SPLK-1004 Practice Test 18 — 15 Questions

Question 1

How can you view all existing field aliases in the Splunk Web interface?

Accepted Answer

Settings > Fields > Field aliases.. In Splunk Web, field aliases are managed under Settings > Fields > Field aliases, where administrators can create, view, edit, and delete aliases that map existing field names to common names without modifying the underlying data. This location lists all aliases defined in the current app context, allowing you to review them. The other Settings menus handle unrelated configuration areas such as data ingestion, lookups, and index storage.

Answer

Settings > Data inputs.

Answer

Settings > Lookups.

Answer

Settings > Indexes.

Question 2

A security team wants to correlate failed and successful logins across Windows Security logs, Linux secure logs, and VPN concentrators using Splunk's Common Information Model. They need a single normalized field for the user account. Which CIM data model and field should they reference?

Accepted Answer

Authentication data model, field user. The Authentication data model is purpose-built for login and authentication events. It includes the user field to represent the account involved, enabling consistent correlation across Windows Security logs, Linux secure logs, and VPN concentrators. Other models address different event categories and do not provide the required normalized authentication outcome fields.

Answer

Change Analysis data model, field user

Answer

Network Traffic data model, field src_user

Answer

Identity Management data model, field identity

Question 3

You are configuring a new alert in Splunk to trigger when a search returns more than 10 failed login attempts. You want the alert to send an email and also run a script. Which two actions must you configure in the alert definition? (Choose two.)

Accepted Answer

Add an 'Email' action and specify recipients.. To send an email and run a script when an alert triggers, you must add and configure the 'Email' and 'Run a script' actions in the alert definition. These are the specific actions that enable those behaviors. Other settings like alert type or severity do not control action execution, and a webhook is a different action not requested.

Answer

Set the alert type to 'Real-time' to ensure immediate triggering.

Answer

Add a 'Webhook' action and specify the URL.

Answer

Set the alert severity to 'High' to prioritize the alert.

Question 4

You need to create a persistent field mapping that allows users to search for 'user_id' instead of 'uid' without modifying the underlying raw data. Which feature should you use?

Accepted Answer

Field Aliases. Field aliases in Splunk allow you to create an alternate name for an existing field without modifying the raw data or the original field. By defining a field alias, users can search for 'user_id' and Splunk will automatically map it to the 'uid' field. This is the correct feature for providing a persistent, search-time mapping.

Answer

Lookups

Answer

Field Extractions

Answer

Calculated Fields

Question 5

You are creating a dashboard that includes a table panel showing the top 10 source IP addresses by event count. You want users to be able to click on a source IP in the table and have a second panel update to show all events from that IP. Which dashboard feature should you configure to enable this behavior?

Accepted Answer

Drilldown. Drilldown is the dashboard feature that defines what happens when a user clicks on a visualization, such as a table row. By configuring a drilldown, you can set a token to the clicked source IP and use that token in the second panel's search. This creates the interactive filtering behavior. Tokens, post-process searches, and base searches are supporting elements but do not themselves enable the click action.

Answer

Token

Answer

Base search

Answer

Post-process search

Question 6

You need to combine two fields into one string. Which eval function is used?

Accepted Answer

eval new = field1 . field2. In Splunk's eval command, string concatenation is performed with the dot (.) operator, so 'eval new = field1 . field2' correctly joins two field values into one string. The plus (+) operator is used for numeric addition, not string concatenation, and there is no built-in merge() or combine() eval function. This is a core SPL syntax rule tested frequently on SPLK-1004.

Answer

eval new = field1 + field2

Answer

eval new = merge(field1, field2)

Answer

eval new = combine(field1, field2)

Question 7

A power user wants to create a report that shows the average duration of each transaction, grouped by the 'service' field. The transactions are already grouped by a unique 'transaction_id' using the transaction command. Which command should be used next to calculate the average duration per service?

Accepted Answer

stats avg(duration) as avg_duration by service. After the transaction command creates transactions with a duration field, the stats command is ideal for aggregating that duration by service. It calculates the average duration for each service and outputs a concise table with one row per service. This is the most efficient and direct way to produce the required report, avoiding the extra events retained by eventstats or the time-based orientation of timechart.

Answer

chart avg(duration) over service

Answer

timechart avg(duration) by service

Answer

eventstats avg(duration) as avg_duration by service

Question 8

Where are search macros primarily stored within the Splunk configuration file system?

Accepted Answer

macros.conf. Search macros in Splunk are defined and stored in macros.conf, which resides in the app's local or default directory. This configuration file contains the macro name, definition, arguments, and validation settings. When a user invokes a macro in SPL, Splunk resolves it by looking up the definition in macros.conf.

Answer

props.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 9

A knowledge manager needs an ad-hoc calculated field named `resp_seconds` available only within a single dashboard panel that computes `round(duration_ms/1000, 2)` from an existing numeric field. The value must not persist to the knowledge object store and must not appear in other searches. Which approach should be used?

Accepted Answer

Add an `eval resp_seconds=round(duration_ms/1000, 2)` command inline in the panel's search string.. An inline eval in the panel search computes the new value at search time and discards it when the search finishes, which is exactly the ad-hoc, panel-scoped behavior requested. Saved calculated fields, props.conf EVAL stanzas, and field aliases all persist as configuration and thus would leak the field into other searches.

Answer

Add a field alias named `resp_seconds` pointing to `duration_ms` in the sourcetype definition.

Answer

Define `EVAL-resp_seconds = round(duration_ms/1000, 2)` in props.conf for the sourcetype.

Answer

Create a calculated field in Settings > Fields with the eval expression and a `resp_seconds` name.

Question 10

You have an automatic lookup that enriches events with `user_department` from a CSV file. You run a search and notice that the `user_department` field is not appearing in the results, even though the lookup file contains the correct mappings and the automatic lookup is enabled. Which of the following is the most likely cause?

Accepted Answer

The lookup definition is configured with `case_sensitive_match = 1` and the user field in events has different casing than the lookup file.. A case-sensitive lookup definition can cause automatic lookups to fail to match when event field values differ in case from the lookup table. Setting `case_sensitive_match = 0` would resolve this. The other options are not typical causes for a missing output field when the lookup file and definition appear correct.

Answer

The search is not using the `lookup` command explicitly, so automatic lookups do not apply.

Answer

The automatic lookup is configured with `OUTPUTNEW` instead of `OUTPUT`.

Answer

The lookup file is stored in the `etc/apps` directory instead of `etc/system`.

Question 11

You are building a dashboard with a base search that returns a large result set, and three panels that each perform different statistical calculations on that same result set. You want to minimize the number of times the base search runs and ensure all panels update together. Which approach should you use?

Accepted Answer

Define a base search in the dashboard and have each panel use a post-process search that references the base search results.. A base search runs once and its results are stored, then post-process searches in other panels operate on that stored result set. This minimizes the number of times the heavy base search executes and ensures all panels use the same data, so they update together. It is the standard Splunk method for sharing search results across multiple panels in one dashboard.

Answer

Configure each panel to use the same search string and rely on Splunk's search result cache to deduplicate the searches.

Answer

Schedule each panel's search independently with the same cron schedule and the same time range.

Answer

Use a global search in the dashboard that all panels inherit automatically through the search template.

Question 12

An analyst is creating a data model and wants to include a field that calculates the duration of a session by subtracting the start time from the end time. Which type of field should the analyst create?

Accepted Answer

A calculated field using the eval expression 'end_time - start_time'. To derive a new field from existing fields in a data model, a calculated field is used. Calculated fields employ eval expressions to compute values at search time. For session duration, subtracting start_time from end_time using eval creates the desired field. This field can then be used in Pivot and tstats. Other field types like regex extraction or lookups cannot dynamically compute values from multiple fields.

Answer

A lookup field that references a CSV file containing duration values

Answer

A regex field extraction that captures the duration from the raw event

Answer

An eval-based field in the data model's constraint

Question 13

An analyst uses the following search to enrich events: index=web | lookup local=1 web_assets clientip OUTPUTNEW asset_owner, asset_criticality. They notice that events where clientip matches multiple entries in web_assets get an arbitrary owner value. They need deterministic behavior where the first matching entry in the lookup is used. Which approach should they take?

Accepted Answer

Edit the lookup definition and set the advanced option for multiple matches to use the first matching entry.. Deterministic handling of duplicate lookup matches is configured in the lookup definition's advanced settings. Options such as first match, last match, or all matches control which row is applied. Setting the definition to use the first matching entry ensures consistent results regardless of file order. The lookup command itself does not expose a parameter for this, and OUTPUT versus OUTPUTNEW only affects field overwriting.

Answer

Sort the lookup file by clientip and rely on the lookup command to honor file order.

Answer

Add the option match_type=first to the lookup command.

Answer

Change OUTPUTNEW to OUTPUT so the lookup overwrites existing fields and resolves duplicates.

Question 14

Which of the following is true about search macros?

Accepted Answer

They can contain parts of a search query. Search macros can contain a full search or just a portion of a search, such as a set of filtering commands or a field extraction snippet. This flexibility allows macros to be reused as building blocks within larger SPL statements.

Answer

They cannot accept arguments

Answer

They must always be a full search query

Answer

They are only for admins

Question 15

How do you extract a portion of a string using 'eval'?

Accepted Answer

eval new = substr(old, 1, 5). Splunk's eval command supports the substr() function, which extracts a substring from a string given a starting position (1-based) and length. The syntax eval new = substr(old, 1, 5) returns the first five characters of the 'old' field, making C the correct answer.

Answer

eval new = cut(old, 1, 5)

Answer

eval new = slice(old, 1, 5)

Answer

eval new = extract(old, 1, 5)