Subsearches core-certified-advanced-power-user Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   If a subsearch returns results but the outer search still returns no results, what should you check?

   • AWhether the subsearch returned more than 50,000 results.
   • BWhether the subsearch used the correct time range.
   • CWhether the outer search has a typo in the command.
   • DWhether the field names in the subsearch results match the field names used in the outer search.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which technique is useful for debugging a subsearch?

   • AUsing the join command instead of the subsearch.
   • BRunning the subsearch independently to see its output.
   • CRemoving the time range from the subsearch.
   • DAdding a sort command to the subsearch.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst needs to identify all firewall logs from the past hour that reference IP addresses currently listed in the 'threat_intel' lookup. The lookup contains over 200,000 entries and is updated every 15 minutes. The analyst writes: index=firewall | search [| inputlookup threat_intel | fields src_ip]. However, the results are missing many events that should match. What is the most likely cause and best fix?

   • AThe subsearch inherits the outer search's 1-hour time range, but the lookup is time-unaware, so it returns nothing. Add `earliest=0 latest=now` inside the subsearch.
   • BThe `fields src_ip` command inside the subsearch is invalid because `fields` cannot be used after `inputlookup`. Replace it with `| table src_ip`.
   • CThe subsearch hits the default 50,000-result limit, truncating the IP list. Use `| inputlookup threat_intel | fields src_ip | format` and increase the limit via limits.conf, or better, use `| lookup` to join directly.
   • DThe subsearch returns more than 50,000 results, so the outer search only filters on the first 50,000. Use `| inputlookup threat_intel | fields src_ip | head 50000` to ensure deterministic behavior.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How can the result limit of a subsearch impact performance on large datasets?

   • AIt speeds up the subsearch by limiting the amount of data processed.
   • BIt causes the subsearch to fail if the limit is exceeded.
   • CIt has no effect on large datasets.
   • DIt can cause the subsearch to return incomplete results, which may lead to incorrect filtering.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which scenario best demonstrates the use of a subsearch for filtering?

   • ACounting the number of events per source type in the last hour.
   • BFinding events whose user IDs match a list of users who logged in from a specific location, where the list is generated by a separate search.
   • CRenaming a field in the search results.
   • DDisplaying the top 10 error messages from a log file.
   Reveal Solution Discussion Select an answer first