Describe How Sub-Searches Work CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Splunk consultant needs to correlate authentication events with a list of users who have a specific role. The role information is in a lookup file. The authentication events have a 'user' field. The consultant wants to find all authentication events for users with the 'admin' role. Which approach is most efficient and scalable?

   • AUse the join command to combine the lookup data with authentication events
   • BUse a sub-search to return the list of admin users and then use it in the outer search
   • CUse the transaction command to group authentication events by user and then filter by role
   • DUse a lookup to enrich authentication events with role information and then filter by role
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk admin is troubleshooting a sub-search that is returning incomplete results. The sub-search is: [search index=main sourcetype=transactions | fields customer_id]. The admin suspects the sub-search is hitting the 50,000 result limit. Which action would confirm this?

   • AAdd '| eval test=1' to the sub-search to see if the search runs
   • BAdd '| stats count' to the sub-search to see the total number of results
   • CAdd '| head 1' to the sub-search to see if any results are returned
   • DAdd '| fields - _raw' to the sub-search to reduce the data size
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a known limitation of sub-searches in Splunk?

   • AThey do not support time range modifiers
   • BThey can only be used with the search command
   • CThey have a maximum result limit of 50,000 events
   • DThey cannot be used in dashboards
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A Splunk consultant is optimizing a search that uses a sub-search to find all transactions for customers who made a purchase in the last 24 hours. The sub-search returns 60,000 customer IDs. The outer search is timing out. Which approach best addresses the performance issue while still achieving the goal?

   • AUse a lookup to map customer IDs to transactions instead of a sub-search
   • BUse a transaction command instead of a sub-search
   • CIncrease the sub-search result limit to 100,000
   • DAdd '| head 50000' to the sub-search to ensure it returns exactly 50,000 results
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Splunk admin is writing a search to find all web requests from users who have been flagged in a 'threat_intel' sourcetype. The web requests are in the 'web' sourcetype. The admin writes: index=main sourcetype=web [search index=main sourcetype=threat_intel | fields user_ip]. What is the purpose of the sub-search in this query?

   • ATo limit the number of results returned by the outer search
   • BTo return a list of user IPs that the outer search uses to filter web requests
   • CTo combine the fields from both sourcetypes into a single result set
   • DTo return the raw events from the threat_intel sourcetype that are then displayed in the results
   Reveal Solution Discussion Select an answer first