  A) length()
  B) len()
  C) strlen()
  D) count()
Correct Answer: A) length()

Question 35

Question: A user wants to search for events containing either 'error' or 'warning'. Which is the correct SPL?
Options:
  A) index=main error warning
  B) index=main error OR warning
  C) index=main (error && warning)
  D) index=main error | warning
Correct Answer: B) index=main error OR warning

Question 36

Question: Which Splunk knowledge object type allows you to normalize field names across different source types?
Options:
  A) Lookup
  B) Field alias
  C) Calculated field
  D) Tag
Correct Answer: B) Field alias

Question 37

Question: What is the purpose of a Splunk tag?
Options:
  A) To label field/value pairs with meaningful names for easier searching
  B) To categorize dashboards
  C) To assign permissions to searches
  D) To mark events for deletion
Correct Answer: A) To label field/value pairs with meaningful names for easier searching

Question 38

Question: Which command would you use to combine results from two datasets where matching is based on a common field?
Options:
  A) append
  B) join
  C) union
  D) merge
Correct Answer: B) join

Question 39

Question: What is the difference between append and join in SPL?
Options:
  A) append concatenates results vertically; join merges results horizontally on a common field
  B) append merges on a common field; join concatenates results
  C) They are the same command
  D) join is used only for lookup files
Correct Answer: A) append concatenates results vertically; join merges results horizontally on a common field

Question 40

Question: What does the bucket command (also known as bin) do?
Options:
  A) Groups continuous field values into discrete ranges
  B) Stores events in a temporary index
  C) Removes low-frequency field values
  D) Aggregates events by source type
Correct Answer: A) Groups continuous field values into discrete ranges

Question 41

Question: Which SPL command is used to search within the results of another search without using a subsearch?
Options:
  A) append
  B) map
  C) union
  D) appendcols
Correct Answer: B) map

Question 42

Question: What is a calculated field in Splunk?
Options:
  A) A field created by an eval expression that is saved as a knowledge object
  B) A field extracted from raw data using regex
  C) A field mapped from a lookup file
  D) A field used only in dashboard panels
Correct Answer: A) A field created by an eval expression that is saved as a knowledge object

Question 43

Question: Which function is used inside eval to return a value based on multiple conditions?
Options:
  A) if()
  B) case()
  C) match()
  D) Both A and B
Correct Answer: D) Both A and B

Question 44

Question: When using stats with by, what does the by clause do?
Options:
  A) Filters events that match a condition
  B) Groups results by the specified field(s)
  C) Sorts results by the specified field
  D) Renames the aggregation field
Correct Answer: B) Groups results by the specified field(s)

Question 45

Question: Which SPL command displays the number of events over time as a column chart?
Options:
  A) chart count by _time
  B) timechart count
  C) stats count by _time
  D) bucket _time | stats count
Correct Answer: B) timechart count

Question 46

Question: What is the coalesce() function used for in eval?
Options:
  A) Returns the sum of multiple fields
  B) Returns the first non-null value from a list of fields
  C) Combines two string fields
  D) Returns the average of multiple fields
Correct Answer: B) Returns the first non-null value from a list of fields

Question 47

Question: Which command lists all unique values for a field along with their counts?
Options:
  A) dedup
  B) top
  C) stats count by fieldname
  D) values()
Correct Answer: C) stats count by fieldname

Question 48

Question: What is report acceleration in Splunk?
Options:
  A) A feature that pre-computes summary data for faster reporting on large datasets
  B) A search command that speeds up field extraction
  C) A hardware upgrade for the indexer
  D) A caching mechanism for dashboard panels
Correct Answer: A) A feature that pre-computes summary data for faster reporting on large datasets

Question 49

Question: Which stats function collects all values of a field into a multivalue field?
Options:
  A) list()
  B) values()
  C) collect()
  D) mvlist()
Correct Answer: A) list()

Question 50

Question: What does earliest=-7d@d latest=@d mean in a search?
Options:
  A) Last 7 hours snapped to the current day
  B) From 7 days ago snapped to midnight to the start of today
  C) From 7 days ago to now
  D) Last 7 days including the current day
Correct Answer: B) From 7 days ago snapped to midnight to the start of today

Section 2: Performance-Based Questions (51–60)

Question 51

Question: A Splunk Power User needs to write a search that counts the number of failed login attempts per user for the past 7 days, shows only users with more than 5 failures, and sorts results in descending order. Which search is correct?
Options:
  A) index=security action=failure earliest=-7d | stats count by user | where count>5 | sort -count
  B) index=security action=failure | stats count by user | sort -count | where count>5
  C) index=security action=failure earliest=-7d | dedup user | stats count | where count>5
  D) index=security action=failure earliest=-7d | top user | where count>5
Correct Answer: A) index=security action=failure earliest=-7d | stats count by user | where count>5 | sort -count

Question 52

Question: You need to create a field called response_category that equals 'Success' if status is 200, 'Redirect' if status is 301 or 302, and 'Error' for all other values. Which eval expression is correct?
Options:
  A) | eval response_category=if(status=200,"Success",if(status=301 OR status=302,"Redirect","Error"))
  B) | eval response_category=case(status=200,"Success",status=301 OR status=302,"Redirect",1=1,"Error")
  C) Both A and B are correct
  D) | eval response_category=match(status,200,"Success",301,"Redirect","Error")
Correct Answer: C) Both A and B are correct

Question 53

Question: A user has a lookup file users.csv with fields user_id and department. They want to enrich web access logs with department info and then count events per department. Which search correctly accomplishes this?
Options:
  A) index=web | lookup users.csv user_id OUTPUT department | stats count by department
  B) index=web | inputlookup users.csv | stats count by department
  C) index=web | join user_id [inputlookup users.csv] | stats count by department
  D) index=web | lookup users.csv department OUTPUT user_id | stats count by department
Correct Answer: A) index=web | lookup users.csv user_id OUTPUT department | stats count by department

Question 54

Question: You need to extract the IP address from events with the format 'Connection from 192.168.1.1 on port 443'. Which rex command correctly extracts it into a field called src_ip?
Options:
  A) | rex field=_raw "Connection from (?P[\d.]+) on"
  B) | rex "src_ip=([\d.]+)"
  C) | rex field=_raw "(?P\d+.\d+.\d+.\d+)"
  D) Both A and C will correctly extract into src_ip
Correct Answer: D) Both A and C will correctly extract into src_ip

Question 55

Question: A Power User wants to create a macro called failed_logins(1) that accepts an index name as an argument and returns failed login events from that index. What is the correct macro definition?
Options:
  A) index= $index$ action=failure
  B) index=$index$ action=failure
  C) search index=$arg1$ action=failure
  D) index=failure action=$1$
Correct Answer: A) index= $index$ action=failure

Question 56

Question: You want to find all source IPs that appeared in more than 100 events in the past hour AND appear in a threat intelligence lookup called bad_ips.csv with a field ip. Which search is correct?
Options:
  A) index=main earliest=-1h | stats count by src_ip | where count>100 | lookup bad_ips.csv ip AS src_ip OUTPUT ip | where isnotnull(ip)
  B) index=main earliest=-1h | lookup bad_ips.csv ip AS src_ip | stats count by src_ip | where count>100
  C) index=main earliest=-1h | stats count by src_ip | where count>100 | inputlookup bad_ips.csv | join src_ip
  D) index=main earliest=-1h | join src_ip [inputlookup bad_ips.csv | rename ip AS src_ip] | stats count by src_ip | where count>100
Correct Answer: A) index=main earliest=-1h | stats count by src_ip | where count>100 | lookup bad_ips.csv ip AS src_ip OUTPUT ip | where isnotnull(ip)

Question 57

Question: A user needs to calculate the average response time per host using the stats command, then create a new field called perf_tier that is 'Fast' if avg_response < 200, 'Normal' if between 200-500, and 'Slow' if above 500. Which search is correct?
Options:
A) index=web | stats avg(response_time) AS avg_response by host | eval perf_tier=case(avg_response
Correct Answer: D) Both A and C are correct

Question 58

Question: You are troubleshooting a scheduled report that is not triggering its alert action. The search returns results but the alert never fires. What is the most likely configuration issue?
Options:
  A) The search is using real-time scheduling instead of historical
  B) The trigger condition is set to 'Number of Results is greater than 0' but no throttle period is applied
  C) The trigger condition or throttle settings are misconfigured, causing the condition to never evaluate as true or be suppressed
  D) The report time range is set to 'All Time' which prevents alerting
Correct Answer: C) The trigger condition or throttle settings are misconfigured, causing the condition to never evaluate as true or be suppressed

Question 59

Question: A Power User needs to use a subsearch to find users who had failed logins and then search for subsequent successful logins by those same users. Which is the correct approach?
Options:
  A) index=auth action=success [search index=auth action=failure | fields user]
  B) index=auth action=success | join user [search index=auth action=failure]
  C) index=auth action=failure | append [search index=auth action=success] | stats count by user
  D) index=auth [search index=auth action=failure | stats count by user]
Correct Answer: A) index=auth action=success [search index=auth action=failure | fields user]

Question 60

Question: You need to write a search using timechart to show the count of events per sourcetype every hour over the last 24 hours, limiting the chart to only the top 5 sourcetypes. Which search is correct?
Options:
  A) index=main earliest=-24h | timechart span=1h count by sourcetype limit=5
  B) index=main earliest=-24h | timechart span=1h count by sourcetype useother=false limit=5
  C) index=main earliest=-24h | top sourcetype | timechart span=1h count
  D) index=main earliest=-24h | bucket _time span=1h | stats count by _time, sourcetype | head 5
Correct Answer: B) index=main earliest=-24h | timechart span=1h count by sourcetype useother=false limit=5

Quiz 1 — Answer Key at a Glance

1. B
2. A
3. C
4. D
5. B
6. B
7. C
8. B
9. A
1. B
1. A
1. A
1. B
1. B
1. B
1. B
1. B
1. B
1. B
1. D
1. B
1. B
1. A
1. B
1. C
1. B
1. B
1. D
1. D
1. B
1. A
1. A
1. B
1. A
1. B
1. B
1. A
1. B
1. A
1. A
1. B
1. A
1. D
1. B
1. B
1. B
1. C
1. A
1. A
1. B
1. A
1. C
1. A
1. D
1. A
1. A
1. D
1. C
1. A
1. B