SPLK-1004 Practice Test 20 — 15 Questions

Question 1

A security analyst needs a search macro that will be used across multiple dashboards and alerts. The macro must accept a field name as an argument and return a search string that filters events where that field equals a specific value. The analyst wants to ensure that the macro can be reused without modification in different contexts. Which of the following best describes how the macro should be defined to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the macro with two arguments, `field` and `value`, and use them in the search string as `$field$=$value$`.. The macro must accept both the field name and the value as arguments to be reusable without modification. By defining two arguments and using them in the search string as `$field$=$value$`, the analyst can call the macro with different field-value pairs. This parameterization ensures flexibility and meets the requirement for cross-dashboard and alert reuse.

Answer

Define the macro with an argument named `filter` and use it in the search string as `$filter$`.

Answer

Define the macro with an argument named `field` and use it in the search string as `$field$=value`.

Answer

Define the macro with no arguments and use a token in the search string that is replaced by the dashboard or alert at runtime.

Question 2

A security analyst in Splunk Enterprise wants to run a high-performance search over accelerated data models but needs to avoid scanning the full index. The analyst runs a tstats search that returns zero results, even though raw events exist. Which action should be taken to resolve this?

Accepted Answer

Verify that the data model is accelerated and that the acceleration summary is complete.. The tstats command relies on accelerated data model summaries to return results efficiently. If the data model is not accelerated or the acceleration summary is incomplete, tstats may return no results even when raw events exist. Verifying acceleration status and summary completeness directly addresses the root cause.

Answer

Add the `summariesonly=true` argument to the tstats command.

Answer

Add the `prestat` argument to the tstats command to force raw event scanning.

Answer

Change the tstats search to use `index=_internal` instead of the data model.

Question 3

Where can you define an event type?

Accepted Answer

In the Settings > Event types menu.. Event types can be defined through the Splunk Web interface under Settings > Event types. This menu allows users to create, edit, and manage event types, which are saved searches that categorize events based on search criteria. Event types are then used in other configurations, such as tags and alerts.

Answer

In the indexer's inputs.conf file.

Answer

In the user's .bashrc file.

Answer

Directly in the search head's license file.

Question 4

A dashboard panel runs a search that aggregates firewall events by src_ip. Users report the panel takes over a minute to render. The search uses `stats count by src_ip` after a base search that retrieves 30 days of data. The Search Inspector shows the search is reading far more events than needed, and the aggregation is spilling to disk. Which change is most likely to reduce the panel's render time while preserving the result?

Accepted Answer

Add `| tstats count where index=firewall by src_ip` to replace the base search and stats command.. Replacing the raw-event aggregation with tstats uses indexed fields and tsidx summaries, eliminating full event retrieval and parsing. This directly addresses the excessive reads and disk spill shown by Search Inspector while returning the same counts, provided the field is indexed. The other options either change results, hide the symptom, or truncate data.

Answer

Add `| head 10000` immediately after the base search to limit events.

Answer

Increase the dashboard's refresh interval so the search runs less often.

Answer

Move the `stats` command earlier in the pipeline before any filtering commands.

Question 5

A user wants to restrict an alert to trigger only once per hour, even if the search returns results every minute. Which setting should be modified?

Accepted Answer

Throttling. Alert throttling in Splunk suppresses alert actions for a specified period after a trigger, so setting throttling to one hour ensures the alert fires at most once per hour even if the search runs every minute. Throttling can be configured per alert and can suppress based on fields or the entire alert.

Answer

Cron schedule

Answer

Alert frequency

Answer

Trigger conditions

Question 6

Which of the following is true about field extractions?

Accepted Answer

They use regular expressions to parse data.. Field extractions in Splunk use regular expressions to parse raw data and extract fields. They can be defined at search time (via props.conf EXTRACT- or the UI) or at index time (via transforms.conf and props.conf), but the core mechanism is regex-based parsing.

Answer

They are only available for the 'admin' role.

Answer

They must be defined at index time.

Answer

They only work on JSON data.

Question 7

A Splunk administrator defines a search macro `top_errors(2)` with arguments `$host$` and `$error_type$`. The definition is `index=main host=$host$ error_type=$error_type$ | top limit=10 error_message`. The administrator sets a validation expression for the first argument as `match($host$, "^[a-zA-Z0-9.-]+$")` and for the second argument as `match($error_type$, "^(critical|warning|info)$")`. An analyst invokes the macro as `| top_errors("web-01", "fatal")`. What happens?

Accepted Answer

The search fails with a validation error because `fatal` does not match the allowed values for the second argument.. Validation expressions are evaluated at invocation time against the supplied arguments. The second argument `fatal` does not match the pattern that permits only `critical`, `warning`, or `info`, so the macro fails with a validation error. The first argument `web-01` is valid, but the failure on the second argument prevents the search from running.

Answer

The search runs successfully because the validation expressions only apply to the macro definition, not to the arguments passed at invocation.

Answer

The search runs but returns no results because the validation expressions are ignored when the macro is invoked with quoted strings.

Answer

The search fails with a validation error because `web-01` does not match the allowed pattern for the first argument.

Question 8

You have a scheduled alert that runs every hour and triggers when the number of results is greater than 0. The alert is configured to send an email. You notice that the alert triggers and sends an email every hour, even when there are no new events. The search itself returns results because it includes a `stats` command that always returns at least one row (e.g., a count of 0). How can you modify the alert to only trigger when there are actual events?

Accepted Answer

Modify the search to include `| where count > 0` after the stats command.. The search always returns at least one row because the `stats` command produces a count of 0 when there are no events. To prevent the alert from triggering in that case, you must filter out the row when the count is 0. Adding `| where count > 0` after the `stats` command ensures that the search returns no results when there are no events, so the alert will only trigger when there are actual events. Other options either do not address the root cause or suppress all triggers.

Answer

Set the alert to trigger only when the search returns more than 0 results and add `| head 0` to the search.

Answer

Change the alert type to Real-time and set the trigger condition to 'Number of Results' is greater than 0.

Answer

Change the trigger condition to 'Number of Results' is greater than 1.

Question 9

A security team wants to trigger an alert when a user account is locked out more than five times in 10 minutes. They create a saved search with the following SPL: index=security EventCode=4740 | stats count by user | where count > 5. They configure the alert to run every 10 minutes and trigger when the number of results is greater than 0. Which alert action should they configure to automatically create a ticket in their incident management system?

Accepted Answer

Webhook. The Webhook alert action is designed to send an HTTP POST to an external URL, making it ideal for integrating with incident management systems that expose an API for ticket creation. It requires no custom scripting and is configured directly in the alert settings. Other actions either only record the alert internally or require additional scripting and deployment effort.

Answer

Add to Triggered Alerts

Answer

Log Event

Answer

Run a Script

Question 10

When an accelerated data model object is updated, what happens to the existing summary files?

Accepted Answer

They are rebuilt to match the new definition. When an accelerated data model object is updated — for example, changing a field, constraint, or calculation — Splunk invalidates the existing summary files and rebuilds them to reflect the new definition. The acceleration process re-runs the underlying search across the relevant time range and writes fresh TSIDX summary files. This ensures that reports using the data model return results consistent with the updated schema.

Answer

They remain unchanged until a reboot

Answer

They are moved to a cold bucket

Answer

They are deleted and never recreated

Question 11

A user wants to create a workflow action that, when clicked, runs a secondary search in Splunk and displays the results in the current window. The action should be available for all events. Which workflow action type should be selected?

Accepted Answer

search. The 'search' workflow action type is used to run a secondary Splunk search when the action is clicked. It can be configured to display results in the current window or a new window. The 'link' type is for external URLs, and 'eval' and 'dashboard' are not valid types. Therefore, 'search' is the correct choice for running a search and displaying results in the current window.

Answer

eval

Answer

dashboard

Answer

link

Question 12

A power user wants to add a calculated field named `response_time` to all events of the `web` sourcetype. The value should be the difference between two existing numeric fields, `end_time` and `start_time`, and must be available in every future search without retyping the eval command. Where should this be configured?

Accepted Answer

In props.conf as an EVAL-response_time setting under the web sourcetype stanza. Calculated fields are defined with EVAL-<fieldname> in props.conf, scoped to a host, source, or sourcetype stanza. Because the EVAL expression is evaluated at search time for every matching event, the derived response_time appears in all future searches of the web sourcetype without additional commands. The other files govern extraction, saved searches, or indexed-field behavior and cannot compute a per-event arithmetic value.

Answer

In transforms.conf as a REPORT stanza

Answer

In fields.conf as a field alias

Answer

In savedsearches.conf as an automatic lookup

Question 13

A security analyst needs a calculated field named `risk_score` that evaluates to the numeric value 10 for every event in the `firewall` sourcetype, regardless of whether any other fields are present. The analyst has created the field in Settings > Fields > Calculated Fields, set the App context to `search`, and set the eval expression to `10`. However, searches in the `main` index for `sourcetype=firewall` do not display the `risk_score` field. Which of the following is the most likely cause?

Accepted Answer

The search is running in a different app context than the one where the calculated field was defined, so the field is not applied.. Calculated fields are app-scoped objects. When a search runs in an app other than the one where the calculated field was created, the field definition is not available, so the field does not appear. To make the field available across apps, it must be defined in a globally shared app or the search must run in the same app context.

Answer

Calculated fields are only applied to events that already have at least one extracted field, so events without fields are skipped.

Answer

The calculated field was created in the `search` app context, but the user lacks permission to access that app's calculated fields.

Answer

Calculated fields cannot contain a constant expression; they must reference at least one existing field.

Question 14

A power user needs to calculate the difference between the current value of a field 'cpu_load' and its value from the previous event, grouped by 'host'. The events are sorted by time. Which command accomplishes this?

Accepted Answer

delta cpu_load as cpu_diff by host. The delta command is specifically designed to compute the difference between the current and previous value of a field. When used with a BY clause, it calculates the delta independently for each group, such as each host. This matches the requirement to calculate the change in cpu_load per host between consecutive events. It is efficient and avoids the complexity of streamstats or invalid eval functions.

Answer

streamstats current=f window=1 values(cpu_load) as prev_load by host | eval cpu_diff = cpu_load - prev_load

Answer

eval cpu_diff = cpu_load - lag(cpu_load) by host

Answer

delta cpu_load as cpu_diff

Question 15

A dashboard has a base search that returns a summarized result set, and several panels use post-process searches. You notice that one panel's post-process search returns no results while the base search clearly has data. Which TWO configuration issues could cause a post-process search to return no results? (Choose two.)

Accepted Answer

The post-process search references a field that was not included in the base search results.. Post-process searches are constrained to the fields and time range established by the base search. Referencing a field that the base search did not return, or specifying a different time range in the post-process, will cause the post-process to find no matching rows even when the base search has data. Both are common configuration mistakes when building dashboards with shared base searches.

Answer

The dashboard's refresh interval is set to a long duration.

Answer

The base search is configured with a very large max result count.

Answer

The post-process search uses the tstats command instead of stats.