SPLK-1004 Field Management And Calculated Fields Practice Test 2 — 15 Questions

Question 1

An administrator maintains a lookup table `user_map.csv` that is updated nightly by an external script. The lookup definition currently uses `case_sensitive_match = false` and the search `| lookup user_map userid AS user OUTPUT department` returns stale departments for some users. Which setting should be examined first to ensure the lookup reflects the most current file contents without restarting Splunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The lookup file's modification time is checked and the lookup is reloaded automatically when the file changes. Lookup freshness depends on Splunk detecting a change to the underlying file's modification time and reloading it. Options that adjust matching behavior cannot fix stale data because they operate on already-loaded rows. The productive first step is confirming the file was rewritten at the expected path and that its mtime advanced, which triggers an automatic reload of the lookup contents.

Answer

case_sensitive_match

Answer

max_matches and case_sensitive_match together

Answer

max_matches

Question 2

A power user is troubleshooting a dashboard panel that uses a lookup to enrich events with a 'region' field. The lookup file is updated daily, but the panel sometimes shows stale region values even after the file is replaced. The panel search references the lookup with the lookup command. Which action best ensures the panel always uses the latest lookup file content without restarting Splunk?

Accepted Answer

Ensure the lookup definition does not have caching enabled or configure the lookup to reload, such as by using a lookup definition without the cache setting or by relying on Splunk's automatic file change detection. Lookup staleness is typically a caching behavior. Splunk caches lookup files for performance, and the cache is refreshed based on the lookup definition settings and file change detection. The correct approach is to review the lookup definition's caching configuration and ensure the file is being reloaded when it changes, rather than adding nonexistent search arguments.

Answer

Configure the lookup definition with 'case_sensitive_match = 0'

Answer

Set 'max_matches' to a higher value in the lookup definition

Answer

Add the 'refresh=1' argument to the lookup command in the panel search

Question 3

A Splunk power user is creating calculated fields for a dashboard that monitors web server performance. The user wants to extract the response time from a field named `duration_ms` (which is in milliseconds) and display it in seconds as `duration_sec`. The user also wants to create a field `status_category` that categorizes HTTP status codes into 'success' (2xx), 'redirect' (3xx), 'client_error' (4xx), and 'server_error' (5xx). Which TWO of the following calculated field definitions are correct and will achieve these goals? (Choose two.)

Accepted Answer

EVAL-status_category = case(status >= 200 AND status < 300, "success", status >= 300 AND status < 400, "redirect", status >= 400 AND status < 500, "client_error", status >= 500 AND status < 600, "server_error"). The correct calculated fields are those that use `EVAL-` syntax and appropriate functions. Dividing `duration_ms` by 1000 yields seconds. Using `case()` with explicit conditions for each status range correctly categorizes the status codes. The other options either use less precise arithmetic or include unnecessary categories, deviating from the specified requirements.

Answer

EVAL-status_category = if(status >= 200 AND status < 300, "success", if(status >= 300 AND status < 400, "redirect", if(status >= 400 AND status < 500, "client_error", "server_error")))

Answer

EVAL-duration_sec = duration_ms * 0.001

Answer

EVAL-status_category = case(status >= 200 AND status < 300, "success", status >= 300 AND status < 400, "redirect", status >= 400 AND status < 500, "client_error", status >= 500 AND status < 600, "server_error", "unknown")

Question 4

A knowledge manager is defining a regex-based field extraction in props.conf for a custom sourcetype. Which TWO statements about search-time field extraction precedence and behavior are accurate? (Choose two.)

Accepted Answer

Inline extractions defined in the search string are applied after automatic extractions from props.conf and transforms.conf. Search-time processing follows a defined sequence: automatic extractions, then inline extractions, with aliases resolved before calculated fields. Inline syntax can therefore override configured extractions, and EVAL expressions can reference aliased names. Calculated fields cannot be targets of aliases because aliasing completes first, and no search-time extraction ever rewrites indexed raw data.

Answer

Automatic extractions defined in props.conf or transforms.conf run before inline extractions in the search string

Answer

Search-time extractions permanently modify the raw event text stored in the index

Answer

Calculated fields are evaluated before field aliases, so an alias can reference an EVAL-derived field

Question 5

A Splunk power user needs to create a field alias so that searches using `clientip` automatically match the existing extracted field `src_ip`. The user wants this alias to apply only to events from the `access_combined` sourcetype. Which of the following is the correct configuration to achieve this?

Accepted Answer

In `props.conf`, under the `[access_combined]` stanza, add `FIELDALIAS-clientip = src_ip`.. Field aliases are defined in `props.conf` using the `FIELDALIAS- = AS ` syntax. This creates a search-time alias that allows users to search using the alias name. The configuration must be placed under the appropriate stanza, such as the sourcetype. The other options either use incorrect file, incorrect syntax, or achieve a similar but not identical result with calculated fields.

Answer

In `props.conf`, under the `[access_combined]` stanza, add `ALIAS-clientip = src_ip`.

Answer

In `transforms.conf`, under the `[access_combined]` stanza, add `REGEX = (?<clientip>\d+\.\d+\.\d+\.\d+)`.

Answer

In `props.conf`, under the `[access_combined]` stanza, add `EVAL-clientip = src_ip`.

Question 6

A Splunk power user is creating calculated fields in `props.conf` to normalize data from multiple sourcetypes. The user wants to ensure that the calculated fields are evaluated correctly and efficiently. Which two of the following statements are true regarding calculated fields? (Choose two.)

Accepted Answer

Calculated fields can reference other calculated fields, but the evaluation order is not guaranteed unless dependencies are explicitly managed.. Calculated fields are defined in `props.conf` using `EVAL-<fieldname>`. They can reference other calculated fields, but the evaluation order is not guaranteed, so dependencies must be managed carefully. They do not modify raw data and can use any eval function. The other statements are false because calculated fields are not in `transforms.conf`, do not require lookups, and support a wide range of operations.

Answer

Calculated fields are permanent and modify the raw event data, making them available for all users without additional configuration.

Answer

Calculated fields can only use a limited set of eval functions, such as `lower` and `upper`, and cannot perform arithmetic operations.

Answer

Calculated fields are defined in `transforms.conf` and require a lookup table to function.

Question 7

A Splunk power user wants to rename the extracted field `src_ip` to `client_ip` at search time without modifying the original data or creating a new field. Which of the following should the user do?

Accepted Answer

Create a field alias in `props.conf` using `FIELDALIAS-client_ip = src_ip AS client_ip`.. A field alias is the correct way to persistently rename a field at search time without altering raw data or creating a new field. It is defined in `props.conf` with `FIELDALIAS- = AS `. The other options either are not persistent, create a new field, or modify the original extraction.

Answer

Use the `rename` command in the search: `... | rename src_ip AS client_ip`.

Answer

Use the `eval` command to create a new field: `... | eval client_ip = src_ip`.

Answer

Modify the field extraction in `transforms.conf` to output the field as `client_ip` instead of `src_ip`.

Question 8

When configuring a field alias in props.conf, which of the following is true?

Accepted Answer

The alias appears in the 'interesting fields' list.. When a field alias is configured in props.conf, the alias appears in the 'interesting fields' list in Splunk Web, allowing users to search by the alias name. The alias does not change the original field name; it provides an alternate name. Field aliases are applied at search time after field extraction, and they do not require an external CSV.

Answer

The alias name must be identical to the original field name.

Answer

The alias is applied before field extraction.

Answer

The alias must reference an external CSV.

Question 9

What is the primary benefit of creating an Event Type?

Accepted Answer

To easily identify and group specific sets of events.. An event type is a saved search-time definition that categorizes events based on a search string, letting users tag and group similar events under a friendly name (e.g., 'failed_login'). Its primary purpose is to make it easy to identify, classify, and later reference groups of related events in searches and dashboards via the eventtype field.

Answer

To increase indexing performance.

Answer

To automate the ingestion of new data.

Answer

To hide events from unauthorized users.

Question 10

You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?

Accepted Answer

Field Lookup. A field lookup is the recommended tool because it maps values from an existing field (like numerical status codes) to corresponding values in a lookup table (like human-readable descriptions). This is a classic lookup use case: enriching event data with external reference information without modifying raw data. Calculated fields, event types, and field aliases cannot perform this code-to-text mapping from an external table.

Answer

Calculated Field

Answer

Event Type

Answer

Field Alias

Question 11

You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?

Accepted Answer

props.conf. Automatic lookups that run for every search on a specific sourcetype are configured in props.conf using the `LOOKUP-<name>` setting. This setting associates a lookup definition (defined in transforms.conf) with a sourcetype, and the lookup is applied automatically at search time. This is the most appropriate place because props.conf controls sourcetype-specific configurations.

Answer

indexes.conf

Answer

lookups.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 12

Which of the following best describes the difference between an event type and a tag?

Accepted Answer

Event types group events by search criteria, while tags label field values.. An event type is a saved search that categorizes events based on search criteria, effectively grouping events that match a certain pattern. A tag, on the other hand, is a label applied to specific field-value pairs, allowing you to search for events with that tag. This distinction — event types group events by search criteria, tags label field values — is the fundamental difference.

Answer

Event types are only for reports, while tags are for dashboard panels.

Answer

Event types only work in the search bar.

Answer

Tags are faster than event types for searching.

Question 13

You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?

Accepted Answer

The source fields required for the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time and depend on the source fields they reference being present in the events. If the fields used in the regex extraction or math calculation are not extracted (either via props.conf/transforms.conf or field extractions), the calculated field cannot compute a value and will not appear in results. The calculation itself does not require indexing of the extracted fields, only that the source fields exist at search time.

Answer

The underlying extracted fields are not indexed.

Answer

The lookup table is not defined.

Answer

The user lacks the 'can_run_calculated_fields' capability.

Question 14

You want to create a calculated field that multiplies 'price' by 'tax_rate'. Why should you avoid using a field alias for this?

Accepted Answer

Field aliases do not support mathematical operators.. Field aliases in Splunk simply map an existing field name to an alternate name — they do not transform or compute values. Because aliases only rename, they cannot evaluate expressions like price * tax_rate. A calculated field, by contrast, uses eval-style expressions to compute a new value at search time, which is exactly what's needed for arithmetic operations.

Answer

Calculated fields are faster.

Answer

Calculated fields are more secure.

Answer

Aliases are deprecated.

Question 15

You need to create a persistent field mapping that allows users to search for 'user_id' instead of 'uid' without modifying the underlying raw data. Which feature should you use?

Accepted Answer

Field Aliases. Field aliases in Splunk allow you to create an alternate name for an existing field without modifying the raw data or the original field. By defining a field alias, users can search for 'user_id' and Splunk will automatically map it to the 'uid' field. This is the correct feature for providing a persistent, search-time mapping.

Answer

Lookups

Answer

Field Extractions

Answer

Calculated Fields