SPLK-1004 Practice Test 14 — 15 Questions

Question 1

What is the result of setting an alert's priority to 'High'?

Accepted Answer

It elevates the alert in the Triggered Alerts list.. In Splunk, an alert's priority setting (High, Medium, Low) does not change execution speed, resource usage, or notification behavior. It only affects the sort order in the Triggered Alerts list, elevating High-priority alerts to the top for visibility. This is purely a UI/display attribute.

Answer

It triggers faster.

Answer

It uses more CPU.

Answer

It sends extra emails.

Question 2

Which TWO are common causes for a 'transaction' command taking too long?

Accepted Answer

The number of unique group values is high.. Option B is correct because a high number of unique group values forces the search engine to create and track many distinct groups, which increases memory usage and processing time for the transaction command. Option C is correct because searching over a very large time range requires scanning more events, which directly increases the time needed to complete the transaction. Option A is incorrect because lacking admin privileges affects permissions, not transaction execution speed. Option D is incorrect because JSON is simply a data format and does not inherently slow down a transaction. Option E is incorrect because using fewer commands would generally reduce, not increase, processing time.

Answer

The user is not an admin.

Answer

The data is in JSON format.

Answer

The search uses too few commands.

Question 3

Which THREE settings can be configured for a scheduled alert?

Accepted Answer

Trigger conditions. A scheduled alert requires trigger conditions (A), which define the search query and threshold that determine when the alert fires, so this is a valid configurable setting. The cron schedule (C) is also configurable because scheduled alerts run on a recurring cadence defined by a cron expression, controlling when the alert search executes. Alert actions (E) are configurable as well, since you must specify what happens when the alert triggers, such as sending an email, invoking a webhook, or running a script. Lookup indexing (B) is not a scheduled-alert setting; lookups are separate knowledge objects used to enrich search results, not configured per alert. Data retention policy (D) is not part of an alert definition either; retention is governed by index or data lifecycle settings, not by the scheduled alert configuration.

Answer

Lookup indexing

Answer

Data retention policy

Question 4

Which THREE of the following are standard configuration files for field management?

Accepted Answer

transforms.conf. In Splunk, field management (field extraction and field transformations) is configured through transforms.conf, fields.conf, and props.conf. transforms.conf [B] defines field transformations and regex-based extractions (e.g., REGEX, FORMAT, SOURCE_KEY) that create or modify fields. fields.conf [C] controls how indexed and search-time fields are handled, particularly specifying whether a field is indexed (INDEXED=true/false) and how it is extracted at search time. props.conf [E] is where field extractions are associated with source types, hosts, or sources via TRANSFORMS and REPORT stanzas, tying the extraction logic to incoming data. The unmarked options do not belong: indexes.conf [A] configures index storage, retention, and paths, not field management, and inputs.conf [D] configures data inputs such as monitors, TCP/UDP ports, and scripted inputs, not field extraction or transformation.

Answer

indexes.conf

Answer

inputs.conf

Question 5

Which TWO are true about the 'eval' command?

Accepted Answer

It can be used to perform logical evaluations.. Option B is correct because the 'eval' command in Splunk can perform logical evaluations, such as using if(), case(), or comparison operators to produce boolean or conditional results. Option E is also correct because 'eval' is commonly used to perform math operations, including arithmetic on numeric fields or expressions, and to assign the result to a new or existing field. Option A is incorrect because 'eval' does create new fields when you specify a field name on the left side of the expression, such as 'eval total=price*qty'. Option C is incorrect because 'eval' is not a generating command; generating commands like 'makeresults' or 'tstats' create events or results, whereas 'eval' is a streaming/eval command that operates on existing results. Option D is incorrect because filtering events is done by search commands such as 'search', 'where', or 'filter', not by 'eval' itself.

Answer

It does not create new fields.

Answer

It is a generating command.

Answer

It is used to filter events.

Question 6

Which TWO of the following are true about 'eventstats'?

Accepted Answer

It calculates aggregates for each event.. Option C is correct because eventstats computes aggregate values (e.g., avg, sum, count) and then enriches each individual event with those results, effectively calculating the aggregate in the context of every event rather than collapsing them. Option D is correct because eventstats appends new fields containing the aggregate values to all events in the result set, preserving the original events while adding the computed statistics. Options A, B, and E are incorrect: eventstats is generally slower than stats because it must retain and enrich every event rather than reducing the result set; it does not remove non-aggregated fields (that describes stats behavior); and it does not replace existing events, it augments them.

Answer

It is faster than stats.

Answer

It removes non-aggregated fields.

Answer

It replaces the existing events.

Question 7

Which THREE of the following are true regarding the order of operations for search-time field extractions?

Accepted Answer

Tags are applied after all other field operations.. Option B is correct because in Splunk's search-time knowledge object processing order, tags are applied last, after all other field operations such as extraction, aliasing, calculated fields, and lookups. Option C is correct because calculated fields are evaluated after field aliases, meaning aliases are resolved first and calculated fields can then reference the aliased names. Option E is correct because field extraction occurs before field aliases, so aliases can only rename fields that have already been extracted. Option A is incorrect because lookups run after field extraction, not before, since lookups typically require extracted fields as input. Option D is incorrect because field aliases happen after field extraction, not before, as aliases depend on fields already existing from extraction.

Answer

Lookups happen before field extraction.

Answer

Field aliases happen before field extraction.

Question 8

Which TWO of the following are valid ways to improve search performance?

Accepted Answer

Filter by indexed fields as early as possible.. Option D is correct because filtering on indexed fields as early as possible lets the search engine discard non-matching events before running expensive operations, reducing the amount of data processed downstream. Option E is correct because restricting the time range limits the volume of events scanned, and since time is a default indexed field, narrowing it dramatically cuts search cost and latency. Options A and C are incorrect because join and transaction are both costly, memory-intensive commands that should be used sparingly rather than for all matching or aggregation. Option B is incorrect because leading wildcards prevent efficient index usage and force a full scan, degrading performance.

Answer

Use the join command for all data matching.

Answer

Always use wildcards at the beginning of terms.

Answer

Use the transaction command for all aggregations.

Question 9

Which THREE of the following functions are used with 'stats' to aggregate data?

Accepted Answer

max. The 'stats' command in Splunk aggregates events and supports statistical functions such as max, count, and sum. Option A (max) is correct because max returns the highest value of a numeric field across the grouped events. Option B (count) is correct because count tallies the number of events in each group, which is a core aggregation. Option E (sum) is correct because sum adds the values of a numeric field across events in each group. Option C (eval) is not a stats function; it is a separate command used to calculate or transform field values. Option D (search) is also not a stats function; it is a command used to filter events, not to aggregate them.

Answer

eval

Answer

search

Question 10

Which THREE of the following are valid ways to manage Search Macros in Splunk?

Accepted Answer

Using the REST API. Option A is correct because Splunk exposes search macros through the REST API, specifically the /servicesNS///configs/conf-macros endpoint, allowing programmatic creation, update, and deletion of macro definitions. Option D is correct because macros are stored in macros.conf, so editing this configuration file directly (followed by a reload or restart) is a valid way to manage them. Option E is correct because Splunk Web provides a Settings > Advanced Search > Search Macros page where administrators can create and edit macros through the UI. Option B is incorrect because the Indexes configuration page manages index definitions and settings, not search macros. Option C is incorrect because the Saved Searches menu manages saved searches, reports, and alerts, not search macros.

Answer

Using the 'Indexes' configuration page

Answer

Via the 'Saved Searches' menu

Question 11

Which THREE of the following are valid ways to troubleshoot a slow dashboard?

Accepted Answer

Inspect the dashboard XML for inefficient post-processing.. Option A is correct because dashboard panels often rely on post-process searches, and inefficient or overly broad post-processing defined in the dashboard XML (simple XML or dashboard studio JSON/XML) can cause slow rendering, so inspecting it reveals costly base searches and post-process chains. Option B is correct because the Monitoring Console provides dashboards such as Search Activity and Search Usage Statistics that show search duration, concurrency, skipped searches, and resource usage, which helps identify whether the slowness stems from search load or scheduling. Option E is correct because the Search Inspector (Job Inspector) exposes execution costs, including search time breakdown, command-level timings, and warnings, allowing you to pinpoint expensive commands or phases in a dashboard search. Option C is not appropriate because re-indexing all data is a drastic, unrelated action that does not address dashboard search performance and would not fix inefficient queries. Option D is not appropriate because restarting the search head is a disruptive, non-diagnostic step that does not identify or resolve the root cause of a slow dashboard.

Answer

Re-index all the data.

Answer

Restart the Splunk search head.

Question 12

You need to create a lookup that will be updated frequently with new data from a search. Which lookup type should you use to allow for fast, concurrent writes and reads?

Accepted Answer

KV Store lookup. KV Store lookups are built on MongoDB and are optimized for dynamic data with frequent updates. They support concurrent reads and writes, making them suitable for lookups that are updated regularly. CSV lookups are file-based and less efficient for frequent changes.

Answer

External lookup

Answer

CSV lookup

Answer

Automatic lookup

Question 13

A security team defines a macro `threat_lookup(2)` with arguments `$ip$` and `$severity$`. In the macro definition UI they set the validation for `$severity$` to a regular expression of `^(low|medium|high)$` and a validation error message of "Severity must be low, medium, or high." An analyst runs `| `threat_lookup("10.1.1.5", "critical")``. What is the result?

Accepted Answer

The search fails before expansion and returns the validation error message "Severity must be low, medium, or high.". Macro argument validation compares each supplied value to the configured expression before expansion. A value outside the permitted set halts expansion and returns the custom validation error message, so the analyst immediately learns that `critical` is not an accepted severity and can correct the call rather than running a search on bad input.

Answer

The macro expands and runs normally because validation is only enforced when the macro is invoked from a scheduled search.

Answer

The macro expands and runs, but `$severity$` is replaced with an empty string because the value did not match the regex.

Answer

The macro expands and runs, and Splunk logs a warning to `splunkd.log` but does not interrupt the search.

Question 14

A power user notices that a dashboard's panels each run nearly identical base searches, causing high search load. The user wants a single search to run once and have multiple panels reuse its results without re-running the search. Which approach should be used?

Accepted Answer

Define a base search in a `` element and have panels use `` referencing it.. The base search pattern runs one search and lets multiple panels reuse its cached results through the base attribute. This is the designed way to reduce duplicate search load in a dashboard. Scheduling, duplicating logic in post-process, or relying on layout grouping do not achieve a single execution shared by panels.

Answer

Place all panel visualizations inside a single `<row>` and rely on Splunk to merge their searches automatically.

Answer

Create a saved search and schedule it to run every minute, then have panels load the saved search results.

Answer

Use a `<post-process>` search in each panel that re-runs the full base search logic.

Question 15

Which command is used to display specific fields in the output?

Accepted Answer

fields. The fields command is used to display specific fields in the output of a search. By specifying fields field1, field2, you instruct Splunk to include only those fields in the results, effectively displaying just the fields you need. This is the standard SPL command for controlling which fields appear in search output.

Answer

display

Answer

select

Answer

show