SPLK-1004 Practice Test 2 — 10 Questions

Question 1

Which of the following best describes the difference between an event type and a tag?

Accepted Answer

Event types group events by search criteria, while tags label field values.. An event type is a saved search that categorizes events based on search criteria, effectively grouping events that match a certain pattern. A tag, on the other hand, is a label applied to specific field-value pairs, allowing you to search for events with that tag. This distinction — event types group events by search criteria, tags label field values — is the fundamental difference.

Answer

Event types are only for reports, while tags are for dashboard panels.

Answer

Event types only work in the search bar.

Answer

Tags are faster than event types for searching.

Question 2

How do you handle case-insensitive filtering in a 'where' clause?

Accepted Answer

where lower(field) = "value". Splunk's where command uses eval-style expressions, and the correct way to perform case-insensitive comparison is to normalize the field with lower() (or upper()) and compare against a lowercase literal. The syntax where lower(field) = "value" is valid eval expression syntax and reliably matches regardless of case.

Answer

where field == /value/i

Answer

where field = '(?i)value'

Answer

where field.case = "ignore"

Question 3

How do you handle a field that exists in your data but is not explicitly defined in a CIM data model?

Accepted Answer

Add a new field definition to the object. In Splunk CIM, if a field exists in your data but is not defined in a data model object, you can add a new field definition to that object. This is done by editing the data model in the Data Model Editor, where you can add fields, set their type, and map them to CIM fields. This allows the field to be used in Pivot and other CIM-based searches. Renaming the raw log field is not necessary and would not integrate it into the CIM. Deleting the CIM model is destructive and unnecessary. You can add custom fields to CIM models, so option D is false.

Answer

Rename the raw log field

Answer

Delete the CIM model and start over

Answer

You cannot add custom fields to CIM models

Question 4

A Splunk administrator is configuring a workflow action that will appear when a user clicks on a field value in search results. The action should open a new browser tab to an external threat intelligence website, passing the field value as a query parameter. The administrator sets the action type to `link` and configures the URI as `https://threatintel.example.com/search?q=$value$`. However, when testing, the link opens in the same tab, replacing the Splunk UI. Which setting must be adjusted to ensure the link opens in a new tab?

Accepted Answer

Set `target` to `_blank` in the workflow action configuration.. For workflow actions of type `link`, the `target` setting determines where the link opens. The default is `_self`, which replaces the current page. To open in a new tab, set `target` to `_blank`. This setting is separate from the URI and must be configured explicitly. Changing the action type or embedding HTML attributes in the URI will not achieve the desired behavior.

Answer

Enable `popup` in the workflow action configuration.

Answer

Set `link.uri` to include `target="_blank"` as an HTML attribute.

Answer

Change the action type from `link` to `search`.

Question 5

In a data model, what is the impact of setting the 'Max Time' for an accelerated model?

Accepted Answer

It sets the age limit for the summary index. The 'Max Time' setting for an accelerated data model specifies the maximum age of events that are summarized in the acceleration summary index. Events older than this limit are not included in the acceleration, effectively setting an age limit for the summary index data.

Answer

It determines the refresh rate

Answer

It limits the number of events indexed

Answer

It restricts search execution time

Question 6

A Splunk administrator is designing a lookup that will be used in a real-time alert to enrich incoming events with user department information. The lookup must support rapid updates without restarting Splunk, allow multiple users to modify entries concurrently, and provide the ability to define a lookup with a case-sensitive match. The administrator wants to use a KV Store lookup instead of a CSV lookup. Which two statements accurately describe KV Store lookups in this context? (Choose two.)

Accepted Answer

KV Store lookups can be updated in real time without restarting Splunk, and changes are immediately available to searches.. KV Store lookups leverage MongoDB, allowing concurrent updates and immediate visibility of changes without restarting Splunk. These features make them ideal for dynamic enrichment in real-time alerts. The other statements are incorrect because KV Store replication requires explicit configuration, case sensitivity is not a mandatory setting, and KV Store lookups are not created by CSV upload.

Answer

KV Store lookups can only be created by uploading a CSV file through the Splunk web interface.

Answer

KV Store lookups require a lookup definition with a case-sensitive match setting to be configured in transforms.conf.

Answer

KV Store lookups automatically replicate data across all search heads in a distributed environment without additional configuration.

Question 7

You want to hide a panel based on the value of a token. Which attribute should you use in the dashboard XML?

Accepted Answer

depends="$token$". The depends attribute in Simple XML controls panel visibility by evaluating a token expression; when the expression is true (token is set and non-empty), the panel is shown, and when false, the panel is hidden. This is the documented mechanism for conditionally displaying panels based on token values.

Answer

hidden="$token$"

Answer

visible="$token$"

Answer

show="true"

Question 8

A Splunk administrator is configuring a field extraction for a custom sourcetype. The raw event data contains a field named `user` that sometimes includes a domain prefix (e.g., `DOMAIN\username`). The administrator wants to create a new field `username` that contains only the username portion, stripping the domain prefix if present. The extraction should work at search time and be available for all users. Which of the following is the most efficient and correct method?

Accepted Answer

Create a calculated field using `EVAL-username = replace(user, "^[^\\]+\\", "")` in `props.conf`.. Calculated fields using `EVAL-` in `props.conf` allow for dynamic transformation of field values at search time. Using `replace()` with a regular expression to strip the domain prefix is efficient and only executes when the field is referenced. This method ensures the transformation is applied consistently and is available to all users of the app. Other methods like field aliases or lookups do not perform the necessary string manipulation.

Answer

Use a field alias in `props.conf` to map `username` to `user`.

Answer

Define a search-time field extraction using a regular expression in `props.conf` with `EXTRACT-username = (?<username>[^\\]+)$`.

Answer

Create a lookup table that maps `user` to `username` and configure an automatic lookup.

Question 9

You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?

Accepted Answer

Field name mismatch between event and lookup.. An automatic lookup joins fields from the lookup table to fields in the event stream at search time. If the field name referenced in the lookup definition (the 'Lookup input field') does not exist in the events, or the case/name differs from what the lookup CSV header expects, the lookup silently returns no matches and the lookup fields remain null. Since the definition and automatic rule were already verified, the most common remaining cause is a field name mismatch between the event data and the lookup table.

Answer

The lookup is set to read-only.

Answer

The lookup is shared globally.

Answer

The lookup table file is too large.

Question 10

When creating a workflow action, what is the 'Label' field used for?

Accepted Answer

The name shown in the user interface. The 'Label' field in a Splunk workflow action controls the human-readable text that appears in the event action menu (the dropdown that shows when you click an event in Search results). It is purely a display string — it does not affect how the action is matched, executed, or stored. Administrators use it to give users a meaningful, descriptive name like 'Search for this IP' rather than an internal identifier.

Answer

The internal name used in configurations

Answer

The field name to which the action is attached

Answer

The search query executed by the action