SPLK-1004 Practice Test 2 — 25 Questions

Question 1

A Splunk administrator wants to create a calculated field that combines the values of two existing extracted fields, 'src_ip' and 'dest_ip', into a new field named 'conversation' with a hyphen separating them. The administrator needs this field to be available in searches immediately without editing any configuration files on the indexers. Where should the administrator define this calculated field?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the calculated fields configuration page under Settings > Fields > Calculated Fields. Calculated fields are defined through the Calculated Fields configuration page in Splunk Web, which automatically updates props.conf with EVAL-<fieldname> directives. This method meets the requirement of immediate availability without direct file edits on indexers. The other options involve configuration files that either do not support calculated fields or require manual editing and restarts.

Answer

In the fields.conf file using the FIELDNAME and FIELDVALUE settings

Answer

In the transforms.conf file using the REGEX and FORMAT directives

Answer

In the search app's props.conf using the EVAL-conversation directive

Question 2

An analyst runs a Pivot report on the Authentication data model and notices that the 'action' field shows values like 'success' and 'failure', but the underlying raw events contain a field named 'status' with values 'Success' and 'Failed'. The analyst wants to understand why the field labels differ from the raw event field names. What is the primary reason for this discrepancy?

Accepted Answer

The data model's field definitions include an eval expression that extracts and normalizes the 'status' field into the CIM-compliant 'action' field.. The data model defines a field named 'action' with an eval expression that maps the raw 'status' values to CIM-compliant terms like 'success' and 'failure'. This is a common practice to normalize data from different sources. The raw events remain unchanged; the data model provides a layer of abstraction that presents standardized fields for Pivot and tstats searches. This abstraction is why the field labels differ from the raw event field names.

Answer

The data model applies a field alias that renames 'status' to 'action' during the data model acceleration process.

Answer

The raw events are parsed by a transform that renames 'status' to 'action' at index time, so the data model sees the renamed field.

Answer

The Pivot interface automatically renames fields to match the CIM, regardless of the data model's field definitions.

Question 3

Which TWO of the following are true regarding the order of operations when a macro is used in a search?

Accepted Answer

Macros are expanded before search execution. Option A is correct because macro expansion occurs at search time, before the search is actually executed — the search head parses the search string, resolves any macro references into their underlying search fragments, and then runs the resulting expanded search. Option B is correct because macro expansion is context-sensitive: the current app context determines which macros are visible and how they resolve, so the same macro name can expand differently depending on the app in which the search runs. Option C is wrong because the indexer handles indexing and search-time data retrieval, not macro expansion, which is a search-head parsing activity. Option D is wrong because the browser merely submits the search; expansion happens server-side on the search head, not client-side. Option E is wrong because expansion must precede execution — a macro cannot be resolved after the search has already finished.

Answer

Macros are expanded by the Indexer

Answer

Macros are expanded by the browser

Answer

Macros are expanded after the search finishes

Question 4

Which THREE of the following are valid aggregation functions used with 'stats'?

Accepted Answer

dc. The 'stats' command in Splunk supports aggregation functions such as dc (distinct count), avg (average), and count, so options A, C, and D are all valid. Option A, dc, is correct because it returns the number of distinct values for a field, e.g., 'stats dc(user)'. Option C, avg, is correct because it computes the arithmetic mean of a numeric field, e.g., 'stats avg(response_time)'. Option D, count, is correct because it counts the number of events or occurrences, e.g., 'stats count by host'. Option B, where, is not an aggregation function; it is a filtering command used to filter search results based on a condition. Option E, rename, is not an aggregation function; it is a command used to rename fields in the results.

Answer

where

Answer

rename

Question 5

How do you view the fields present in a data model object?

Accepted Answer

In the Data Model Editor. To view the fields present in a data model object, you use the Data Model Editor in Splunk. The Data Model Editor provides a graphical interface to inspect and edit data models, including their objects and fields. It lists all fields defined for each object, along with their types and other properties. Running a pivot search or using a 'list fields' command does not directly show the fields defined in a data model object; those methods show fields in your data, not the data model definition. The Indexes page is unrelated to data model fields.

Answer

By running a 'pivot' search

Answer

Using the 'list fields' command

Answer

In the Indexes page

Question 6

What is the result of using 'OUTPUTNEW' instead of 'OUTPUT' in a lookup command?

Accepted Answer

It only adds fields if they do not already exist.. In a lookup command, OUTPUTNEW only adds fields from the lookup if those fields do not already exist in the event. If the field already exists, the lookup value is ignored. This contrasts with OUTPUT, which overwrites existing fields. Thus, option C is correct.

Answer

It forces an error if the lookup is empty.

Answer

It performs a case-insensitive lookup.

Answer

It creates a new lookup table.

Question 7

A Splunk power user is configuring an alert that must trigger only when a search returns more than 100 events in a 5-minute window. The user wants to avoid duplicate alerts for the same set of events and wants the alert to include a link to the search results in the notification email. Which alert configuration should the user set to prevent duplicate alerts?

Accepted Answer

Enable the 'Throttle' option and set a throttle period.. Throttling suppresses alert actions for a defined period after an alert triggers, preventing duplicate notifications for the same condition. The other options do not address duplicate alerts: cron scheduling still triggers on each run if the condition persists, dedup only affects events within a single search, and triggering per result increases notifications.

Answer

Set the alert to run on a cron schedule instead of a real-time schedule.

Answer

Add the dedup command to the search to remove duplicate events.

Answer

Configure the alert to trigger once per result instead of once per search.

Question 8

You want to see a list of unique 'clientip' addresses. Which command is most efficient?

Accepted Answer

dedup clientip. The dedup command is specifically designed to remove duplicate events based on specified fields, making it the most efficient way to get a list of unique clientip addresses. It returns the first occurrence of each unique value and is optimized for this purpose. While stats count by clientip also provides unique values, it includes counts and may be less efficient for simply listing unique IPs, especially when you don't need the counts.

Answer

stats count by clientip

Answer

head 100

Answer

chart clientip

Question 9

You have a lookup definition 'user_info' that maps user to department. In a search, you run: index=main | lookup user_info user OUTPUTNEW department AS dept. Some events already contain a field named 'dept'. What is the result for those events?

Accepted Answer

The existing 'dept' field remains unchanged, and the lookup value is not added.. OUTPUTNEW adds lookup values only when the destination field is absent. When 'dept' already exists, the lookup value is not applied, leaving the original field intact. This differs from OUTPUT, which overwrites existing fields. The search does not error; it simply skips adding the value for events that already have the field.

Answer

The lookup value is added as a new field named 'department' instead of 'dept'.

Answer

The existing 'dept' field is overwritten with the value from the lookup.

Answer

The search fails with an error because OUTPUTNEW cannot be used with an AS clause.

Question 10

A power user configures an automatic lookup that enriches events with a `priority` field from a CSV, and also defines a calculated field `severity = priority * 10` via EVAL in props.conf. After deploying, `severity` is always null. What is the cause?

Accepted Answer

Calculated fields are evaluated before automatic lookups run, so priority does not exist yet when severity is computed. Calculated fields are evaluated during the field resolution phase, which precedes automatic lookup enrichment. Because priority is added only when the lookup runs, the EVAL expression sees no such field and produces null. Resolving this requires computing severity after enrichment, for example with an eval command placed after the lookup in the search, or by restructuring the enrichment so the dependency is satisfied.

Answer

The CSV lookup does not support numeric fields, so priority cannot be multiplied

Answer

The lookup definition must set `max_matches` to a value greater than one for the enriched field to be visible to EVAL

Answer

The EVAL expression must use the `eval` command syntax with quotes around field names

Question 11

You need to create a lookup definition that references a CSV file stored in the `lookups` directory of your app. Which configuration file is used to define the lookup?

Accepted Answer

transforms.conf. Lookup definitions are stored in `transforms.conf`. This file contains the stanza for the lookup definition, specifying the lookup name, the file path, and other parameters like case sensitivity. The other files listed serve different purposes: `props.conf` for parsing, `inputs.conf` for data inputs, and `outputs.conf` for forwarding. Therefore, `transforms.conf` is the correct configuration file.

Answer

props.conf

Answer

outputs.conf

Answer

inputs.conf

Question 12

A security team maintains a search macro named `net_flow_analysis` in the `syslog` app. The macro is defined with `definition = index=network sourcetype=firewall | stats count by src_ip, dest_ip` and no arguments. An analyst runs a search in the Search & Reporting app: `| net_flow_analysis`. What is the result of this search?

Accepted Answer

The search returns the results of `index=network sourcetype=firewall | stats count by src_ip, dest_ip`.. A search macro with no arguments expands directly into its definition when invoked as the first command after a pipe. The definition includes both a search clause and a stats pipeline, so the expanded search is valid and returns the stats results. Cross-app usage is allowed when the macro is shared appropriately, and the presence of a pipe inside the definition is normal.

Answer

The search returns only the event count because the `stats` command requires the `search` command before it.

Answer

The search returns an error because the macro definition contains a pipe and must be invoked with the `search` command.

Answer

The search returns an error because the macro is defined in the `syslog` app but invoked from the Search & Reporting app.

Question 13

Which TWO settings in a lookup definition affect how the lookup matches the data?

Accepted Answer

Match type. In a Splunk lookup definition, the Match type setting (A) determines whether the lookup matches on the entire field value (exact match) or on a portion of it (CIDR, wildcard, or regex matching), directly controlling how lookup keys are compared to event field values. The Case sensitive match setting (B) controls whether the lookup comparison treats uppercase and lowercase characters as distinct, which also directly affects whether a match is found. Together these two settings govern the matching logic of the lookup. Owner permissions (C) only control access rights to the lookup object, not how values are matched. Lookup file compression (D) is not a matching setting and relates to file storage/size handling. Refresh interval (E) controls how often the lookup file is reloaded into memory, not how matches are performed.

Answer

Owner permissions

Answer

Lookup file compression

Answer

Refresh interval

Question 14

You need to create a search macro that accepts one argument. How should you define the argument in the macro definition field?

Accepted Answer

Using dollar signs like $arg1$. In Splunk, search macro arguments are defined by wrapping the argument name in dollar signs, e.g., $arg1$. This syntax tells the Splunk search processor to treat the enclosed token as a substitution variable that will be replaced at search time with the value supplied by the user or calling search. The dollar-sign delimiters are mandatory; without them, Splunk treats the text as a literal string rather than a dynamic argument.

Answer

Using angle brackets like <arg1>

Answer

Using curly braces like {arg1}

Answer

Using percent signs like %arg1%

Question 15

You need to ensure that an alert notifies a specific team via email only when the number of errors exceeds 50 in 5 minutes. What is the correct way to implement this?

Accepted Answer

Set trigger condition to 'greater than' 50 results in 5 minutes.. The trigger condition in a Splunk saved search defines the threshold that must be met for the alert to fire. Setting it to 'greater than' 50 results over a 5-minute window directly implements the requirement of notifying only when errors exceed 50. The alert action (email) is configured separately, and the trigger condition is what governs when that action executes.

Answer

Enable 'Real-time' alert mode.

Answer

Use a cron expression of */5.

Answer

Configure the 'Action' to 'Email'.

Question 16

Which TWO of the following commands are considered 'transforming' commands?

Accepted Answer

timechart. In Splunk's Search Processing Language (SPL), transforming commands are those that order the results into a data table, typically aggregating or grouping events into statistical output — and both A (timechart) and B (stats) do exactly this. The timechart command is a transforming command because it aggregates events into a time-series table, bucketing by _time and splitting by a field to produce statistical values per time interval. The stats command is likewise transforming because it computes aggregations (such as count, sum, avg, dc) and returns a tabular result set grouped by specified by-clauses. By contrast, C (rex) is a field-extraction command that only adds fields to events without restructuring them into a table, D (fields) is a filtering/field-selection command that includes or excludes fields, and E (where) is a filtering command that evaluates a boolean expression to keep or drop events — none of these transform the result set into statistical tabular output.

Answer

rex

Answer

fields

Answer

where

Question 17

A Splunk power user is designing a new data model to support Pivot users who need to analyze web traffic. The data model must be efficient and provide accurate field mappings. Which two actions should the user take to ensure the data model is optimized for Pivot and CIM compliance? (Choose two.)

Accepted Answer

Map fields to the Common Information Model (CIM) field names to enable compatibility with other CIM-based apps and dashboards.. Constraining the root event object to relevant data reduces the dataset size and improves performance. Mapping fields to CIM names ensures compatibility with other CIM-based apps and dashboards, which is essential for a data model intended for broad use. These two actions optimize the data model for Pivot and CIM compliance.

Answer

Add a large number of calculated fields to the data model to provide maximum flexibility for Pivot users.

Answer

Set the acceleration to run every minute to ensure near real-time data availability in Pivot.

Answer

Accelerate the data model with a summary range of 'All time' to ensure the fastest possible Pivot performance for any time range.

Question 18

You have a field 'ip_address' and want to tag it with 'internal' for specific subnets. What is the most efficient way to manage this?

Accepted Answer

Create an event type for the subnet, then tag the event type.. Event types let you define a reusable search-based classification (e.g., src_ip within internal subnets), and tags applied to the event type automatically propagate to all matching events. This is far more efficient than tagging individual events and keeps the tagging logic centralized and maintainable.

Answer

Manually tag every IP event one by one.

Answer

Write a search that updates the raw data.

Answer

Use a calculated field to add the tag.

Question 19

A dashboard has a panel that shows a table of error counts by host. Users want to click a host name and open a new dashboard filtered to that host. Which Simple XML element defines this behavior on the table panel?

Accepted Answer

A `` element containing a `` with a target dashboard and a token set from the clicked field.. Drilldown with a link is the Simple XML mechanism for click-through navigation. It captures the clicked field value into a token and navigates to a target dashboard, where that token filters the destination. The other elements either control display, visibility, or are not valid attributes for click behavior.

Answer

A `<chart>` element with an `onClick` handler that calls a saved search.

Answer

A `<search>` element with a `depends` attribute set to the host field.

Answer

A `<title>` element that references the host field as a token.

Question 20

What is the primary performance difference between using a 'lookup' command and a 'join' command?

Accepted Answer

Lookups are more efficient than joins for matching related data.. The lookup command is generally more efficient than the join command for matching related data because lookups are optimized for enriching events with data from a lookup table, often using in-memory or indexed structures, and do not require the subsearch and join overhead. Joins, especially with large datasets, can be resource-intensive and may hit subsearch limits.

Answer

Lookups are executed in memory, while joins use the disk.

Answer

Joins are faster for large datasets.

Answer

They perform the same.