Free SPLK-1002 Practice Test Questions and Answers (2026)

The transaction command is a Splunk command that finds transactions based on events that meet

various constraints .

Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of

the earliest member, as well as the union of all other fields of each member .

The transaction command groups events together by matching one or more fields that have the

same value across the events . For example, | transaction clientip will group events that have the

same value in the clientip field.

The relationship between data models and pivots is that data models provide the datasets for pivots.

Data models are collections of datasets that represent your data in a structured and hierarchical way.

Data models define how your data is organized into objects and fields. Pivots are user interfaces that

allow you to create data visualizations that present different aspects of a data model. Pivots let you

select options from menus and forms to create charts, tables, maps, etc., without writing any SPL

code. Pivots use datasets from data models as their source of data. Pivots and data models are not

the same thing, as pivots are tools for visualizing data models. Pivots do not provide datasets for data

models, but rather use them as inputs.

Therefore, only statement A is true about the relationship between data models and pivots.

The fields sidebar is a panel that shows the fields that are present in your search results2. The fields

sidebar has two sections: selected fields and interesting fields2. Selected fields are fields that you

choose to display in your search results by clicking on them in the fields sidebar or by using the fields

command2. Interesting fields are fields that appear in at least 20 percent of events or have high

variability among values2. For each field in the fields sidebar, you can select one of the following

options: events with this field, rare values, top values by time or top values2. If you select rare

values, Splunk will automatically pipe your search results to the rare command, which shows the

least common values of a field2. Therefore, option B is correct, while options A, C and D are incorrect

because they do not pipe your search results to the rare command.

Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot

A pivot is a tool that allows you to create reports and dashboards using data models without writing

any SPL commands2. You can use pivots to explore, filter, split and visualize your data using a

graphical interface2. Pivots are designed for users who want to analyze and report on their data

without having to learn the SPL syntax or the underlying structure of the data2. Therefore, option A is

correct, while options B, C and D are incorrect because they are not the typical group of users who

would use pivots.

:

The transaction command is used to group events that share a common value for one or more fields

into transactions2. The transaction command assigns a transaction ID to each group of events and

creates new fields such as duration, eventcount and eventlist for each transaction2. To identify all of

the contributing events within a transaction that contains at least one REJECT event, you can use the

following syntax: index=main | transaction sessionid | search REJECT2. This search will first group the

events by sessionid, then filter out the transactions that do not contain REJECT in any of their

events2. Therefore, option B is correct, while options A, C and D are incorrect because they do not

follow the correct syntax for using the transaction command or the search command.

Reference: https://www.edureka.co/blog/splunk-events-event-types-and-tags/

As mentioned before, an event type is a way to categorize events based on a search string that

matches the events2. Event types can be tagged, which means that you can apply descriptive labels

to event types and use them in your searches2. Therefore, option A is correct. Event types categorize

events based on a search string, which means that you can define an event type by specifying a

search string that matches the events you want to include in the event type2. Therefore, option C is

correct. Event types can be a useful method for capturing and sharing knowledge, which means that

you can use event types to organize your data into meaningful categories and share them with other

users in your organization2. Therefore, option D is correct. Event types do not have to include a time

range, which means that you can create an event type without specifying a time range for the

events2. Therefore, option B is incorrect.

:

:

A delimiter field extraction is a method of extracting fields from data that uses a character or a string

to separate fields in each event. A delimiter field extraction can be performed by using the Field

Extractor (FX) tool or by editing the props.conf file. A delimiter field extraction can be applied to any

file format that uses a delimiter to separate fields, such as CSV, TSV, PSV, etc. A CSV file is a comma-

separated values file that uses commas as delimiters. Therefore, a CSV file can be extracted using a

delimiter field extraction.

After manually editing a regular expression (regex) that was created using the Field Extractor (FX) UI,

it is no longer possible to edit the field extraction in the FX UI. The FX UI is a tool that helps you

extract fields from your data using delimiters or regular expressions. The FX UI can generate a regex

for you based on your selection of sample values or you can enter your own regex in the FX UI.

However, if you edit the regex manually in the props.conf file, the FX UI will not be able to recognize

the changes and will not let you edit the field extraction in the FX UI anymore. You will have to use

the props.conf file to make any further changes to the field extraction. Changes made manually

cannot be reverted in the FX UI, as the FX UI does not keep track of the changes made in the

props.conf file. It is possible to manually edit a regex that was created using the FX UI, as long as you

do it in the props.conf file.

Therefore, only statement B is true about manually editing a regex.

The maxspan function of the transaction command allows you to set the maximum total time

between the earliest and latest events returned. The maxspan function is an argument that can be

used with the transaction command to specify the start and end constraints for the transactions. The

maxspan function takes a time modifier as its value, such as 30s, 5m, 1h, etc. The maxspan function

sets the maximum time span between the first and last events in a transaction. If the time span

between the first and last events exceeds the maxspan value, the transaction will be split into

multiple transactions.

:

:

The correct answer is A. | where 10yearAnnerversary=Renewal-MonthYear. The where command is used to filter the search results based on an expression that evaluates to true or false. The where command can compare two fields, two values, or a field and a value. The where command can also use functions, operators, and wildcards to create complex expressions1. The syntax for the where command is: | where The expression can be a comparison, a calculation, a logical operation, or a combination of these. The expression must evaluate to true or false for each event. To compare two fields with the where command, you need to use the field names without any quotation marks. For example, if you want to find events where the values for the 10yearAnnerversary field match the values for the Renewal-MonthYear field, you can use the following syntax: | where 10yearAnnerversary=Renewal-MonthYear This will return only the events where the two fields have the same value. The other options are not correct because they use quotation marks around the field names, which will cause the where command to interpret them as string values instead of field names. For example, if you use: | where ‘10yearAnnerversary’=‘Renewal-MonthYear’ This will return no events because there are no events where the string value ‘10yearAnnerversary’ is equal to the string value ‘Renewal-MonthYear’. Reference: where command usage

The correct answer is A. chart, timechart, stats, eventstats. Transforming commands are commands that change the format of the search results into a table or a chart. They can be used to perform statistical calculations, create visualizations, or manipulate data in various ways1. Transactions are groups of events that share some common values and are related in some way. Transactions can be defined by using the transaction command or by creating a transaction type in the transactiontypes.conf file2. Some transforming commands can be used with transactions to create tables or charts based on the transaction fields. These commands include: chart: This command creates a table or a chart that shows the relationship between two or more fields. It can be used to aggregate values, count occurrences, or calculate statistics3. timechart: This command creates a table or a chart that shows how a field changes over time. It can be used to plot trends, patterns, or outliers4. stats: This command calculates summary statistics on the fields in the search results, such as count, sum, average, etc. It can be used to group and aggregate data by one or more fields5. eventstats: This command calculates summary statistics on the fields in the search results, similar to stats, but it also adds the results to each event as new fields. It can be used to compare events with the overall statistics. These commands can be applied to transactions by using the transaction fields as arguments. For example, if you have a transaction type named “login” that groups events based on the user field and has fields such as duration and eventcount, you can use the following commands with transactions: | chart count by user : This command creates a table or a chart that shows how many transactions each user has. | timechart span=1h avg(duration) by user : This command creates a table or a chart that shows the average duration of transactions for each user per hour. | stats sum(eventcount) as total_events by user : This command creates a table that shows the total number of events for each user across all transactions. | eventstats avg(duration) as avg_duration : This command adds a new field named avg_duration to each transaction that shows the average duration of all transactions. The other options are not valid because they include commands that are not transforming commands or cannot be used with transactions. These commands are: diff: This command compares two search results and shows the differences between them. It is not a transforming command and it does not work with transactions. datamodel: This command retrieves data from a data model, which is a way to organize and categorize data in Splunk. It is not a transforming command and it does not work with transactions. pivot: This command creates a pivot report, which is a way to analyze data from a data model using a graphical interface. It is not a transforming command and it does not work with transactions. Reference: About transforming commands About transactions chart command overview timechart command overview stats command overview [eventstats command overview] [diff command overview] [datamodel command overview] [pivot command overview]

In Splunk, calculated fields allow you to create new fields using expressions that can transform or combine the values of existing fields. Although all options provided might seem viable, when selecting only one option that is most representative of a calculated field, we typically refer to: D . Extracted fields: Calculated fields are often based on fields that have already been extracted from your data. Extracted fields are those that Splunk has identified and pulled out from the event data based on patterns, delimiters, or other methods such as regular expressions or automatic extractions. These fields can then be used in expressions to create calculated fields. For example, you might have an extracted field for the time in seconds, and you want to create a calculated field for the time in minutes. You would use the extracted field in a calculation to create the new field. It's important to note that although fields generated within a search string (A) and regular expressions (C) can also be used in the calculation of a new field, and lookup tables (B) can be used to enrich data, option D is typically what one refers to when discussing calculated fields, as it implies a direct transformation or calculation based on fields that have been extracted from the raw data.

During the validation step of the Field Extractor workflow, you can remove values that aren’t a match for the field you want to define2. The validation step allows you to review and edit the values that have been extracted by the FX and make sure they are correct and consistent2. You can remove values that aren’t a match by clicking on them and selecting Remove Value from the menu2. This will exclude them from your field extraction and update the regular expression accordingly2. Therefore, option A is correct, while options B and C are incorrect because they are not actions that you can perform during the validation step of the Field Extractor workflow.

The Field Extractor Utility (FX) is a tool that helps you extract fields from your events using a graphical interface or by manually editing the regular expression2. The FX has a button that displays events that do not contain extracted fields, which is the Non-Matches button2. The Non-Matches button shows you the events that do not match the regular expression that you have defined for your field extraction2. This way, you can check if your field extraction is accurate and complete2. Therefore, option B is correct, while options A, C and D are incorrect because they are not buttons that display events that do not contain extracted fields.

In Splunk, a field alias is used to create an alternative name for an existing field, making it easier to

refer to data in a consistent manner across different searches and reports. Field aliases can be

applied to both calculated fields and extracted fields. Calculated fields are those that are created

using eval expressions, while extracted fields are typically those parsed from the raw data at index

time or search time. This flexibility allows users to streamline their searches by using more intuitive

field names without altering the underlying data. Field aliases cannot be applied to data in a lookup

table, specific individual fields within a dataset, or directly to a host, source, or sourcetype.