SPLK-1004 Practice Questions 2 — 50 Questions

Question 1

Which THREE pieces of information are displayed in the 'Search Macros' listing page in Splunk Web?

Accepted Answer

Arguments. In Splunk Web, the Settings > Advanced Search > Search Macros listing page presents a table of existing macros with columns that include the Macro Name (E), the Arguments (B) that the macro accepts, and the Definition (D) showing the macro's search string or SPL content. These three fields are exactly what the listing displays so users can identify, parameterize, and inspect macros without opening each one. The page does not show a Last run time (A), since Splunk does not track or display macro execution timestamps in this listing. It also does not show an Owner role (C); ownership/permissions are managed separately and are not a column on the Search Macros listing page.

Answer

Last run time

Answer

Owner role

Question 2

Which of the following is an effective strategy to optimize a search that filters by a specific user?

Accepted Answer

Filter by indexed fields as early as possible.. Filtering by indexed fields as early as possible in the search is an effective optimization strategy because it reduces the amount of data that needs to be processed in later stages. Indexed fields are those that are extracted at index time (e.g., host, source, sourcetype, and custom indexed fields), and filtering on them allows Splunk to use the index efficiently, skipping irrelevant data. This is a best practice for search performance.

Answer

Use the 'regex' command instead of 'where'.

Answer

Include a subsearch for all users.

Answer

Always put the 'stats' command at the start.

Question 3

When using 'stats', how does the 'values()' function differ from 'list()'?

Accepted Answer

Values() returns unique values, list() returns all values.. In Splunk's stats command, values() returns the unique (deduplicated) values of a field, while list() returns all values including duplicates. Both preserve order of appearance by default, but only values() removes duplicates. This distinction matters when counting distinct items versus listing every occurrence.

Answer

List() sorts the data automatically.

Answer

Values() is faster than list().

Answer

Values() is only for numbers.

Question 4

A Splunk power user creates a workflow action of type 'Search' that uses a field named `clientip` to launch a search for that IP address. The user wants the search to open in a new window and to pass the field value as a search term. Which configuration settings are required to achieve this?

Accepted Answer

Set 'Search String' to `index=main $clientip$` and enable 'Open in new window'.. For a 'Search' type workflow action, the search query is defined in the 'Search String' field, and field values are substituted using dollar signs. Enabling 'Open in new window' ensures the search opens in a new browser window. The other options misuse the 'Link URI' field or fail to substitute the field value correctly.

Answer

Set 'Search String' to `index=main clientip` and enable 'Open in new window'.

Answer

Set 'Link URI' to `search?q=index=main $clientip$` and set 'Open in new window' to false.

Answer

Set 'Link URI' to `search?q=index=main $clientip$` and enable 'Open in new window'.

Question 5

Which of the following is a requirement for using a CSV lookup?

Accepted Answer

A lookup definition must exist for the CSV file.. In Splunk, a CSV lookup requires a lookup definition (also called a lookup table definition) to be created, which maps the CSV file to a named lookup that can be invoked in search commands like lookup or inputlookup. The definition specifies the file path, the lookup type (CSV), and optionally advanced settings like case sensitivity or matching fields. Without a lookup definition, Splunk cannot resolve the CSV file as a lookup table, even if the file exists in the appropriate directory. Thus, option A is the correct requirement.

Answer

The CSV must be indexed into the _internal index.

Answer

The CSV must be placed in the /etc/indexes directory.

Answer

The CSV needs to be converted to JSON.

Question 6

A Splunk user is working with the CIM and notices that a data model contains a dataset named 'Authentication' and another named 'Failed_Authentication'. What is the relationship between these two datasets?

Accepted Answer

Failed_Authentication is a child dataset of Authentication, inheriting its fields and adding constraints.. In the CIM, datasets can have parent-child relationships. Failed_Authentication is a child of Authentication, meaning it inherits all fields and adds constraints to select only failed events. This allows for consistent field usage and efficient searches. The other options incorrectly describe the hierarchy or lack thereof.

Answer

Authentication is a child dataset of Failed_Authentication, inheriting its fields.

Answer

They are unrelated datasets that happen to share similar field names.

Answer

They are independent root datasets that both contain authentication events.

Question 7

When using 'chart', what is the behavior if you do not specify a 'by' clause?

Accepted Answer

It creates a single-series chart for the entire result set.. When you use the chart command without a 'by' clause, Splunk produces a single-series chart that aggregates the entire result set into one row/series. The chart command requires at least one aggregation function (e.g., count, sum) and without a 'by' clause it simply applies that function to all events, returning one data point per aggregation.

Answer

It returns an error.

Answer

It defaults to the first field found.

Answer

It returns the same as 'stats'.

Question 8

If a data model is accelerated, where are the summary files stored on the indexer?

Accepted Answer

In the _datamodel_summary index. When a data model is accelerated, Splunk stores the summary files in the _datamodel_summary index. This is a dedicated internal index created specifically for data model acceleration summaries, separate from the main index and other internal indexes. Knowing this location is important for capacity planning and troubleshooting.

Answer

In the main index

Answer

In the user's home directory

Answer

In the /var/lib/splunk/storage directory

Question 9

You want a macro to expand to a specific set of fields. Which field in the macro definition would you use to provide a default value if the user provides no arguments?

Accepted Answer

Default value. In a Splunk macro definition, the 'Default value' field provides a value that is used when the user does not supply an argument for a corresponding argument placeholder. This allows macros to be called with fewer arguments than defined, using defaults for the missing ones. The Arguments field defines the argument names, and the Definition field contains the macro's search string.

Answer

Arguments

Answer

Definition

Answer

Validation text

Question 10

Which TWO of the following are valid lookup types in Splunk?

Accepted Answer

KV Store lookup. KV Store lookups (A) are a valid Splunk lookup type, defined with a transforms.conf stanza using external_type = kvstore and backed by the app's MongoDB-based KV Store collections, allowing lookups to be created and edited via the Splunk Web UI or REST API. CSV lookups (D) are also valid, defined with external_type = csv and a filename pointing to a .csv file in the app's lookups directory, and are the most common file-based lookup type. The remaining options are not Splunk lookup types: there is no 'Database lookup' (B) type (external database access is done via DB Connect, which surfaces data as lookups or via dbxquery), no 'Log lookup' (C) type, and no 'Text lookup' (E) type — Splunk supports CSV, KV Store, and external/scripted lookup types, not these.

Answer

Database lookup

Answer

Log lookup

Answer

Text lookup

Question 11

A SOC manager wants analysts to be able to right-click a `user` field value in search results and open that user's profile page in the organization's identity portal. The portal accepts a URL of the form `https://idp.example.com/user/<username>`. Which workflow action type and configuration should be used?

Accepted Answer

A GET workflow action with Link URI `https://idp.example.com/user/$user$` and the field name `user`.. Opening an external profile page requires a GET workflow action whose Link URI embeds the field token, because the platform substitutes the clicked field value into that token when building the URL. A POST action or a search action would not produce the browser navigation the portal expects, and omitting the token would drop the username entirely.

Answer

A POST workflow action with Link URI `https://idp.example.com/user/$user$` and the field name `user`.

Answer

A search workflow action with a Search string that queries the identity portal index for the username.

Answer

A GET workflow action with Link URI `https://idp.example.com/user/` and the field name `user`, relying on Splunk to append the value automatically.

Question 12

You have a dashboard with a base search that returns a large result set, and three panels that each apply different transforming commands to that base search. You want to avoid running the base search three times. Which approach should you use?

Accepted Answer

Use a post-process search in each panel that references a base search defined in a hidden panel or a global base search.. Post-process searches let multiple panels reuse the results of a single base search. The base search runs once, and its results are cached and made available to each panel's post-process search. This reduces the number of times the heavy base search executes, improving performance. Defining the base search in a hidden panel or globally is a common pattern.

Answer

Use a global search in the dashboard definition and reference it with the base attribute in each panel.

Answer

Create a scheduled report that runs the base search and use the output of that report in each panel via the loadjob command.

Answer

Define the base search in the first panel and use the <search> element with the ref attribute in the other panels.

Question 13

What is the purpose of 'calculated fields' within a data model?

Accepted Answer

To perform runtime field derivation. Calculated fields in a data model define new fields whose values are derived at search time using eval-style expressions on existing fields. They perform runtime field derivation without modifying the underlying indexed data.

Answer

To replace the need for lookups

Answer

To accelerate indexing

Answer

To modify raw log data on disk

Question 14

How do you calculate the percentage of total events for each status code?

Accepted Answer

stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100. The correct answer uses stats count by status to get counts per status, then eventstats sum(count) as total to compute the total across all events, and finally eval percent = (count/total)*100 to calculate the percentage. This is the standard Splunk pattern for percentage-of-total calculations because eventstats adds the aggregate total to each row without collapsing results. The combination ensures each status code's percentage is correctly derived from the overall event count.

Answer

stats count(status) as total

Answer

stats count by status | eval percent = count/total

Answer

chart count by status | addtotals

Question 15

A Splunk user wants to create a workflow action that appears when a user clicks on the `clientip` field in search results. The action should open an external website that displays geolocation information for that IP address. The URL for the website is `https://ipinfo.io/$clientip$`. Which type of workflow action should the user create?

Accepted Answer

Link. Workflow actions of type 'Link' are used to open external URLs, and they support tokens such as `$clientip$` that are replaced with the clicked field's value. The URL provided is a classic example of a link action. The other types, 'Search', 'Dashboard', and 'Script', are either not valid types or not appropriate for opening an external website.

Answer

Dashboard

Answer

Script

Answer

Search

Question 16

What is the maximum number of arguments a search macro can accept?

Accepted Answer

Unlimited (subject to system resources). Search macros in Splunk can accept any number of arguments; there is no hard-coded limit such as 5, 10, or 1. The only practical constraints are system resources and the complexity of the macro definition itself. Arguments are defined in the macro's argument list and referenced as $arg1$, $arg2$, etc., and Splunk will accept as many as you define.

Answer

1

Answer

10

Answer

5

Question 17

A user wants to use the tstats command to search an accelerated data model. Which of the following is a requirement for tstats to return results from the data model?

Accepted Answer

The data model must be accelerated and the user must have permissions to the data model. For tstats to query a data model, the data model must be accelerated. Additionally, the user must have permissions to access the data model. Acceleration creates summary files that tstats reads, enabling fast searches. Without acceleration, tstats cannot retrieve data from the data model. Permissions ensure the user is authorized. Thus, acceleration and permissions are the essential requirements.

Answer

The data model must be accelerated, and the user must be assigned the 'power' role

Answer

The data model must be accelerated, and the user must have the 'run_tstats' capability

Answer

The data model must be accelerated, and the user must have the 'search' capability

Question 18

A security analyst needs to create a Pivot report that shows failed authentication attempts over time, grouped by the targeted user account. The environment has the Splunk_TA_windows add-on and the Authentication data model accelerated. Which approach should the analyst take to build this Pivot?

Accepted Answer

Use the Authentication data model, select the Failed_Authentication_Attempts dataset, add a Split Row on user, and add a Column on _time using the Date histogram.. The Authentication data model provides the Failed_Authentication_Attempts dataset, which is the correct CIM-normalized source for failed logins. Splitting rows by user and adding a time-based column with a Date histogram delivers the required time-series view per account. Because the model is accelerated, Pivot queries the summary data efficiently, giving fast results without raw search overhead.

Answer

Use the Authentication data model, select the Successful_Authentication dataset, and use the stats command to count events by user.

Answer

Use the Endpoint data model, select the Processes dataset, filter on process_name=login, and split rows on process_user.

Answer

Use the Network_Traffic data model, select the All_Traffic dataset, filter on action=failure, and split rows on src_user.

Question 19

A Splunk power user is building a search that needs to calculate the difference in seconds between two epoch time fields, start_time and end_time, and then format the result as a human-readable duration like '1h 23m 45s'. The fields are numeric epoch values. Which eval expression accomplishes this?

Accepted Answer

eval duration = tostring(end_time - start_time, "duration"). The tostring function in Splunk supports a "duration" format that converts a numeric seconds value into a human-readable string like '1h 23m 45s'. By subtracting the start_time from end_time, the eval command produces the difference in seconds, which tostring then formats correctly. This approach is straightforward and leverages built-in formatting capabilities.

Answer

eval duration = end_time - start_time | convert dur2sec(duration)

Answer

eval duration = round(end_time - start_time, 0) . " seconds"

Answer

eval duration = strftime(end_time - start_time, "%Hh %Mm %Ss")

Question 20

You are using a dependent dropdown. When the first dropdown changes, the second dropdown needs to re-run its search. How do you trigger this?

Accepted Answer

Include the first token in the second input's search query.. In a dependent dropdown, the second dropdown's search query must reference the token from the first dropdown. When the first dropdown changes, the token value updates, and because the second dropdown's search includes that token, Splunk automatically re-runs the search to refresh the options. This is the standard mechanism for dependent inputs in Splunk dashboards.

Answer

Use a 'drilldown' tag on the second input.

Answer

Use an 'on_change' script.

Answer

Set the 'refresh' attribute on the second input.