SPLK-1004 Practice Test 12 — 15 Questions

Question 1

A power user has a lookup definition named `asset_lookup` that maps `host` to `owner` and `location`. In a search they run `| lookup asset_lookup host OUTPUT owner` and notice that the `location` field is absent from the results even though the CSV contains it. What is the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The OUTPUT clause lists only `owner`, so only that field is returned from the lookup.. The lookup command attaches only the fields explicitly named in its OUTPUT clause. Since the search lists just owner, the location column is never copied onto the events, regardless of what the CSV or lookup definition contains. Adding location to the OUTPUT list resolves the problem.

Answer

The lookup definition was created without the location field in its field list.

Answer

The location column contains null values for the matched hosts.

Answer

A field alias for location overrides the lookup output and hides the field.

Question 2

A team is standardizing a lookup file `product_catalog.csv` that maps `product_id` to `product_name`, `category`, and `list_price`. They want searches to automatically enrich events that contain a matching `product_id`. Which two configurations accomplish this automatic enrichment? (Choose two.)

Accepted Answer

Define the lookup in transforms.conf with `filename = product_catalog.csv` and reference it from props.conf with `LOOKUP-product = product_lookup product_id OUTPUT product_name, category, list_price`.. Automatic enrichment requires a lookup definition plus an automatic lookup binding. Writing the transforms.conf stanza and props.conf LOOKUP- reference directly, or using the Settings > Lookups workflow that generates those same stanzas, both cause matching events to be enriched at search time without an explicit lookup command.

Answer

Add `EVAL-product_name = lookup(product_catalog.csv, product_id, product_name)` to props.conf for the sourcetype.

Answer

Run `| lookup product_catalog.csv product_id OUTPUT product_name, category, list_price` at the end of each relevant search.

Answer

Import the CSV as a KV Store collection and enable automatic enrichment on the collection.

Question 3

A dashboard panel's search reads 12 GB from disk but returns only 4,000 events. In Search Inspector, which metric should you investigate first to reduce unnecessary disk reads?

Accepted Answer

The 'Disk Usage' metric showing bytes read from disk. Search Inspector provides a Disk Usage metric that reports how much data the search read from disk. A large read volume with a small result set indicates the search is scanning far more raw data than necessary. Addressing this by narrowing the time range, adding indexed field filters, or using summary indexes directly reduces disk reads and improves performance.

Answer

The 'Result Count' metric showing the number of returned events

Answer

The 'Execution Cost' metric indicating CPU time spent

Answer

The search's 'bucket' count in the Search Inspector's 'Performance' section

Question 4

A Splunk administrator defines a calculated field in props.conf with EVAL-total_bytes that sums two extracted fields, bytes_in and bytes_out. After saving, searches on the sourcetype still do not show total_bytes, although bytes_in and bytes_out appear correctly. The administrator confirms the stanza name matches the sourcetype exactly. Which of the following is the most likely explanation?

Accepted Answer

The calculated field was defined in a props.conf file that is not in the app context currently applied to the search, or the knowledge objects have not been reloaded.. Calculated fields are app-scoped knowledge objects, so a props.conf defined in one app is not visible to searches running in another app's context. Even within the correct app, the configuration must be reloaded or the search head restarted for changes to take effect. When the stanza name and expression are correct but the field is still missing, app context and configuration reload are the prime suspects.

Answer

The EVAL expression uses field names that are not yet extracted at the point the calculated field is evaluated, so the calculation yields null.

Answer

The field name total_bytes is a reserved Splunk internal field and is silently dropped from calculated field output.

Answer

Calculated fields cannot sum numeric fields; they only support string concatenation and conditional expressions.

Question 5

A dashboard panel shows a timechart of web request latency, and users want to click a point on the chart to open a new search in a separate window that lists the individual slow requests for that time. Which dashboard feature should you configure to enable this behavior?

Accepted Answer

A drilldown defined on the chart with a link to a search that uses the clicked time as a token.. The requirement is an interactive, click-driven action that opens a detail search for a selected point. Drilldown configuration on the chart is the dashboard feature designed for this: it captures the clicked value, such as a timestamp, and passes it as a token to a target search that can open in a new window, showing the underlying slow requests.

Answer

A scheduled alert that triggers when latency exceeds a threshold.

Answer

A post-process search that reuses the panel's base search results.

Answer

A token set by an input element that filters the dashboard's time range.

Question 6

A Splunk power user is creating a report that requires calculating the running total of sales amounts over time, and also needs to include the overall average sales amount for each region on every row. Which two commands can be used together to achieve this? (Choose two.)

Accepted Answer

eventstats. To calculate a running total of sales amounts, 'streamstats' is the appropriate command because it processes events sequentially and can compute cumulative sums. To include the overall average sales amount per region on every row, 'eventstats' is needed because it calculates aggregations across all events and appends the result to each event without collapsing them. Used together, they provide both the running total and the per-region average on each row, meeting the report's requirements.

Answer

stats

Answer

addtotals

Answer

transaction

Question 7

How do you add a total row to a stats table?

Accepted Answer

addtotals. The `addtotals` command is specifically designed to append a summary row (or column) to the results of a statistical aggregation, such as those produced by `stats` or `chart`. It computes the sum of each numeric field across all result rows and adds a new row labeled 'Total' at the bottom. This is the standard SPL approach for adding totals to a stats table without altering the underlying aggregation logic.

Answer

addsum

Answer

eval total = sum(field)

Answer

stats total

Question 8

A power user needs to identify which dashboard panels are consuming the most resources and slowing down the dashboard. Which Splunk feature should the user consult to view the search job details, including execution time and resource usage, for each panel's search?

Accepted Answer

The Search Job Inspector for each panel's search.. The Search Job Inspector is the correct tool to view detailed performance metrics for a specific search, including those run by dashboard panels. It shows execution time, resource usage, and search optimization details. By accessing it from a panel's menu, the user can analyze each panel's search individually and identify bottlenecks. The other options either do not exist or do not provide the same level of per-panel detail.

Answer

The 'Job' menu in the Search app, filtered by dashboard name.

Answer

The Monitoring Console's 'Search' menu under 'Search Activity'.

Answer

The Dashboard Editor's 'Performance' tab.

Question 9

A security analyst creates a data model named 'WebTraffic' with a root event object based on the 'Web' dataset. They add a child object 'FailedLogins' that filters on status=401. After acceleration, a dashboard using this data model returns no results for a specific time range. What is the most likely reason?

Accepted Answer

The child object 'FailedLogins' inherits the constraints of the root object, but the root object's constraints may exclude the events with status=401.. Child objects in a data model inherit all constraints from their parent objects. If the root event object has a constraint that filters out events with status=401, the child object 'FailedLogins' will never see those events, leading to no results. This is a frequent pitfall when designing hierarchical data models.

Answer

The data model acceleration summary only includes events from the last 24 hours by default.

Answer

The 'tstats' command cannot query child objects directly; you must query the root object and filter manually.

Answer

The data model acceleration summary is incomplete because the search head did not have enough disk space.

Question 10

A Splunk administrator is creating a workflow action that will appear when a user clicks on a field value in search results. The action should open a new browser tab and pass the field value to an external ticketing system via a URL. The administrator wants to ensure that the field value is properly URL-encoded and that the action is only available for events where the field `status` equals `open`. Which of the following configurations will achieve this?

Accepted Answer

Set the workflow action type to 'link', set the URI to the external system's URL with `$status|u$` appended, and add a condition `status=open`.. To open an external URL with a field value, the workflow action type must be 'link', and the field value should be URL-encoded using the `|u` filter to ensure it is safe for transmission. The condition `status=open` restricts the action to relevant events. This combination satisfies the requirement to open a new tab and pass the encoded value to the ticketing system.

Answer

Set the workflow action type to 'search', set the URI to the external system's URL with `$status$` appended, and add a condition `status=open`.

Answer

Set the workflow action type to 'link', set the URI to the external system's URL with `$status$` appended, and add a condition `status=open`.

Answer

Set the workflow action type to 'link', set the URI to the external system's URL with `$status$` appended, and add a condition `status="open"`.

Question 11

You are using the Search Job Inspector to diagnose a slow search. You notice that the 'execution costs' show a high value for 'bucket_count' and 'disk_usage'. Which action is most likely to reduce these costs?

Accepted Answer

Narrow the search's time range to reduce the number of buckets scanned.. In the Search Job Inspector, execution costs like bucket_count and disk_usage indicate how many index buckets were read and how much data was scanned. Narrowing the time range directly reduces the number of buckets that fall within the search window, thereby lowering both metrics. This is the most effective way to reduce these specific costs.

Answer

Use the fillnull command to replace missing values in the results.

Answer

Increase the search head's memory allocation to cache more buckets.

Answer

Add more fields to the search's output using the table command.

Question 12

A Splunk user needs to add a field that indicates whether a response time is above or below a threshold of 500 milliseconds. The events contain a field named response_time. Which eval function should they use to create a new field called performance_category with values 'slow' or 'fast'?

Accepted Answer

eval performance_category=if(response_time > 500, "slow", "fast"). The if function is the correct choice for a simple conditional that returns one of two values based on a boolean expression. It takes three arguments: condition, value if true, and value if false. This matches the requirement to classify response times as 'slow' or 'fast' based on a 500ms threshold.

Answer

eval performance_category=validate(response_time > 500, "slow", "fast")

Answer

eval performance_category=case(response_time > 500, "slow", "fast")

Answer

eval performance_category=coalesce(response_time > 500, "slow", "fast")

Question 13

A Splunk administrator is troubleshooting a data model that has been accelerated for several months. Users report that recent data is missing from Pivot reports, but older data is present. The acceleration summary files exist and are not corrupt. What should the administrator check first?

Accepted Answer

The data model's acceleration time range setting, to ensure it covers the current time period.. The acceleration time range setting controls the period covered by the summary. If it is set to a fixed window that does not include the present, recent data will be absent. Administrators should verify this setting and adjust it to cover the desired time range, such as 'All time' or a rolling window.

Answer

The indexer's disk space, because if the disk is full, new events are not indexed and thus not accelerated.

Answer

The data model's acceleration schedule, to ensure it runs frequently enough to capture new data.

Answer

The search head's clock synchronization, as time skew can cause recent events to be indexed with future timestamps.

Question 14

A team is building a workflow action that will appear when an analyst clicks a `dest_ip` field in search results. They want the action to open an internal ticketing system, pre-filling the ticket form with the destination IP and the event's timestamp. Which two configuration elements are required for this workflow action to function? (Choose two.)

Accepted Answer

A Link URI that contains the field tokens `$dest_ip$` and `$timestamp$` where the values should be inserted.. A workflow action needs a Link URI containing the tokens to substitute and a field name that determines where the action is offered. Together these let the analyst click a destination IP and open a ticketing form pre-filled with that IP and the event timestamp. Macros, scheduled searches, and field mappings are not required for this behavior.

Answer

A scheduled search that periodically refreshes the ticketing system's field list.

Answer

A search macro that validates the `dest_ip` and `timestamp` values before the action runs.

Answer

A `props.conf` stanza that maps `dest_ip` to the ticketing system's expected field name.

Question 15

A Splunk administrator is troubleshooting why a data model acceleration summary for the 'Network_Traffic' data model is not returning results for a specific time range, even though the data model is accelerated and the search head is healthy. The administrator checks the acceleration settings and sees that the acceleration is enabled with a summary range of 7 days. The search is for the last 30 days. What is the most likely cause of the missing results?

Accepted Answer

The acceleration summary only covers the last 7 days, so data older than that is not summarized and must be searched from raw data.. Data model acceleration summarizes data for a defined summary range. If the range is set to 7 days, only that period is accelerated. Searches for older data will not use the acceleration summary and may return incomplete results if the search is configured to use only accelerated data. The administrator should either extend the summary range or adjust the search to include raw data for the older period.

Answer

The acceleration summary files are corrupted and need to be rebuilt.

Answer

The 'Network_Traffic' data model does not support acceleration for time ranges longer than 7 days due to licensing restrictions.

Answer

The data model acceleration is not working because the search head is not connected to the indexers.