SPLK-1004 Practice Test 1 — 10 Questions

Question 1

What is the result of 'transaction' command compared to 'stats'?

Accepted Answer

Transaction groups events by time and common fields.. Transaction groups events into a single entity based on shared fields and time constraints.

Answer

Transaction is for reporting only.

Answer

Transaction is always faster than stats.

Answer

Stats can only be used with time.

Question 2

When creating a calculated field, what does the 'EVAL-' prefix in props.conf indicate?

Accepted Answer

It indicates a calculated field definition.. The 'EVAL-' prefix tells Splunk that the following expression should be evaluated as a calculated field.

Answer

It identifies a field for a lookup table.

Answer

It marks the field as a source for an alias.

Answer

It forces the field to be indexed.

Question 3

You have a field 'ip_address' and want to tag it with 'internal' for specific subnets. What is the most efficient way to manage this?

Accepted Answer

Create an event type for the subnet, then tag the event type.. Event types can be used to label the subnets, and then tags can be applied to those event types.

Answer

Manually tag every IP event one by one.

Answer

Write a search that updates the raw data.

Answer

Use a calculated field to add the tag.

Question 4

When using the 'inputfields' parameter in a lookup definition, what happens?

Accepted Answer

It maps search-time fields to lookup table columns.. The inputfields parameter defines which fields in your search results should map to the fields in the lookup table.

Answer

It restricts the output fields to only those specified.

Answer

It hides the lookup results from unauthorized users.

Answer

It automatically indexes the lookup data.

Question 5

Which configuration file would you modify to assign a tag to a field-value pair manually?

Accepted Answer

tags.conf. tags.conf is the configuration file where manual tag assignments are stored.

Answer

props.conf

Answer

eventtypes.conf

Answer

transforms.conf

Question 6

You defined a lookup that is not working. You verified the CSV exists and the app permissions are correct. What search-time troubleshooting step should you perform?

Accepted Answer

Verify the lookup is applied to the correct sourcetype in props.conf.. Checking the 'sourcetype' settings in props.conf is crucial to ensure the lookup is actually applied to the data.

Answer

Check the indexer logs for 'lookup_failure'.

Answer

Rebuild the tsidx files.

Answer

Run a search with 'metadata' command.

Question 7

Which of the following best describes the difference between an event type and a tag?

Accepted Answer

Event types group events by search criteria, while tags label field values.. Event types group events based on search strings, while tags are simple key-value pairs used to label events.

Answer

Event types are only for reports, while tags are for dashboard panels.

Answer

Event types only work in the search bar.

Answer

Tags are faster than event types for searching.

Question 8

Which TWO of the following are valid lookup types?

Accepted Answer

KV Store lookup.. CSV lookups and KV Store lookups are two of the most common types in Splunk.

Answer

Raw log lookup.

Answer

SQL lookup.

Answer

TXT file lookup.

Question 9

How do you extract a portion of a string using 'eval'?

Accepted Answer

eval new = substr(old, 1, 5). The 'substr' function extracts a substring based on start and length indices.

Answer

eval new = cut(old, 1, 5)

Answer

eval new = slice(old, 1, 5)

Answer

eval new = extract(old, 1, 5)

Question 10

Which THREE of the following items are configured in props.conf?

Accepted Answer

Field alias.. props.conf is the central hub for search-time configuration, including extractions, aliases, and lookups.

Answer

Index retention policy.

Answer

Search head distribution.