SPLK-1004 Data Models And CIM — 15 Questions

Question 1

You have a data model that is failing to accelerate. Where should you check to verify if the summary index files are being created successfully?

Accepted Answer

The 'Data Model Audit' dashboard in the CIM app. The Data Model Audit dashboard in the CIM app is the correct place to verify whether summary index files are being created successfully for an accelerated data model. This dashboard provides visibility into the acceleration process, including whether summaries are being generated, any errors encountered, and the status of the acceleration. It is specifically designed for troubleshooting data model acceleration issues.

Answer

The 'splunkd.log' file exclusively

Answer

The 'Indexes' page in Settings

Answer

Settings > Data Models > Audit

Question 2

You need to create a data model object that combines two separate event sources. Which object type should you use?

Accepted Answer

Transaction object. A Transaction object allows for grouping and combining events based on shared fields and temporal constraints.

Answer

Event object

Answer

Search object

Answer

Lookup object

Question 3

Which of the following is a valid method to create a new data model?

Accepted Answer

Running a 'tstats' command. Data models are created through the Settings > Data Models menu.

Answer

Using the 'dbinspect' command

Answer

Editing the 'props.conf' file directly

Question 4

Which THREE of the following are common CIM compliance requirements?

Accepted Answer

Using standard field names (e.g., 'user', 'src', 'dest'). Option A is correct because the Common Information Model (CIM) in Splunk requires normalizing data to standardized field names such as 'user', 'src', and 'dest' so that events from disparate sources can be correlated and searched consistently. Option B is correct because CIM compliance involves mapping raw events to defined event types (e.g., authentication, network traffic) so that data models and accelerated searches can operate on them. Option E is correct because applying event tags is a core CIM practice that classifies events into categories like authentication or malware, enabling data model constraints and tag-based searches to function. Option C is incorrect because CIM promotes standardized, shared field names rather than unique custom names per source, which would defeat normalization. Option D is incorrect because disabling all accelerations is not a CIM requirement; data model acceleration is often used to improve performance and is unrelated to compliance with the model's field and tag conventions.

Answer

Creating unique custom field names for every source

Answer

Disabling all accelerations

Question 5

Which TWO of the following objects can be used to add fields to a data model?

Accepted Answer

Calculated fields. Calculated fields (B) are correct because they let you derive new fields in a data model by evaluating expressions or formulas over existing fields, adding a new field to the model's schema. Lookup fields (E) are also correct because they add a field to a data model by retrieving a value from another dataset or lookup table based on a matching key, effectively enriching the model with an additional field. Alert fields (A) are not used to extend a data model; alerts are conditions or notifications triggered on existing data rather than new schema fields. Index fields (C) do not add new fields either — indexing is a performance optimization applied to existing fields to speed up searches. Report fields (D) are not a mechanism for adding fields to a data model; reports present or format data from the model rather than defining new model fields.

Answer

Alert fields

Answer

Index fields

Answer

Report fields

Question 6

Which TWO of the following are valid ways to improve the performance of a data model search?

Accepted Answer

Enable data model acceleration. Option A is correct because enabling data model acceleration pre-computes and stores the model's results in summary (tsidx) files on the indexers, so searches against the accelerated data model run against the smaller, pre-built summaries instead of re-running the full base search over raw events, dramatically improving performance. Option C is correct because constraining the root search to a single index reduces the number of index buckets that must be scanned and merged, which lowers search cost and speeds up data model population and any non-accelerated searches. Options B, D, and E are not valid performance improvements: increasing child objects (B) adds more constraints and complexity that can slow the search, changing index storage to a heavy forwarder (D) is not a supported way to store indexed data and would not improve search speed, and adding more lookup definitions (E) introduces additional lookup processing overhead rather than improving data model search performance.

Answer

Increase the number of child objects

Answer

Change the index storage from indexer to heavy forwarder

Answer

Add more lookup definitions

Question 7

Which THREE of the following are required to make data CIM compliant?

Accepted Answer

Using CIM-compliant field names. To make data CIM compliant, you must map your fields to CIM-compliant field names (Option A), because the Common Information Model defines standardized field names for each data model, and searches and correlation rules rely on those exact names. You must also ensure event categories match the CIM model (Option D), since each CIM data model specifies which event categories (e.g., authentication, network traffic, endpoint) its fields and tags apply to, and mismatched categories break model validation. Finally, you must tag event types with the appropriate CIM tags (Option E), as tags are the mechanism that associates events with a specific CIM data model and its fields, enabling model-based searches and dashboards. Storing data in a 'cim' index (Option B) is not required — CIM compliance is about field naming, categories, and tags, not the index name, and data typically remains in its original index. Using only JSON formatted logs (Option C) is also not required, because CIM compliance can be achieved with any sourcetype as long as field extraction and tagging produce the correct CIM fields, categories, and tags.

Answer

Storing data in the 'cim' index

Answer

Using only JSON formatted logs

Question 8

Which THREE of the following are true about the 'Data Model Audit' dashboard?

Accepted Answer

It displays acceleration status. The Data Model Audit dashboard in Splunk is designed to surface information about data models and their acceleration, so option A is correct because it displays the acceleration status of data models (e.g., whether acceleration is enabled, its status, and related details). Option B is correct because the dashboard helps identify unoptimized searches by showing search activity and highlighting searches that are not optimized for acceleration or that could benefit from tuning. Option C is correct because it shows storage usage of summary files, which are the TSIDX/summary artifacts created when data model acceleration runs, helping administrators monitor disk consumption. Option D is incorrect because user password management is handled by authentication and user management features, not by the Data Model Audit dashboard. Option E is incorrect because deleting old raw data logs is a retention/index lifecycle task, not a function of the Data Model Audit dashboard.

Answer

It manages user passwords

Answer

It deletes old raw data logs

Question 9

A security analyst runs a Pivot that uses the Authentication data model. The analyst wants to see a breakdown of failed logins by user and by source IP address. Which Pivot element should the analyst configure to display this information?

Accepted Answer

Split rows by user and split columns by src. Pivot allows analysts to explore data model datasets without writing SPL. To break down failed logins by user and source IP, the analyst must use split rows and split columns. Setting split rows to 'user' and split columns to 'src' produces a matrix showing counts for each combination. This directly satisfies the requirement to see failed logins by both dimensions.

Answer

Use the 'user' and 'src' fields as column values and set the cell value to count

Answer

Create a new data model that includes both user and src as fields

Answer

Add a filter for action=failure and set the statistic to count

Question 10

A Splunk administrator is troubleshooting a data model acceleration that has been running for several days. The acceleration summary for a root event object is showing as only 60% complete, even though the acceleration schedule is set to run every hour with a 1-hour max time. The search head has sufficient resources, and the indexers are not overloaded. Which of the following is the most likely cause?

Accepted Answer

The acceleration max time span is set to a value that is too short, causing the acceleration to only cover part of the data.. The max time span for acceleration controls how much data is accelerated per run. If it is set too low relative to the data volume and schedule, the acceleration will not keep up, leaving the summary incomplete. Other options, such as field count or licensing, would typically cause different symptoms or complete failure. High cardinality might slow but not prevent completion. Thus, the max time span setting is the most likely cause.

Answer

The data model contains too many fields in the root event object, causing the acceleration to time out.

Answer

The acceleration search is being skipped because the search head is not licensed for data model acceleration.

Answer

The data model includes a large number of high-cardinality fields that are not being summarized efficiently.

Question 11

A security analyst runs a Pivot from the Authentication data model and applies a filter on the 'action' field for the value 'failure'. The analyst then saves this Pivot as a report. Later, another user opens the saved report and sees that the 'action' filter was not preserved, and all authentication events are returned. What is the most likely reason the filter was lost?

Accepted Answer

The filter was applied as a temporary element in the Pivot interface and was not saved as part of the report definition.. When you create a Pivot and apply filters, those filters become part of the Pivot definition. If you save the Pivot as a report, the filters are included. However, if you apply a filter after saving the report, or if you save the report before adding the filter, the filter will not be saved. The scenario indicates the filter was not preserved, which points to the filter not being part of the saved report definition.

Answer

The data model acceleration for the Authentication data model was disabled, causing filters to be lost.

Answer

The user who saved the report did not have permission to save filters, so the filter was stripped.

Answer

The 'action' field is not a valid field in the Authentication data model, so the filter was ignored.

Question 12

A Splunk administrator is designing a data model for web proxy logs. The requirement is to extract the HTTP status code from the raw event field `status` and map it to the CIM field `status` in the Web data model. Which data model object type should be used to define this field mapping?

Accepted Answer

Root event object with a field alias for the `status` field.. Field aliases in the root event object of a data model map raw event fields to CIM field names. This normalization allows the data model to present a consistent schema for Pivot and tstats. Using a field alias for the `status` field directly fulfills the requirement to map the HTTP status code to the CIM field.

Answer

Transaction object with a group-by field.

Answer

Event object with a field extraction using a regex.

Answer

Attribute object with a field alias and a lookup.

Question 13

A Splunk power user is creating a new data model and wants to ensure that the fields are properly mapped to the Common Information Model (CIM). The user has defined a field called 'user' in the data model and wants to map it to the CIM 'user' field. Which of the following is the correct way to map this field in the data model editor?

Accepted Answer

In the data model editor, add a field with the name 'user' and in the 'Field Mapping' section, specify the CIM field name 'user' as the target.. To map a field to the CIM, you define the field in the data model and then specify the corresponding CIM field name in the field's mapping settings. This is typically done by editing the data model JSON or using the field editor to set the 'CIM' attribute. The correct method involves explicitly setting the CIM field name for the field.

Answer

In the data model editor, add a field with the name 'user' and set its type to 'string', then in the 'CIM' tab, select the 'user' field from the list of CIM fields.

Answer

In the data model editor, create a new field named 'user' and then use the 'CIM Mapping' button to automatically map it to the closest CIM field.

Answer

In the data model editor, add a field with the name 'user' and then in the 'Constraints' section, add a constraint that the field must match the CIM 'user' field.

Question 14

A Splunk administrator is troubleshooting a data model that is not returning expected results in Pivot. The data model is accelerated, but some fields are missing and the acceleration summary is incomplete. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Check the acceleration settings and ensure that the data model acceleration is not disabled or expired. Missing fields and incomplete acceleration summaries typically stem from incorrect field mappings or acceleration configuration issues. Verifying that fields are correctly mapped to the CIM data model ensures they appear in Pivot. Checking acceleration settings confirms that the summary is being generated and is up to date. Together, these actions address the most common causes of the described symptoms.

Answer

Recreate the data model from scratch to ensure all fields are included

Answer

Run the CIM Validator tool to identify any missing or incorrect field mappings

Answer

Increase the acceleration time range to cover a longer period

Question 15

A Splunk power user is creating a data model to normalize firewall logs. Which two actions are required to ensure the data model is CIM-compliant for the Network Traffic data model? (Choose two.)

Accepted Answer

Map the raw destination IP field to the CIM `dest` field using a field alias.. For CIM compliance with the Network Traffic data model, the raw source and destination IP fields must be mapped to the CIM fields `src` and `dest` using field aliases. These mappings ensure that the data model correctly represents network traffic, enabling accurate Pivot and tstats searches.

Answer

Define a transaction object grouping events by session ID.

Answer

Add a tag for `network` and `communicate` to the event type.

Answer

Create a calculated field that concatenates source and destination IPs.