SPLK-1004 Practice Test 5 — 25 Questions

Question 1

Which command is used to display specific fields in the output?

Accepted Answer

fields. The 'fields' command is used to include or exclude fields from the results.

Answer

display

Answer

select

Answer

show

Question 2

Which THREE actions can be performed when an alert triggers?

Accepted Answer

Run a script. Splunk natively supports sending emails, running custom scripts, and logging events to the internal index.

Answer

Delete the index

Answer

Reboot the server

Question 3

Which THREE features allow for more precise control over lookup performance?

Accepted Answer

Memory limit configuration. Lookup indexing, memory limits, and field filtering help maintain efficient lookups.

Answer

Data compression

Answer

User role permissions

Question 4

You are using a dependent dropdown. When the first dropdown changes, the second dropdown needs to re-run its search. How do you trigger this?

Accepted Answer

Include the first token in the second input's search query.. The second dropdown's search needs to reference the token from the first dropdown; when that token updates, the search automatically re-runs.

Answer

Use a 'drilldown' tag on the second input.

Answer

Use an 'on_change' script.

Answer

Set the 'refresh' attribute on the second input.

Question 5

A user reports that a data model acceleration summary is 'incomplete'. What is the most likely cause?

Accepted Answer

The summary search has not completed its initial scan of the historical data. If the data model is configured to search a time range that exceeds the retention period or the summary build is still in progress, the status will be incomplete.

Answer

The user does not have 'admin' permissions

Answer

The root search uses a lookup

Answer

The model is too large for the disk

Question 6

When using Pivot, what determines the field labels shown to the user?

Accepted Answer

The data model field display names. Field labels are derived from the data model field definitions, not the raw indexed field names.

Answer

The raw log field names

Answer

The user's preference settings

Answer

The index name

Question 7

When configuring a CSV lookup file, where is the file uploaded in Splunk?

Accepted Answer

Settings > Lookups > Lookup table files. Lookup table files are managed under Settings > Lookups > Lookup table files.

Answer

Settings > Indexes

Answer

Settings > Field extractions

Answer

Settings > Data inputs

Question 8

Which THREE factors influence the throttling behavior of an alert?

Accepted Answer

Suppress results by field. Throttling is determined by the suppression time, the scope (all or by field), and the alert configuration.

Answer

Search index name

Answer

User role

Question 9

You want to extend a data model object to include new fields. Which object type allows you to add child objects that inherit base constraints?

Accepted Answer

Child object. A 'Transaction' or 'Search' object can be used, but the standard way to extend structure is through a child object.

Answer

Lookup object

Answer

Event object

Answer

Pivot object

Question 10

What is the purpose of the 'CIM Validator' tool?

Accepted Answer

To verify data model CIM compliance. The CIM Validator helps ensure that your data model mappings comply with CIM standards.

Answer

To check for syntax errors in SPL

Answer

To update lookup files

Answer

To monitor indexer health

Question 11

Which feature allows you to explore data model data without writing SPL?

Accepted Answer

Pivot. Pivot is the visual tool designed to query data models without requiring manual SPL.

Answer

Data Preview

Answer

Field Extractor

Answer

Search App

Question 12

Which THREE of the following are true about the 'Data Model Audit' dashboard?

Accepted Answer

It displays acceleration status. It tracks acceleration status, disk usage, and search performance of data models.

Answer

It manages user passwords

Answer

It deletes old raw data logs

Question 13

You need to pass a field value from a search result into a workflow action URL. What syntax should you use in the URI field?

Accepted Answer

$field$. You use the $field$ syntax to reference a field value from the result row.

Answer

%field%

Answer

{field}

Answer

<field>

Question 14

Which TWO of the following are true regarding workflow action field targeting?

Accepted Answer

Actions can be restricted by sourcetype. Actions can be applied to specific fields, and they can be restricted to specific sourcetypes.

Answer

Actions can only apply to indexed fields

Answer

Actions require a macro to function

Answer

Actions apply globally to all fields by default

Question 15

When using the 'post-process' search feature in a dashboard, what is the main benefit?

Accepted Answer

It shares a single base search across multiple panels to reduce load.. Post-processing allows multiple panels to share the results of a single base search, reducing the total load on the Splunk indexers.

Answer

It enables the use of macros in the search string.

Answer

It allows for real-time streaming of events.

Answer

It allows the search to bypass the indexer entirely.

Question 16

When a dashboard panel uses a base search and a post-process search, which command is NOT allowed in the post-process search?

Accepted Answer

metadata. Post-process searches are limited to transforming commands; they cannot perform operations that require raw event data or index retrieval, such as 'metadata' or 'tstats'.

Answer

eval

Answer

sort

Answer

stats

Question 17

In the context of the CIM, what is a 'dataset'?

Accepted Answer

A base or child object in a data model. A dataset is a collection of events defined by search constraints in a data model.

Answer

A specific index name

Answer

A saved search result

Answer

A raw log file

Question 18

Which of the following is a key advantage of using KV Store lookups over CSV lookups?

Accepted Answer

They support dynamic updates and data types.. KV Store lookups are designed to be dynamic and support read/write operations from multiple sources.

Answer

They don't require lookup definitions.

Answer

They use less disk space.

Answer

They are faster for static data.

Question 19

When configuring a workflow action of type 'GET', what is the purpose of the 'Link URI' field?

Accepted Answer

To provide the target URL for the GET request. The Link URI field specifies the URL template that Splunk will navigate to when the workflow action is clicked, allowing for dynamic parameter injection.

Answer

To set the HTTP header for the request

Answer

To define the search query that the workflow action runs

Answer

To identify which index the data should be retrieved from

Question 20

Which type of workflow action allows you to execute a new search based on the value of a field in a current search result?

Accepted Answer

Search. A search-type workflow action allows users to trigger a new search, often using the context from the current result.

Answer

Dashboard

Answer

Report

Answer

GET

Answer

POST