SPLK-1004 Practice Test 16 — 15 Questions

Question 1

A junior analyst needs to search for events where a field named 'status_code' equals 404, but the field is only present under the name 'http_status' in the indexed data. The analyst wants to use 'status_code' in searches without changing the data or the extraction. Which of the following should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A field alias using FIELDALIAS-status_code that maps status_code to http_status.. Field aliases provide an alternate name for an existing field and are configured with FIELDALIAS-<alias> in props.conf. Mapping status_code to http_status makes the analyst's preferred name searchable without altering extraction or reindexing. This is the lightest-weight solution because it performs no computation and simply resolves the alias at search time to the original field's values.

Answer

A tag named status_code applied to events where http_status exists.

Answer

A lookup definition that maps http_status values to status_code values using a CSV file.

Answer

A calculated field using EVAL-status_code that copies the value from http_status.

Question 2

Which attribute must be set for a field to be available in a Pivot report?

Accepted Answer

Visible. For a field to appear in Pivot, it must be marked as Visible in the data model. Visibility controls whether the field is exposed to the Pivot interface for use in reports and dashboards, so C is correct.

Answer

Hidden

Answer

Indexed

Answer

Required

Question 3

You are using an automatic lookup. If you want to overwrite an existing field in your search results with a value from the lookup, which setting should be enabled?

Accepted Answer

Overwrite field values. The 'Overwrite field values' setting in an automatic lookup configuration allows values from the lookup to replace existing field values in the search results. This is necessary when you want the lookup to take precedence over fields already present in the events. Without this setting, the lookup will not overwrite existing fields.

Answer

Default values

Answer

Force match

Answer

Strict match

Question 4

You are creating a new data model and need to define a root object that includes only events where the field 'status' is '200'. Which feature should be used to restrict this data?

Accepted Answer

Data model root search. The data model root search defines the base search that constrains which events are included in the data model. By specifying a search like 'status=200' in the root event's search clause, only events matching that condition become part of the dataset. This is the correct place to restrict data at the root level.

Answer

Pivot filter

Answer

Accelerate command

Answer

CIM mapping

Question 5

A security analyst needs to correlate failed login events with subsequent successful logins from the same source IP within a 10-minute window. The raw events contain src_ip and action fields but no session identifier. Which Splunk transforming command should the analyst use to group these events into sessions based on time proximity?

Accepted Answer

transaction. The transaction command is designed to group related events into a single event based on shared field values and time constraints such as maxspan or maxpause. By setting maxpause=10m and grouping by src_ip, the analyst can correlate failed and successful logins that occur within 10 minutes, creating session-like events without needing a pre-existing session identifier.

Answer

stats

Answer

streamstats

Answer

join

Question 6

You are configuring a lookup definition named `product_owner` that uses a CSV file. The lookup contains a field `product_id` that in your event data is sometimes lowercase and sometimes uppercase. You need the lookup to match regardless of case. Which advanced setting in the lookup definition should you configure?

Accepted Answer

Set `case_sensitive_match = 0` in the lookup definition.. The `case_sensitive_match` setting in a lookup definition determines whether lookup matching is case-sensitive. Setting it to 0 makes matching case-insensitive, so values like `ABC123` and `abc123` will both match the lookup table. This is the correct advanced setting for the scenario.

Answer

Set `match_type = exact` in the lookup definition.

Answer

Set `max_matches = 0` in the lookup definition.

Answer

Set `filter = false` in the lookup definition.

Question 7

You are using the lookup command to enrich your search results with a CSV lookup. You want to add a field from the lookup only if that field does not already exist in your events. Which argument should you use?

Accepted Answer

OUTPUTNEW. The lookup command's OUTPUTNEW argument adds fields from the lookup only if they are not already present in the event, preserving existing values. OUTPUT overwrites existing fields, while INPUT and MATCH are not valid arguments. Thus, OUTPUTNEW is the correct choice to add fields without overwriting.

Answer

OUTPUT

Answer

INPUT

Answer

MATCH

Question 8

A dashboard panel runs a search that aggregates web access logs over the last 30 days. Users report the dashboard takes over a minute to load, and the Search Inspector shows high disk read time. The search is not scheduled and there is no acceleration. Which action should you take to reduce the panel's load time while preserving the ability to view the most recent 30 days of data?

Accepted Answer

Create a report acceleration summary for the search and enable acceleration on the saved search powering the panel.. Report acceleration creates precomputed summary data for a saved search, so the panel reads smaller tsidx files instead of scanning raw events across 30 days. This cuts disk read time and speeds dashboard loading while preserving the full time range. The panel must be tied to an accelerated saved search, and the acceleration must be enabled on that saved search.

Answer

Convert the panel to use a post-process search that inherits results from a base search.

Answer

Change the panel's time range to 'Last 24 hours' and add a note that older data is unavailable.

Answer

Add the tstats command with the prestats=true argument to the panel search.

Question 9

Which feature allows you to explore data model data without writing SPL?

Accepted Answer

Pivot. Pivot is the Splunk feature that lets users explore data model data through a point-and-click interface without writing SPL. It provides a drag-and-drop UI where you select a data model, choose a root or child object, and build a report by selecting fields, split-by dimensions, and filters. Pivot generates the underlying SPL automatically, making data model exploration accessible to non-SPL users.

Answer

Data Preview

Answer

Field Extractor

Answer

Search App

Question 10

A Splunk user is working with the 'Authentication' data model and wants to create a report that shows the number of failed login attempts by user. The user opens the Pivot interface and selects the 'Authentication' data model. Which of the following steps should the user take to create the report?

Accepted Answer

Drag the 'user' field to the 'Split Rows' area, drag the 'action' field to the 'Filter' area, and set the filter to 'failure', then click 'Save As' and choose 'Report'.. To create a report showing failed login attempts by user, you need to filter the events to only failures and then split by user to count. In Pivot, this is done by adding a filter on the 'action' field for 'failure' and splitting rows by the 'user' field. Saving as a report preserves this configuration.

Answer

Drag the 'user' field to the 'Split Columns' area, drag the 'action' field to the 'Split Rows' area, and then save as a report.

Answer

Drag the 'action' field to the 'Filter' area, set it to 'failure', then drag the 'user' field to the 'Column Values' area, and save as a report.

Answer

Drag the 'user' field to the 'Split Rows' area, then in the search bar add 'action=failure', and save as a report.

Question 11

You want to create a lookup that updates automatically as new data arrives. Which feature should you use?

Accepted Answer

KV Store lookup.. A KV Store lookup stores lookup data in Splunk's MongoDB-based key-value store, which can be updated programmatically and dynamically via REST API or the outputlookup command, allowing the lookup to reflect new data as it arrives. This makes it the correct choice for a lookup that updates automatically.

Answer

Field alias.

Answer

Calculated field.

Answer

CSV file lookup.

Question 12

When configuring a field alias in props.conf, which of the following is true?

Accepted Answer

The alias appears in the 'interesting fields' list.. When a field alias is configured in props.conf, the alias appears in the 'interesting fields' list in Splunk Web, allowing users to search by the alias name. The alias does not change the original field name; it provides an alternate name. Field aliases are applied at search time after field extraction, and they do not require an external CSV.

Answer

The alias name must be identical to the original field name.

Answer

The alias is applied before field extraction.

Answer

The alias must reference an external CSV.

Question 13

A Splunk administrator is creating a search macro that will be used to standardize the extraction of a user ID from an email address. The macro should accept an email field as an argument and return only the portion before the '@' symbol. The administrator wants to ensure that when the macro is invoked in a search, the argument is properly validated to be a valid email address. Which of the following is the correct way to define the validation for this macro?

Accepted Answer

In the macro definition, add a validation expression using a regular expression and a validation error message that will be displayed if the argument does not match the pattern.. The correct answer is to use the macro's built-in validation expression and error message. This feature allows administrators to define a regular expression that the argument must match. If the argument fails validation, Splunk returns the specified error message and does not execute the search. This provides immediate feedback and prevents invalid data from being processed.

Answer

Use the eval command with the match function inside the macro to validate the argument and return an error if it fails.

Answer

Create a separate saved search that validates the email format and schedule it to run before the macro is used.

Answer

Define the macro with a validation type of 'string' and rely on Splunk's built-in email format validation.

Question 14

Which search command is used to display the contents of a lookup table?

Accepted Answer

inputlookup. The 'inputlookup' command is specifically designed to read and display the contents of a lookup table file (CSV or KV Store) as search results. It is the standard command for viewing lookup data without joining it to an event stream. Running '| inputlookup mylookup.csv' returns all rows and columns from the lookup.

Answer

table

Answer

lookup

Answer

outputlookup

Question 15

A Splunk power user needs to calculate the total number of events per sourcetype and include a column that shows the percentage of total events each sourcetype represents. The search should return a table with sourcetype, count, and percentage. Which sequence of commands achieves this?

Accepted Answer

stats count BY sourcetype | eventstats sum(count) AS total | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage. To calculate a percentage of total, the search must first aggregate counts per sourcetype using stats, then compute the grand total across all results using eventstats without a BY clause. The eval command then divides each count by the grand total and multiplies by 100. This sequence ensures each row's percentage is based on the overall total, not a running or grouped sum.

Answer

stats count BY sourcetype | eventstats sum(count) AS total BY sourcetype | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage

Answer

stats count BY sourcetype | streamstats sum(count) AS total | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage

Answer

stats count BY sourcetype | addtotals | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage