SPLK-1004 Practice Test 2 — 10 Questions

Question 1

You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?

Accepted Answer

Field name mismatch between event and lookup.. The most common reason for an automatic lookup failing is a field name mismatch between the event data and the lookup table header.

Answer

The lookup is set to read-only.

Answer

The lookup is shared globally.

Answer

The lookup table file is too large.

Question 2

You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?

Accepted Answer

Field Lookup. A lookup table is the standard way to map a key (status) to a value (status_desc).

Answer

Calculated Field

Answer

Event Type

Answer

Field Alias

Question 3

What is the effect of the 'overwrite' setting in a lookup configuration?

Accepted Answer

It replaces the existing field value with the lookup result.. If overwrite is enabled, the lookup will replace existing fields in the event if the lookup fields have the same name.

Answer

It deletes the original raw data.

Answer

It forces the lookup to run at index time.

Answer

It forces the lookup to run only for admins.

Question 4

Which THREE of the following are benefits of using calculated fields?

Accepted Answer

They allow for complex string manipulations.. They enable mathematical operations, conditional logic, and string manipulations at search time.

Answer

They are stored as raw data.

Answer

They automatically increase index speed.

Question 5

You have a macro that uses a search command that is not allowed by the user's role. What happens when the user tries to run the macro?

Accepted Answer

The macro expansion succeeds but the command fails. If the underlying search is restricted by role-based search filters or command constraints, the search will fail or be restricted accordingly.

Answer

The macro is blocked from expanding

Answer

The user is prompted to elevate privileges

Answer

The macro is automatically sanitized

Question 6

When configuring a field alias in props.conf, which of the following is true?

Accepted Answer

The alias appears in the 'interesting fields' list.. Aliases are applied at search time and respect the order of operations, occurring after extractions.

Answer

The alias name must be identical to the original field name.

Answer

The alias is applied before field extraction.

Answer

The alias must reference an external CSV.

Question 7

Which THREE of the following are valid ways to manage Search Macros in Splunk?

Accepted Answer

Using the REST API. Macros can be managed via the Web UI, direct editing of macros.conf, or using the REST API.

Answer

Using the 'Indexes' configuration page

Answer

Via the 'Saved Searches' menu

Question 8

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. The Field Extractor (UI) and editing props.conf/transforms.conf are the two standard ways.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 9

What is the primary benefit of creating an Event Type?

Accepted Answer

To easily identify and group specific sets of events.. Event types allow you to label a group of events based on a search, making them easier to identify in results.

Answer

To increase indexing performance.

Answer

To automate the ingestion of new data.

Answer

To hide events from unauthorized users.

Question 10

You want to filter out events where the 'action' field is empty. Which command is best?

Accepted Answer

where isnotnull(action) AND action!="". The 'where' command allows for complex logical filtering.

Answer

filter action != null

Answer

search action=*

Answer

eval action = if(isnull(action), "remove", action) | search action!="remove"