SPLK-1004 Practice Test 3 — 30 Questions

Question 1

A SOC manager wants analysts to be able to right-click a `user` field value in search results and open that user's profile page in the organization's identity portal. The portal accepts a URL of the form `https://idp.example.com/user/<username>`. Which workflow action type and configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A GET workflow action with Link URI `https://idp.example.com/user/$user$` and the field name `user`.. Opening an external profile page requires a GET workflow action whose Link URI embeds the field token, because the platform substitutes the clicked field value into that token when building the URL. A POST action or a search action would not produce the browser navigation the portal expects, and omitting the token would drop the username entirely.

Answer

A POST workflow action with Link URI `https://idp.example.com/user/$user$` and the field name `user`.

Answer

A search workflow action with a Search string that queries the identity portal index for the username.

Answer

A GET workflow action with Link URI `https://idp.example.com/user/` and the field name `user`, relying on Splunk to append the value automatically.

Question 2

You have a dashboard with a base search that returns a large result set, and three panels that each apply different transforming commands to that base search. You want to avoid running the base search three times. Which approach should you use?

Accepted Answer

Use a post-process search in each panel that references a base search defined in a hidden panel or a global base search.. Post-process searches let multiple panels reuse the results of a single base search. The base search runs once, and its results are cached and made available to each panel's post-process search. This reduces the number of times the heavy base search executes, improving performance. Defining the base search in a hidden panel or globally is a common pattern.

Answer

Use a global search in the dashboard definition and reference it with the base attribute in each panel.

Answer

Create a scheduled report that runs the base search and use the output of that report in each panel via the loadjob command.

Answer

Define the base search in the first panel and use the <search> element with the ref attribute in the other panels.

Question 3

What is the purpose of 'calculated fields' within a data model?

Accepted Answer

To perform runtime field derivation. Calculated fields in a data model define new fields whose values are derived at search time using eval-style expressions on existing fields. They perform runtime field derivation without modifying the underlying indexed data.

Answer

To replace the need for lookups

Answer

To accelerate indexing

Answer

To modify raw log data on disk

Question 4

How do you calculate the percentage of total events for each status code?

Accepted Answer

stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100. The correct answer uses stats count by status to get counts per status, then eventstats sum(count) as total to compute the total across all events, and finally eval percent = (count/total)*100 to calculate the percentage. This is the standard Splunk pattern for percentage-of-total calculations because eventstats adds the aggregate total to each row without collapsing results. The combination ensures each status code's percentage is correctly derived from the overall event count.

Answer

stats count(status) as total

Answer

stats count by status | eval percent = count/total

Answer

chart count by status | addtotals

Question 5

A Splunk user wants to create a workflow action that appears when a user clicks on the `clientip` field in search results. The action should open an external website that displays geolocation information for that IP address. The URL for the website is `https://ipinfo.io/$clientip$`. Which type of workflow action should the user create?

Accepted Answer

Link. Workflow actions of type 'Link' are used to open external URLs, and they support tokens such as `$clientip$` that are replaced with the clicked field's value. The URL provided is a classic example of a link action. The other types, 'Search', 'Dashboard', and 'Script', are either not valid types or not appropriate for opening an external website.

Answer

Dashboard

Answer

Script

Answer

Search

Question 6

What is the maximum number of arguments a search macro can accept?

Accepted Answer

Unlimited (subject to system resources). Search macros in Splunk can accept any number of arguments; there is no hard-coded limit such as 5, 10, or 1. The only practical constraints are system resources and the complexity of the macro definition itself. Arguments are defined in the macro's argument list and referenced as $arg1$, $arg2$, etc., and Splunk will accept as many as you define.

Answer

1

Answer

10

Answer

5

Question 7

A user wants to use the tstats command to search an accelerated data model. Which of the following is a requirement for tstats to return results from the data model?

Accepted Answer

The data model must be accelerated and the user must have permissions to the data model. For tstats to query a data model, the data model must be accelerated. Additionally, the user must have permissions to access the data model. Acceleration creates summary files that tstats reads, enabling fast searches. Without acceleration, tstats cannot retrieve data from the data model. Permissions ensure the user is authorized. Thus, acceleration and permissions are the essential requirements.

Answer

The data model must be accelerated, and the user must be assigned the 'power' role

Answer

The data model must be accelerated, and the user must have the 'run_tstats' capability

Answer

The data model must be accelerated, and the user must have the 'search' capability

Question 8

A security analyst needs to create a Pivot report that shows failed authentication attempts over time, grouped by the targeted user account. The environment has the Splunk_TA_windows add-on and the Authentication data model accelerated. Which approach should the analyst take to build this Pivot?

Accepted Answer

Use the Authentication data model, select the Failed_Authentication_Attempts dataset, add a Split Row on user, and add a Column on _time using the Date histogram.. The Authentication data model provides the Failed_Authentication_Attempts dataset, which is the correct CIM-normalized source for failed logins. Splitting rows by user and adding a time-based column with a Date histogram delivers the required time-series view per account. Because the model is accelerated, Pivot queries the summary data efficiently, giving fast results without raw search overhead.

Answer

Use the Authentication data model, select the Successful_Authentication dataset, and use the stats command to count events by user.

Answer

Use the Endpoint data model, select the Processes dataset, filter on process_name=login, and split rows on process_user.

Answer

Use the Network_Traffic data model, select the All_Traffic dataset, filter on action=failure, and split rows on src_user.

Question 9

A Splunk power user is building a search that needs to calculate the difference in seconds between two epoch time fields, start_time and end_time, and then format the result as a human-readable duration like '1h 23m 45s'. The fields are numeric epoch values. Which eval expression accomplishes this?

Accepted Answer

eval duration = tostring(end_time - start_time, "duration"). The tostring function in Splunk supports a "duration" format that converts a numeric seconds value into a human-readable string like '1h 23m 45s'. By subtracting the start_time from end_time, the eval command produces the difference in seconds, which tostring then formats correctly. This approach is straightforward and leverages built-in formatting capabilities.

Answer

eval duration = end_time - start_time | convert dur2sec(duration)

Answer

eval duration = round(end_time - start_time, 0) . " seconds"

Answer

eval duration = strftime(end_time - start_time, "%Hh %Mm %Ss")

Question 10

You are using a dependent dropdown. When the first dropdown changes, the second dropdown needs to re-run its search. How do you trigger this?

Accepted Answer

Include the first token in the second input's search query.. In a dependent dropdown, the second dropdown's search query must reference the token from the first dropdown. When the first dropdown changes, the token value updates, and because the second dropdown's search includes that token, Splunk automatically re-runs the search to refresh the options. This is the standard mechanism for dependent inputs in Splunk dashboards.

Answer

Use a 'drilldown' tag on the second input.

Answer

Use an 'on_change' script.

Answer

Set the 'refresh' attribute on the second input.

Question 11

Which TWO pieces of information must be provided when defining a lookup table file upload?

Accepted Answer

Destination Filename. When defining a lookup table file upload, the two required pieces of information are the Destination Filename (B) and the Destination App (E). The Destination Filename (B) specifies the exact name of the lookup file (for example, a .csv file) that will be created or replaced in the destination app, so the system knows where to write the uploaded lookup data. The Destination App (E) identifies the Splunk app context in which the lookup file will be stored, ensuring the file is placed in the correct app's lookups directory and is available to knowledge objects in that app. The Lookup definition (A) is not required at upload time because the lookup definition (transform) can be created or referenced separately after the file exists. The Lookup index (C) is not applicable, since lookup files are stored as files in an app's lookups directory, not indexed as events in an index. Field aliases (D) are optional configuration applied to a lookup definition to map lookup fields to event fields, and are not required to upload the file itself.

Answer

Lookup definition

Answer

Lookup index

Answer

Field aliases

Question 12

What is the benefit of using the 'tstats' command for dashboard panels?

Accepted Answer

It is significantly faster because it queries metadata files.. The tstats command is significantly faster than a standard search because it queries the index's metadata (TSIDX) files rather than reading raw events. This makes it ideal for dashboard panels that need to aggregate large volumes of data quickly.

Answer

It automatically formats results for charts.

Answer

It retrieves the raw events for every search.

Answer

It allows joining multiple indexes automatically.

Question 13

You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?

Accepted Answer

stats dc(user) by department. The dc() function in Splunk's stats command stands for 'distinct count' and returns the number of unique values for a field. 'stats dc(user) by department' correctly counts unique users per department. The other functions either list values, return the values themselves, or count all events rather than unique occurrences.

Answer

stats list(user) by department

Answer

stats values(user) by department

Answer

stats count(user) by department

Question 14

Which THREE of the following are potential causes for a data model to fail to accelerate?

Accepted Answer

The indexer is running out of disk space. Option B is correct because data model acceleration builds and maintains summary files (tsidx) on the indexers, so if the indexer runs out of disk space the acceleration process cannot write or update those summaries and the model fails to accelerate. Option C is correct because acceleration is driven by the base search defined in the data model; if that base search is invalid or returns no results, there is nothing to accelerate and the acceleration job fails or produces no data. Option D is correct because acceleration must be explicitly enabled on the data model (the 'accelerated' setting), and if it is not set to accelerated, no acceleration job runs at all. Option A does not belong because having 'admin' rights is a permissions/role attribute that does not by itself prevent acceleration. Option E does not belong because browser caching affects client-side display of search results, not the server-side acceleration process.

Answer

The user has 'admin' rights

Answer

The browser is cached

Question 15

Which permission setting is required for other users to use a lookup table you have created?

Accepted Answer

App or Global. For other users to use a lookup table, its permissions must be set to App or Global. App-level permissions make the lookup available to all users of that app, while Global permissions make it available across all apps. These settings ensure the lookup is shared beyond the owner.

Answer

Owner-only

Answer

System-only

Answer

Private

Question 16

Which THREE of the following are common issues that cause a lookup to fail?

Accepted Answer

Incorrect object permissions.. Option A is correct because lookup operations run under the permissions of the user or role executing the search, so if that user lacks read access to the lookup definition or the underlying lookup file, the lookup fails with a permission error. Option B is correct because lookup matching is typically case-sensitive by default (for example, in Splunk's lookup matching), so a value like "User1" in the event will not match "user1" in the lookup table unless case sensitivity is explicitly handled. Option C is correct because if the lookup file (such as a CSV) was never uploaded or the lookup definition points to a nonexistent file, the lookup cannot resolve and returns no results or an error. Option D is not a common cause because lookup execution does not require admin privileges; a non-admin user with the appropriate capabilities and object permissions can run lookups successfully. Option E is not a common cause because indexes store event data, not lookup tables, and an index being full does not prevent a lookup from resolving against its lookup file.

Answer

The user is not an admin.

Answer

The index is full.

Question 17

You need to pass a field value from a search result into a workflow action URL. What syntax should you use in the URI field?

Accepted Answer

$field$. In Splunk workflow actions, the URI field uses dollar-sign syntax ($field$) to reference a field value from the search result, which Splunk substitutes at runtime when the action is invoked. This token replacement happens when the user clicks the workflow action, injecting the actual field value into the URL. The $field$ syntax is Splunk's standard token substitution format used across workflow actions, dashboards, and forms.

Answer

%field%

Answer

{field}

Answer

<field>

Question 18

Which TWO of the following are benefits of using a lookup instead of a join?

Accepted Answer

Reduced memory consumption.. Option A (Reduced memory consumption) is correct because a lookup enriches events by matching field values against a compact lookup table (e.g., a CSV or KV Store lookup) rather than building and holding the larger intermediate result sets that a join creates when combining two searches, so less memory is used. Option B (Improved search performance) is correct because lookup matching is a fast, single-pass enrichment against a small table, avoiding the expensive subsearch execution and result correlation that joins require, which typically yields faster searches. Option C is not correct because handling real-time streaming data is a property of ingestion/indexing (e.g., real-time search or streaming commands), not a specific benefit of lookups over joins. Option D is not correct because subsearches are a feature of the search language itself and can be used with joins as well; lookups do not provide subsearch support as a distinguishing benefit. Option E is not correct because lookups do not automatically update indexes; index updates occur through indexing, and lookup tables must be refreshed or managed separately.

Answer

Ability to handle real-time streaming data.

Answer

Support for subsearches.

Answer

Automatic index updating.

Question 19

Which menu path in Splunk Web allows you to view the list of saved dashboards?

Accepted Answer

Settings > Dashboards. In Splunk Web, saved dashboards are managed under Settings > Dashboards, which lists all dashboards the user has permission to view, along with options to edit, clone, or delete them. This is the central location for dashboard administration, distinct from the search and reporting interface.

Answer

Search > Reports

Answer

Activity > Jobs

Answer

Apps > Manage Apps

Question 20

You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?

Accepted Answer

Field Lookup. A field lookup is the recommended tool because it maps values from an existing field (like numerical status codes) to corresponding values in a lookup table (like human-readable descriptions). This is a classic lookup use case: enriching event data with external reference information without modifying raw data. Calculated fields, event types, and field aliases cannot perform this code-to-text mapping from an external table.

Answer

Calculated Field

Answer

Event Type

Answer

Field Alias