Splunk · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which permission setting is required for other users to use a lookup table you have created?
Owner-only
System-only
Private
App or Global
Shared permissions enable usage by other users.
Where is the most appropriate place to check for errors related to a failed lookup execution?
The _internal index
Lookup errors are logged to the _internal index.
The Splunk Web UI dashboard
The lookup csv file
The savedsearches.conf file
You need to update a lookup table periodically using the output of a scheduled search. Which command is required to write the search results to the lookup file?
lookup_update
outputlookup
This writes results to a lookup file.
inputlookup
lookup
You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?
The lookup is set to read-only.
The lookup is shared globally.
The lookup table file is too large.
Field name mismatch between event and lookup.
Automatic lookups require exact field name matching unless aliases are used.
You are performing a lookup with a large CSV file and notice poor performance. Which feature can optimize the lookup performance?
Splitting the lookup file
Lookup indexing
Lookup indexing optimizes lookup performance for large files.
Increasing the memory limit
Compressing the lookup file
You need to ensure that an alert notifies a specific team via email only when the number of errors exceeds 50 in 5 minutes. What is the correct way to implement this?
Set trigger condition to 'greater than' 50 results in 5 minutes.
This is the standard trigger configuration for threshold-based alerts.
Enable 'Real-time' alert mode.
Use a cron expression of */5.
Configure the 'Action' to 'Email'.
Want more Lookups And Alerts practice?
Practice this domainWhen configuring a field alias in props.conf, which of the following is true?
The alias appears in the 'interesting fields' list.
Aliases are treated as fields and appear in the field picker.
The alias name must be identical to the original field name.
The alias is applied before field extraction.
The alias must reference an external CSV.
What is the primary benefit of creating an Event Type?
To increase indexing performance.
To automate the ingestion of new data.
To hide events from unauthorized users.
To easily identify and group specific sets of events.
Grouping is the core purpose of event types.
You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?
Calculated Field
Event Type
Field Lookup
Lookups are designed for data enrichment based on key values.
Field Alias
You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?
props.conf
props.conf is where the lookup definition is applied to the data stream.
indexes.conf
lookups.conf
transforms.conf
savedsearches.conf
Which of the following best describes the difference between an event type and a tag?
Event types group events by search criteria, while tags label field values.
Event types are saved searches; tags are labels for field-value pairs.
Event types are only for reports, while tags are for dashboard panels.
Event types only work in the search bar.
Tags are faster than event types for searching.
You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?
The underlying extracted fields are not indexed.
The source fields required for the calculation are not extracted.
Calculated fields cannot evaluate if the input fields are missing.
The lookup table is not defined.
The user lacks the 'can_run_calculated_fields' capability.
Want more Field Management And Calculated Fields practice?
Practice this domainHow do you calculate the percentage of total events for each status code?
stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100
This uses eventstats to calculate the total across all rows for the percentage calculation.
stats count(status) as total
stats count by status | eval percent = count/total
chart count by status | addtotals
Which command would you use to rename a field to a more readable name in the middle of a search pipeline?
fieldformat old_name = new_name
rename old_name as new_name
This is the correct syntax for renaming fields.
alias old_name = new_name
eval new_name = old_name
When using 'chart', what is the behavior if you do not specify a 'by' clause?
It returns an error.
It creates a single-series chart for the entire result set.
Without a 'by' clause, it aggregates the entire result set into one value.
It defaults to the first field found.
It returns the same as 'stats'.
Which command is used to remove a field from the search results?
eval field_name = null
fields - field_name
The minus sign explicitly excludes the field.
drop field_name
delete field_name
You are correlating two searches. What is the primary advantage of using 'join' over 'lookup'?
Lookups cannot be used with stats.
Joins are faster than lookups.
Joins are automatically cached.
Joins allow for subsearch results to be mapped to the primary search results dynamically.
Joins allow joining a results set from a subsearch to the primary search.
You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?
stats list(user) by department
stats values(user) by department
stats dc(user) by department
The dc() function correctly identifies distinct counts.
stats count(user) by department
Want more Transforming Commands And Formatting practice?
Practice this domainA dashboard user reports that a drilldown is not passing the expected token to a target dashboard. The source panel uses a chart where the click event is defined. Which configuration detail should you verify first?
Check if the target dashboard has a Time Range Picker.
Verify the 'click.value' property is correctly set to the field name.
The click.value property maps the clicked element to the token variable.
Rebuild the summary index.
Ensure the user has write permissions to the target dashboard.
You have a dashboard with a form input that triggers a search. To prevent the search from running automatically when the page loads, which attribute must you configure?
runOnSubmit="true"
initialization="manual"
autoRun="false"
searchWhenChanged="false"
This attribute controls whether the search fires upon input initialization.
A user wants to pass multiple values from a multiselect input to a search. Which option must be enabled in the input configuration for the token value to be formatted correctly for an 'IN' clause?
valuePrefix/valueSuffix
These attributes surround each value in the multiselect array.
searchable
delimiter
tokenFormatter
You are investigating a slow-running search that uses a subsearch. Which of the following is the most effective way to optimize the subsearch performance by limiting the result set returned to the outer search?
Use the limit command to filter results to 1000.
Use the return command to specify the exact number of results to pass.
The return command allows you to define the number of results and specific fields to return.
Apply the fields command before the subsearch ends.
Convert the subsearch into a join command.
You want to create a dropdown input that populates based on search results. Which XML element is required to define the source of the search for the input?
<data>
<search>
The <search> tag defines the query for populating dropdowns or radio buttons.
<populate>
<query>
When using the 'post-process' search feature in a dashboard, what is the main benefit?
It enables the use of macros in the search string.
It allows for real-time streaming of events.
It allows the search to bypass the indexer entirely.
It shares a single base search across multiple panels to reduce load.
Post-processing is specifically designed to reuse base search results.
Want more Search Tuning Performance And Dashboards practice?
Practice this domainWhen creating a workflow action, what is the 'Label' field used for?
The internal name used in configurations
The field name to which the action is attached
The search query executed by the action
The name shown in the user interface
The label provides the user-facing text displayed in the field menu.
Where are search macros primarily stored within the Splunk configuration file system?
props.conf
transforms.conf
savedsearches.conf
macros.conf
Macros are explicitly defined in the macros.conf file.
A user has defined a macro with the argument 'user_id'. When calling the macro, the user provides the value 'admin'. How should the macro be invoked in the search bar?
$my_macro(admin)$
[my_macro admin]
my_macro:admin
`my_macro(admin)`
The correct syntax for invoking a macro with arguments is backticks surrounding the macro name and its parameters in parentheses.
You need to create a search macro that accepts one argument. How should you define the argument in the macro definition field?
Using dollar signs like $arg1$
Splunk uses the $name$ syntax to define variables within a macro definition.
Using angle brackets like <arg1>
Using curly braces like {arg1}
Using percent signs like %arg1%
What happens if a macro name conflicts with a Splunk search command name?
The macro will override the search command
The search command takes precedence
Built-in commands have higher precedence than user-defined macros, causing the macro to be ignored.
Splunk will throw a syntax error during search execution
The search will fail to initialize
When configuring a workflow action of type 'GET', what is the purpose of the 'Link URI' field?
To provide the target URL for the GET request
The Link URI field is the destination URL for a GET-type workflow action.
To set the HTTP header for the request
To define the search query that the workflow action runs
To identify which index the data should be retrieved from
Want more Macros And Workflow Actions practice?
Practice this domainWhich CIM data model should be used to normalize authentication data?
Change Analysis
Network Traffic
Authentication
Authentication is specifically designed for user identity and access events.
A user reports that a data model acceleration summary is 'incomplete'. What is the most likely cause?
The user does not have 'admin' permissions
The root search uses a lookup
The model is too large for the disk
The summary search has not completed its initial scan of the historical data
Acceleration takes time; until the historical window is processed, the status is incomplete.
You have a data model that is failing to accelerate. Where should you check to verify if the summary index files are being created successfully?
The 'splunkd.log' file exclusively
The 'Indexes' page in Settings
Settings > Data Models > Audit
The 'Data Model Audit' dashboard in the CIM app
The CIM app provides built-in dashboards to monitor acceleration status.
You want to extend a data model object to include new fields. Which object type allows you to add child objects that inherit base constraints?
Lookup object
Child object
Child objects inherit constraints from their parent.
Event object
Pivot object
What is the primary benefit of using a Data Model over standard raw search results in Pivot?
They provide faster performance for large datasets
Acceleration creates summary files that drastically speed up reporting.
They allow for raw log access only
They are always real-time
They provide better data security
When configuring a CIM-compliant data model, what happens if a field is tagged but the event type is not associated with the model?
The model will use default values
The model will trigger a warning
The data will not appear in the data model
If the event type mapping is missing, the CIM infrastructure ignores the event.
The search will automatically include all indexed events
Want more Data Models And CIM practice?
Practice this domainThe SPLK-1004 exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Lookups And Alerts, Field Management And Calculated Fields, Transforming Commands And Formatting, Search Tuning Performance And Dashboards, Macros And Workflow Actions, Data Models And CIM. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-1004 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.