SPLK-1004 Practice Questions 1 — 50 Questions

Question 1

What is the result of 'transaction' command compared to 'stats'?

Accepted Answer

Transaction groups events by time and common fields.. Transaction groups events into a single entity based on shared fields and time constraints.

Answer

Transaction is for reporting only.

Answer

Transaction is always faster than stats.

Answer

Stats can only be used with time.

Question 2

When creating a calculated field, what does the 'EVAL-' prefix in props.conf indicate?

Accepted Answer

It indicates a calculated field definition.. The 'EVAL-' prefix tells Splunk that the following expression should be evaluated as a calculated field.

Answer

It identifies a field for a lookup table.

Answer

It marks the field as a source for an alias.

Answer

It forces the field to be indexed.

Question 3

You have a field 'ip_address' and want to tag it with 'internal' for specific subnets. What is the most efficient way to manage this?

Accepted Answer

Create an event type for the subnet, then tag the event type.. Event types can be used to label the subnets, and then tags can be applied to those event types.

Answer

Manually tag every IP event one by one.

Answer

Write a search that updates the raw data.

Answer

Use a calculated field to add the tag.

Question 4

When using the 'inputfields' parameter in a lookup definition, what happens?

Accepted Answer

It maps search-time fields to lookup table columns.. The inputfields parameter defines which fields in your search results should map to the fields in the lookup table.

Answer

It restricts the output fields to only those specified.

Answer

It hides the lookup results from unauthorized users.

Answer

It automatically indexes the lookup data.

Question 5

Which configuration file would you modify to assign a tag to a field-value pair manually?

Accepted Answer

tags.conf. tags.conf is the configuration file where manual tag assignments are stored.

Answer

props.conf

Answer

eventtypes.conf

Answer

transforms.conf

Question 6

You defined a lookup that is not working. You verified the CSV exists and the app permissions are correct. What search-time troubleshooting step should you perform?

Accepted Answer

Verify the lookup is applied to the correct sourcetype in props.conf.. Checking the 'sourcetype' settings in props.conf is crucial to ensure the lookup is actually applied to the data.

Answer

Check the indexer logs for 'lookup_failure'.

Answer

Rebuild the tsidx files.

Answer

Run a search with 'metadata' command.

Question 7

Which of the following best describes the difference between an event type and a tag?

Accepted Answer

Event types group events by search criteria, while tags label field values.. Event types group events based on search strings, while tags are simple key-value pairs used to label events.

Answer

Event types are only for reports, while tags are for dashboard panels.

Answer

Event types only work in the search bar.

Answer

Tags are faster than event types for searching.

Question 8

Which TWO of the following are valid lookup types?

Accepted Answer

KV Store lookup.. CSV lookups and KV Store lookups are two of the most common types in Splunk.

Answer

Raw log lookup.

Answer

SQL lookup.

Answer

TXT file lookup.

Question 9

How do you extract a portion of a string using 'eval'?

Accepted Answer

eval new = substr(old, 1, 5). The 'substr' function extracts a substring based on start and length indices.

Answer

eval new = cut(old, 1, 5)

Answer

eval new = slice(old, 1, 5)

Answer

eval new = extract(old, 1, 5)

Question 10

Which THREE of the following items are configured in props.conf?

Accepted Answer

Field alias.. props.conf is the central hub for search-time configuration, including extractions, aliases, and lookups.

Answer

Index retention policy.

Answer

Search head distribution.

Question 11

You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?

Accepted Answer

Field name mismatch between event and lookup.. The most common reason for an automatic lookup failing is a field name mismatch between the event data and the lookup table header.

Answer

The lookup is set to read-only.

Answer

The lookup is shared globally.

Answer

The lookup table file is too large.

Question 12

You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?

Accepted Answer

Field Lookup. A lookup table is the standard way to map a key (status) to a value (status_desc).

Answer

Calculated Field

Answer

Event Type

Answer

Field Alias

Question 13

What is the effect of the 'overwrite' setting in a lookup configuration?

Accepted Answer

It replaces the existing field value with the lookup result.. If overwrite is enabled, the lookup will replace existing fields in the event if the lookup fields have the same name.

Answer

It deletes the original raw data.

Answer

It forces the lookup to run at index time.

Answer

It forces the lookup to run only for admins.

Question 14

Which THREE of the following are benefits of using calculated fields?

Accepted Answer

They allow for complex string manipulations.. They enable mathematical operations, conditional logic, and string manipulations at search time.

Answer

They are stored as raw data.

Answer

They automatically increase index speed.

Question 15

You have a macro that uses a search command that is not allowed by the user's role. What happens when the user tries to run the macro?

Accepted Answer

The macro expansion succeeds but the command fails. If the underlying search is restricted by role-based search filters or command constraints, the search will fail or be restricted accordingly.

Answer

The macro is blocked from expanding

Answer

The user is prompted to elevate privileges

Answer

The macro is automatically sanitized

Question 16

When configuring a field alias in props.conf, which of the following is true?

Accepted Answer

The alias appears in the 'interesting fields' list.. Aliases are applied at search time and respect the order of operations, occurring after extractions.

Answer

The alias name must be identical to the original field name.

Answer

The alias is applied before field extraction.

Answer

The alias must reference an external CSV.

Question 17

Which THREE of the following are valid ways to manage Search Macros in Splunk?

Accepted Answer

Using the REST API. Macros can be managed via the Web UI, direct editing of macros.conf, or using the REST API.

Answer

Using the 'Indexes' configuration page

Answer

Via the 'Saved Searches' menu

Question 18

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. The Field Extractor (UI) and editing props.conf/transforms.conf are the two standard ways.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 19

What is the primary benefit of creating an Event Type?

Accepted Answer

To easily identify and group specific sets of events.. Event types allow you to label a group of events based on a search, making them easier to identify in results.

Answer

To increase indexing performance.

Answer

To automate the ingestion of new data.

Answer

To hide events from unauthorized users.

Question 20

You want to filter out events where the 'action' field is empty. Which command is best?

Accepted Answer

where isnotnull(action) AND action!="". The 'where' command allows for complex logical filtering.

Answer

filter action != null

Answer

search action=*

Answer

eval action = if(isnull(action), "remove", action) | search action!="remove"