Splunk · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which permission setting is required for other users to use a lookup table you have created?
Owner-only
System-only
Private
App or Global
Sharing a lookup requires its permissions be set to App or Global, which grants all users of that app, or every user, read access to the lookup definition and file. Private or user-scoped settings restrict it to the owner, blocking other users.
Where is the most appropriate place to check for errors related to a failed lookup execution?
The _internal index
Splunk writes internal diagnostic messages, including lookup execution failures and search errors, to the _internal index. Searching there surfaces the specific error details, unlike the _audit index, which records user activity rather than processing faults.
The Splunk Web UI dashboard
The lookup csv file
The savedsearches.conf file
You need to update a lookup table periodically using the output of a scheduled search. Which command is required to write the search results to the lookup file?
lookup_update
outputlookup
outputlookup writes search results into a specified lookup file, overwriting or appending as configured. A scheduled search running this command therefore refreshes the CSV lookup periodically, satisfying the requirement to update the table from search output.
inputlookup
lookup
You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?
The lookup is set to read-only.
The lookup is shared globally.
The lookup table file is too large.
Field name mismatch between event and lookup.
Automatic lookups join on field names, so if the event field and lookup table column differ, no match occurs and the lookup returns nothing. Verifying the definition and rule would not reveal this, making a field name mismatch the most likely cause of the failure.
You need to ensure that an alert notifies a specific team via email only when the number of errors exceeds 50 in 5 minutes. What is the correct way to implement this?
Set trigger condition to 'greater than' 50 results in 5 minutes.
Setting the trigger condition to greater than 50 results within a five-minute window fires the alert only when the error count exceeds the threshold, satisfying the stem's requirement for email notification on that specific condition.
Enable 'Real-time' alert mode.
Use a cron expression of */5.
Configure the 'Action' to 'Email'.
A user wants to restrict an alert to trigger only once per hour, even if the search returns results every minute. Which setting should be modified?
Throttling
Throttling suppresses alert actions for a defined window after the first trigger, so subsequent search results within that period generate no further notifications. Setting a one-hour throttle satisfies the requirement of one alert per hour despite minute-by-minute results.
Cron schedule
Alert frequency
Trigger conditions
Want more Lookups And Alerts practice?
Practice this domainWhich CIM data model should be used to normalize authentication data?
Change Analysis
Network Traffic
Authentication
The Authentication data model normalises login, logout and authentication-failure events across sources into a common schema, so disparate auth logs become consistently searchable. Selecting it satisfies the stem's requirement to normalise authentication data rather than merely search it raw.
A user reports that a data model acceleration summary is 'incomplete'. What is the most likely cause?
The user does not have 'admin' permissions
The root search uses a lookup
The model is too large for the disk
The summary search has not completed its initial scan of the historical data
Acceleration builds its summary by running a scheduled search across the full historical time range. Until that initial scan finishes, the summary covers only part of the data, so Splunk reports it as incomplete rather than fully built.
You want to extend a data model object to include new fields. Which object type allows you to add child objects that inherit base constraints?
Lookup object
Child object
Child objects extend a parent data model object by inheriting its base constraints, such as field definitions and search restrictions, while adding new fields of their own. This inheritance satisfies the requirement to extend the object without redefining existing constraints, making child objects the appropriate type for adding inheritable fields.
Event object
Pivot object
What is the primary benefit of using a Data Model over standard raw search results in Pivot?
They provide faster performance for large datasets
Data Models pre-compute and store summarised results through acceleration, so Pivot queries read compact tsidx summaries rather than scanning raw events. This satisfies the stem's performance constraint, delivering markedly faster response times across large datasets than equivalent raw searches.
They allow for raw log access only
They are always real-time
They provide better data security
When configuring a CIM-compliant data model, what happens if a field is tagged but the event type is not associated with the model?
The model will use default values
The model will trigger a warning
The data will not appear in the data model
Data model inclusion requires both the field to be tagged with the model's field name and the event type to be added to the model's constraints. Without the event type association, the search returns no results, so tagged fields alone do not populate the model.
The search will automatically include all indexed events
You are creating a new data model and need to define a root object that includes only events where the field 'status' is '200'. Which feature should be used to restrict this data?
Pivot filter
Data model root search
A data model root search defines the base dataset for the root object, so adding a search filter such as status=200 restricts which events the object contains. This satisfies the requirement to include only events where status equals 200.
Accelerate command
CIM mapping
Want more Data Models And CIM practice?
Practice this domainWhen configuring a field alias in props.conf, which of the following is true?
The alias appears in the 'interesting fields' list.
A field alias created in props.conf with FIELDALIAS- produces a new search-time field name that Splunk lists among interesting fields, because it is extracted and selectable like any other. This satisfies the question's constraint about alias visibility in the interface.
The alias name must be identical to the original field name.
The alias is applied before field extraction.
The alias must reference an external CSV.
What is the primary benefit of creating an Event Type?
To increase indexing performance.
To automate the ingestion of new data.
To hide events from unauthorized users.
To easily identify and group specific sets of events.
Event types apply a saved search that tags matching events with a named type, letting users reference that group by name in searches and other objects. This directly satisfies the stem's requirement to identify and group specific sets of events without rewriting the underlying search each time.
You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?
Calculated Field
Event Type
Field Lookup
Field Lookup maps a key field to a lookup definition, returning the corresponding descriptive value from a CSV or KV Store lookup table. This directly satisfies the requirement to translate numerical status codes into human-readable text, and is the documented Splunk method for enriching events with external reference data.
Field Alias
You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?
props.conf
props.conf defines sourcetype-level settings, including automatic lookups that Splunk applies to every event of that sourcetype during search-time field extraction. Configuring the lookup there satisfies the requirement that it run automatically for every search on the specified sourcetype.
indexes.conf
lookups.conf
transforms.conf
savedsearches.conf
Which of the following best describes the difference between an event type and a tag?
Event types group events by search criteria, while tags label field values.
Event types classify events by matching search criteria against indexed data, dynamically grouping results at search time. Tags, by contrast, apply static labels to specific field-value pairs, enabling quick filtering without re-evaluating a search. This distinction satisfies the stem's requirement to differentiate their grouping and labelling roles.
Event types are only for reports, while tags are for dashboard panels.
Event types only work in the search bar.
Tags are faster than event types for searching.
You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?
The underlying extracted fields are not indexed.
The source fields required for the calculation are not extracted.
A calculated field only evaluates when its source fields exist in the event; if regex extraction never populated them, the calculation silently returns nothing. This satisfies the stem's constraint that missing extracted source fields cause the calculation to disappear.
The lookup table is not defined.
The user lacks the 'can_run_calculated_fields' capability.
Want more Field Management And Calculated Fields practice?
Practice this domainHow do you calculate the percentage of total events for each status code?
stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100
eventstats computes the sum of all per-status counts and appends that total to every row, letting eval divide each count by the grand total and multiply by 100. This yields each status code's percentage of all events without collapsing the per-status breakdown.
stats count(status) as total
stats count by status | eval percent = count/total
chart count by status | addtotals
When using 'chart', what is the behavior if you do not specify a 'by' clause?
It returns an error.
It creates a single-series chart for the entire result set.
Omitting the 'by' clause collapses all results into one aggregation group, so 'chart' renders a single series spanning the whole result set rather than splitting values across multiple series. This satisfies the stem's constraint of no split-by field being supplied, producing one aggregated series instead of per-category series.
It defaults to the first field found.
It returns the same as 'stats'.
Which command is used to remove a field from the search results?
eval field_name = null
fields - field_name
The fields command with a minus sign removes the named field from results, using the same field-selection syntax as the plus form. This satisfies the requirement to strip a field from the returned events without altering the underlying indexed data.
drop field_name
delete field_name
You are correlating two searches. What is the primary advantage of using 'join' over 'lookup'?
Lookups cannot be used with stats.
Joins are faster than lookups.
Joins are automatically cached.
Joins allow for subsearch results to be mapped to the primary search results dynamically.
Join performs a subsearch and dynamically matches returned fields against events in the primary search at runtime, so correlation adapts to whatever the subsearch yields. Lookup instead matches against a static CSV or KV Store file, which cannot reflect live subsearch results.
You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?
stats list(user) by department
stats values(user) by department
stats dc(user) by department
dc(user) is the distinct count function, returning the number of unique user values. Grouping with by department produces one row per department, giving the unique user count for each, which is precisely what the requirement asks.
stats count(user) by department
What is the purpose of 'streamstats' compared to 'stats'?
It computes aggregates for each event based on current and previous events.
streamstats computes aggregates incrementally, adding each event's values to the running calculation as the search progresses, so every event carries a result reflecting itself and all preceding events. stats instead collapses the whole result set into one row per group.
It can only be used with time-series data.
It is faster for large datasets.
It computes aggregates over the entire search result set.
Want more Transforming Commands And Formatting practice?
Practice this domainWhen creating a workflow action, what is the 'Label' field used for?
The internal name used in configurations
The field name to which the action is attached
The search query executed by the action
The name shown in the user interface
The Label field supplies the human-readable name displayed for the workflow action in the Splunk interface, letting users identify the action when configuring alerts or reports. It is purely presentational and does not affect the action's underlying command or execution logic.
Where are search macros primarily stored within the Splunk configuration file system?
props.conf
transforms.conf
savedsearches.conf
macros.conf
Search macros are defined as stanza entries in macros.conf, which Splunk reads from its configuration file system to resolve macro names during search processing. This file is the designated location for macro definitions, satisfying the stem's question about where macros are primarily stored.
A user has defined a macro with the argument 'user_id'. When calling the macro, the user provides the value 'admin'. How should the macro be invoked in the search bar?
$my_macro(admin)$
[my_macro admin]
my_macro:admin
`my_macro(admin)`
Macro arguments are passed positionally as bare values inside the parentheses, so the literal value admin is supplied without quotes or the argument name. Splunk substitutes it for user_id at execution, matching the defined argument order.
You need to create a search macro that accepts one argument. How should you define the argument in the macro definition field?
Using dollar signs like $arg1$
Dollar-sign delimiters, such as $arg1$, are Splunk's required syntax for declaring arguments inside a search macro definition. The stem's constraint of exactly one argument is satisfied by naming a single token this way; Splunk substitutes the supplied value at execution. Bare names or other delimiters are not parsed as arguments.
Using angle brackets like <arg1>
Using curly braces like {arg1}
Using percent signs like %arg1%
What happens if a macro name conflicts with a Splunk search command name?
The macro will override the search command
The search command takes precedence
A macro name that collides with a built-in search command is shadowed, because Splunk resolves command tokens before macro expansion. The command therefore executes, and the macro is never invoked. This satisfies the stem's conflict scenario: command precedence overrides the macro definition, so the macro's arguments and definition remain unused.
Splunk will throw a syntax error during search execution
The search will fail to initialize
When configuring a workflow action of type 'GET', what is the purpose of the 'Link URI' field?
To provide the target URL for the GET request
Link URI supplies the destination address the browser or client requests when the workflow action fires. For a GET action, that URL defines the endpoint receiving the request, directly fulfilling the stem's requirement to specify where the GET is sent.
To set the HTTP header for the request
To define the search query that the workflow action runs
To identify which index the data should be retrieved from
Want more Macros And Workflow Actions practice?
Practice this domainA dashboard user reports that a drilldown is not passing the expected token to a target dashboard. The source panel uses a chart where the click event is defined. Which configuration detail should you verify first?
Check if the target dashboard has a Time Range Picker.
Verify the 'click.value' property is correctly set to the field name.
In Simple XML drilldowns, click.value carries the clicked field's value into the token; if it references the wrong field name, the target dashboard receives an empty or incorrect token. Verifying this property first isolates the most common token-passing misconfiguration.
Rebuild the summary index.
Ensure the user has write permissions to the target dashboard.
You want to create a dropdown input that populates based on search results. Which XML element is required to define the source of the search for the input?
<data>
<search>
The `<search>` element supplies the query whose results populate the dropdown, satisfying the requirement to define the search source. Without it, the input has no data origin. Other elements such as `<fieldForLabel>` or `<choice>` only map or display values; they cannot execute the search themselves.
<populate>
<query>
When using the 'post-process' search feature in a dashboard, what is the main benefit?
It enables the use of macros in the search string.
It allows for real-time streaming of events.
It allows the search to bypass the indexer entirely.
It shares a single base search across multiple panels to reduce load.
Post-process searches reuse one base search's results, so multiple dashboard panels run their own refining queries against that cached result set rather than re-scanning the full index. This directly satisfies the stem's load-reduction benefit, cutting search cost and time across panels.
Which Splunk tool should you use to identify specific search components that are consuming excessive CPU or I/O resources?
The Search Inspector
Deployment Server logs
Splunk Web Index Status
Monitoring Console: Search Activity Dashboard
The Search Activity Dashboard in the Monitoring Console reports per-search CPU, disk and memory usage, isolating the individual searches consuming excessive resources. Other Monitoring Console views aggregate at the instance or indexer level, so they cannot attribute load to specific search components.
When creating a dashboard token, what is the correct syntax for referencing it in a search string?
@token_name@
{{token_name}}
$token_name$
Dashboard tokens are referenced in search strings by wrapping the token name in dollar signs, so $token_name$ is substituted with the token's current value at runtime. This is the syntax Splunk uses for token replacement in searches and panel definitions.
%token_name%
What is the primary performance difference between using a 'lookup' command and a 'join' command?
Lookups are executed in memory, while joins use the disk.
Joins are faster for large datasets.
Lookups are more efficient than joins for matching related data.
Lookups match against a prebuilt lookup table held in memory, avoiding the join's subsearch and per-event row comparison. This makes lookups markedly more efficient for enriching events with related data, satisfying the performance constraint in the stem.
They perform the same.
Want more Search Tuning Performance And Dashboards practice?
Practice this domainThe SPLK-1004 exam has 70 questions and must be completed in 60 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Lookups And Alerts, Data Models And CIM, Field Management And Calculated Fields, Transforming Commands And Formatting, Macros And Workflow Actions, Search Tuning Performance And Dashboards. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-1004 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.