SPLK-1004 Practice Questions 1 — 50 Questions

Question 1

You want to extend a data model object to include new fields. Which object type allows you to add child objects that inherit base constraints?

Accepted Answer

Child object. A child object in a data model is the object type specifically designed to inherit constraints from a parent (base) object and add new fields or constraints. Child objects extend the base event or search object, inheriting its constraints while allowing additional field definitions. This is the mechanism Splunk provides for building hierarchical data models without duplicating base constraints.

Answer

Lookup object

Answer

Event object

Answer

Pivot object

Question 2

A dashboard has multiple inputs. When a user changes one, you want the others to reset. How can you achieve this using Simple XML?

Accepted Answer

Define a 'change' block with for the other tokens.. In Simple XML, a block attached to an input fires whenever that input's token value changes, and the element inside it removes the values of other tokens. By placing inside the change handler, the dependent inputs lose their current selection and revert to their default state, effectively resetting them. This is the documented Splunk pattern for cascading input resets.

Answer

Use an 'on_load' script.

Answer

Use a 'global' scope for all tokens.

Answer

Use the 'reset' attribute on the input.

Question 3

You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?

Accepted Answer

The source fields required for the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time and depend on the source fields they reference being present in the events. If the fields used in the regex extraction or math calculation are not extracted (either via props.conf/transforms.conf or field extractions), the calculated field cannot compute a value and will not appear in results. The calculation itself does not require indexing of the extracted fields, only that the source fields exist at search time.

Answer

The underlying extracted fields are not indexed.

Answer

The lookup table is not defined.

Answer

The user lacks the 'can_run_calculated_fields' capability.

Question 4

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. Option B is correct because the Field Extractor UI tool in Splunk (accessible via Settings > Fields > Field Extractions or from the search results) provides a guided, interactive way to define regex-based or delimiter-based field extractions and automatically writes the resulting configuration to props.conf and transforms.conf. Option E is correct because editing props.conf and transforms.conf directly is the underlying, supported configuration method for creating field extractions: props.conf defines the stanza (sourcetype/host/source) and references a transform via REPORT or EXTRACT, while transforms.conf defines the regex or delimiter-based extraction logic. Option A is incorrect because indexes.conf controls index-level settings such as storage paths, retention, and sizing, not field extraction definitions. Option C is incorrect because modifying raw log files on disk alters the source data itself and does not create any Splunk extraction configuration. Option D is incorrect because there is no 'index' search command that creates field extractions; the search bar is used for querying and testing extractions, not for defining them.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 5

A security team wants every event tagged with the sourcetype 'cisco:asa' to also carry the tag 'firewall' so analysts can search 'tag=firewall' without typing the sourcetype. A power user opens Settings > Tags and sees no existing tags for that sourcetype. What is the most efficient way to apply the tag to ALL current and future cisco:asa events?

Accepted Answer

Create a tag named 'firewall' and apply it directly to the 'cisco:asa' sourcetype field value in the Tags settings page. Tags in Splunk are knowledge objects attached to specific field/value pairs, and tagging a sourcetype value applies that tag to every event with that sourcetype. This is the only listed method that persists the tag for both existing and future events without altering raw data or creating a parallel dataset.

Answer

Run a search that adds 'tag=firewall' to each event and save the results to a summary index

Answer

Create a calculated field named 'firewall' with the eval expression 'if(sourcetype=="cisco:asa", "true", "false")'

Answer

Edit each event's raw text with the 'replace' command to append the string 'firewall'

Question 6

A security analyst needs to correlate failed login attempts with subsequent successful logins for the same user within 10 minutes. The relevant events are in the 'auth' index with fields 'user', 'action' (failed or success), and '_time'. Which command should be used to achieve this correlation?

Accepted Answer

transaction user maxspan=10m startswith=action="failed" endswith=action="success". The transaction command is designed to group related events into a single transaction based on a common field and time constraints. By specifying startswith and endswith, it ensures that only sequences beginning with a failed login and ending with a successful login within 10 minutes are grouped. This precisely matches the analyst's need to correlate failed attempts with subsequent successful logins for the same user.

Answer

stats count by user, action | where action="failed" AND action="success"

Answer

join user [ search index=auth action=success ]

Answer

eventstats values(action) as actions by user | where mvcount(actions)>1

Question 7

What is the purpose of the 'CIM Validator' tool?

Accepted Answer

To verify data model CIM compliance. The CIM Validator tool is designed to verify that indexed data conforms to the Common Information Model — checking whether the fields, tags, and eventtypes required by a given CIM data model are correctly present and populated. It runs validation searches against your data and reports which CIM-required fields are missing or malformed. This helps ensure that data model acceleration and CIM-based apps work correctly.

Answer

To check for syntax errors in SPL

Answer

To update lookup files

Answer

To monitor indexer health

Question 8

Which TWO of the following are benefits of using the CIM?

Accepted Answer

Simplified correlation across disparate sources. The Common Information Model (CIM) in Splunk provides a normalized, schema-based layer on top of indexed data, so option B is correct: by mapping fields from many different sourcetypes to common field names and tags, CIM enables simplified correlation across disparate sources (e.g., joining firewall, proxy, and authentication events on a shared src/dest/user model). Option E is also correct because CIM defines a standardized set of field names and data models, giving analysts a consistent search syntax and field vocabulary for common data regardless of the original source format. The unmarked options do not belong: CIM does not automatically generate raw log files (A), does not automatically delete sensitive data (C), and does not increase disk space for indexes (D) — it is a knowledge-layer normalization scheme, not a data-collection, retention, or storage-expansion mechanism.

Answer

Automatic generation of raw log files

Answer

Automatic deletion of sensitive data

Answer

Increased disk space for indexes

Question 9

You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?

Accepted Answer

props.conf. Automatic lookups that run for every search on a specific sourcetype are configured in props.conf using the `LOOKUP-<name>` setting. This setting associates a lookup definition (defined in transforms.conf) with a sourcetype, and the lookup is applied automatically at search time. This is the most appropriate place because props.conf controls sourcetype-specific configurations.

Answer

indexes.conf

Answer

lookups.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 10

Which THREE of the following are valid sources of information for a Workflow Action link?

Accepted Answer

Values from fields in the search result. Option A is correct because a Workflow Action link can dynamically pull values from fields in the search result, allowing the URI to be constructed based on the specific event or record returned. Option C is correct because fixed text in the URI string is a valid static source, enabling the link to include constant portions such as a base URL or static path. Option E is correct because values from the search query parameters can be referenced, letting the action link incorporate the user's original search terms or filters. Option B is not valid because user passwords are never exposed as a source for constructing action links, as that would be a severe security risk. Option D is not valid because system time is not a supported dynamic source for Workflow Action links in this context.

Answer

User password

Answer

System time

Question 11

Which of the following best describes the difference between an event type and a tag?

Accepted Answer

Event types group events by search criteria, while tags label field values.. An event type is a saved search that categorizes events based on search criteria, effectively grouping events that match a certain pattern. A tag, on the other hand, is a label applied to specific field-value pairs, allowing you to search for events with that tag. This distinction — event types group events by search criteria, tags label field values — is the fundamental difference.

Answer

Event types are only for reports, while tags are for dashboard panels.

Answer

Event types only work in the search bar.

Answer

Tags are faster than event types for searching.

Question 12

How do you handle case-insensitive filtering in a 'where' clause?

Accepted Answer

where lower(field) = "value". Splunk's where command uses eval-style expressions, and the correct way to perform case-insensitive comparison is to normalize the field with lower() (or upper()) and compare against a lowercase literal. The syntax where lower(field) = "value" is valid eval expression syntax and reliably matches regardless of case.

Answer

where field == /value/i

Answer

where field = '(?i)value'

Answer

where field.case = "ignore"

Question 13

How do you handle a field that exists in your data but is not explicitly defined in a CIM data model?

Accepted Answer

Add a new field definition to the object. In Splunk CIM, if a field exists in your data but is not defined in a data model object, you can add a new field definition to that object. This is done by editing the data model in the Data Model Editor, where you can add fields, set their type, and map them to CIM fields. This allows the field to be used in Pivot and other CIM-based searches. Renaming the raw log field is not necessary and would not integrate it into the CIM. Deleting the CIM model is destructive and unnecessary. You can add custom fields to CIM models, so option D is false.

Answer

Rename the raw log field

Answer

Delete the CIM model and start over

Answer

You cannot add custom fields to CIM models

Question 14

A Splunk administrator is configuring a workflow action that will appear when a user clicks on a field value in search results. The action should open a new browser tab to an external threat intelligence website, passing the field value as a query parameter. The administrator sets the action type to `link` and configures the URI as `https://threatintel.example.com/search?q=$value$`. However, when testing, the link opens in the same tab, replacing the Splunk UI. Which setting must be adjusted to ensure the link opens in a new tab?

Accepted Answer

Set `target` to `_blank` in the workflow action configuration.. For workflow actions of type `link`, the `target` setting determines where the link opens. The default is `_self`, which replaces the current page. To open in a new tab, set `target` to `_blank`. This setting is separate from the URI and must be configured explicitly. Changing the action type or embedding HTML attributes in the URI will not achieve the desired behavior.

Answer

Enable `popup` in the workflow action configuration.

Answer

Set `link.uri` to include `target="_blank"` as an HTML attribute.

Answer

Change the action type from `link` to `search`.

Question 15

In a data model, what is the impact of setting the 'Max Time' for an accelerated model?

Accepted Answer

It sets the age limit for the summary index. The 'Max Time' setting for an accelerated data model specifies the maximum age of events that are summarized in the acceleration summary index. Events older than this limit are not included in the acceleration, effectively setting an age limit for the summary index data.

Answer

It determines the refresh rate

Answer

It limits the number of events indexed

Answer

It restricts search execution time

Question 16

A Splunk administrator is designing a lookup that will be used in a real-time alert to enrich incoming events with user department information. The lookup must support rapid updates without restarting Splunk, allow multiple users to modify entries concurrently, and provide the ability to define a lookup with a case-sensitive match. The administrator wants to use a KV Store lookup instead of a CSV lookup. Which two statements accurately describe KV Store lookups in this context? (Choose two.)

Accepted Answer

KV Store lookups can be updated in real time without restarting Splunk, and changes are immediately available to searches.. KV Store lookups leverage MongoDB, allowing concurrent updates and immediate visibility of changes without restarting Splunk. These features make them ideal for dynamic enrichment in real-time alerts. The other statements are incorrect because KV Store replication requires explicit configuration, case sensitivity is not a mandatory setting, and KV Store lookups are not created by CSV upload.

Answer

KV Store lookups can only be created by uploading a CSV file through the Splunk web interface.

Answer

KV Store lookups require a lookup definition with a case-sensitive match setting to be configured in transforms.conf.

Answer

KV Store lookups automatically replicate data across all search heads in a distributed environment without additional configuration.

Question 17

You want to hide a panel based on the value of a token. Which attribute should you use in the dashboard XML?

Accepted Answer

depends="$token$". The depends attribute in Simple XML controls panel visibility by evaluating a token expression; when the expression is true (token is set and non-empty), the panel is shown, and when false, the panel is hidden. This is the documented mechanism for conditionally displaying panels based on token values.

Answer

hidden="$token$"

Answer

visible="$token$"

Answer

show="true"

Question 18

A Splunk administrator is configuring a field extraction for a custom sourcetype. The raw event data contains a field named `user` that sometimes includes a domain prefix (e.g., `DOMAIN\username`). The administrator wants to create a new field `username` that contains only the username portion, stripping the domain prefix if present. The extraction should work at search time and be available for all users. Which of the following is the most efficient and correct method?

Accepted Answer

Create a calculated field using `EVAL-username = replace(user, "^[^\\]+\\", "")` in `props.conf`.. Calculated fields using `EVAL-` in `props.conf` allow for dynamic transformation of field values at search time. Using `replace()` with a regular expression to strip the domain prefix is efficient and only executes when the field is referenced. This method ensures the transformation is applied consistently and is available to all users of the app. Other methods like field aliases or lookups do not perform the necessary string manipulation.

Answer

Use a field alias in `props.conf` to map `username` to `user`.

Answer

Define a search-time field extraction using a regular expression in `props.conf` with `EXTRACT-username = (?<username>[^\\]+)$`.

Answer

Create a lookup table that maps `user` to `username` and configure an automatic lookup.

Question 19

You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?

Accepted Answer

Field name mismatch between event and lookup.. An automatic lookup joins fields from the lookup table to fields in the event stream at search time. If the field name referenced in the lookup definition (the 'Lookup input field') does not exist in the events, or the case/name differs from what the lookup CSV header expects, the lookup silently returns no matches and the lookup fields remain null. Since the definition and automatic rule were already verified, the most common remaining cause is a field name mismatch between the event data and the lookup table.

Answer

The lookup is set to read-only.

Answer

The lookup is shared globally.

Answer

The lookup table file is too large.

Question 20

When creating a workflow action, what is the 'Label' field used for?

Accepted Answer

The name shown in the user interface. The 'Label' field in a Splunk workflow action controls the human-readable text that appears in the event action menu (the dropdown that shows when you click an event in Search results). It is purely a display string — it does not affect how the action is matched, executed, or stored. Administrators use it to give users a meaningful, descriptive name like 'Search for this IP' rather than an internal identifier.

Answer

The internal name used in configurations

Answer

The field name to which the action is attached

Answer

The search query executed by the action