SPLK-1004 Field Management And Calculated Fields Practice Test 3 — 15 Questions

Question 1

Which configuration file would you modify to assign a tag to a field-value pair manually?

Accepted Answer

tags.conf. The tags.conf file is the Splunk configuration file that defines tag definitions, mapping a tag name to specific field-value pairs (for example, tagging host=web01 with the tag 'production'). Manual assignment of a tag to a field-value pair is done by editing tags.conf, typically via Settings > Tags in Splunk Web or by directly editing the file in an app's local directory.

Answer

props.conf

Answer

eventtypes.conf

Answer

transforms.conf

Question 2

What is the result of applying multiple aliases to the same field?

Accepted Answer

The field will have multiple valid names in the search.. In Splunk, field aliases allow you to assign alternative names to a field without removing the original. When multiple aliases are applied to the same field, the field becomes accessible by all those names in searches. This means you can reference the field by its original name or any of its aliases, and they all point to the same underlying data. This is useful for normalizing field names across different sourcetypes.

Answer

The original field name is deleted.

Answer

The search will fail due to a conflict.

Answer

Only the first alias takes effect.

Question 3

Which of the following is a requirement for using a CSV lookup?

Accepted Answer

A lookup definition must exist for the CSV file.. In Splunk, a CSV lookup requires a lookup definition (also called a lookup table definition) to be created, which maps the CSV file to a named lookup that can be invoked in search commands like lookup or inputlookup. The definition specifies the file path, the lookup type (CSV), and optionally advanced settings like case sensitivity or matching fields. Without a lookup definition, Splunk cannot resolve the CSV file as a lookup table, even if the file exists in the appropriate directory. Thus, option A is the correct requirement.

Answer

The CSV must be indexed into the _internal index.

Answer

The CSV must be placed in the /etc/indexes directory.

Answer

The CSV needs to be converted to JSON.

Question 4

Where can you define an event type?

Accepted Answer

In the Settings > Event types menu.. Event types can be defined through the Splunk Web interface under Settings > Event types. This menu allows users to create, edit, and manage event types, which are saved searches that categorize events based on search criteria. Event types are then used in other configurations, such as tags and alerts.

Answer

In the indexer's inputs.conf file.

Answer

In the user's .bashrc file.

Answer

Directly in the search head's license file.

Question 5

What is the effect of the 'overwrite' setting in a lookup configuration?

Accepted Answer

It replaces the existing field value with the lookup result.. The overwrite setting in a lookup configuration determines whether the lookup result replaces the existing field value in the event. When overwrite is set to true (1), the value returned by the lookup overwrites the original field value; when false (0), the lookup result is written to a new field or only used if the original field is null. This is critical for controlling data enrichment behavior.

Answer

It deletes the original raw data.

Answer

It forces the lookup to run at index time.

Answer

It forces the lookup to run only for admins.

Question 6

You want to create a lookup that updates automatically as new data arrives. Which feature should you use?

Accepted Answer

KV Store lookup.. A KV Store lookup stores lookup data in Splunk's MongoDB-based key-value store, which can be updated programmatically and dynamically via REST API or the outputlookup command, allowing the lookup to reflect new data as it arrives. This makes it the correct choice for a lookup that updates automatically.

Answer

Field alias.

Answer

Calculated field.

Answer

CSV file lookup.

Question 7

Which of the following is true about field extractions?

Accepted Answer

They use regular expressions to parse data.. Field extractions in Splunk use regular expressions to parse raw data and extract fields. They can be defined at search time (via props.conf EXTRACT- or the UI) or at index time (via transforms.conf and props.conf), but the core mechanism is regex-based parsing.

Answer

They are only available for the 'admin' role.

Answer

They must be defined at index time.

Answer

They only work on JSON data.

Question 8

A user complains that a calculated field is not showing up. Which of the following is the best first step to troubleshoot?

Accepted Answer

Check if the field is in the 'Selected Fields' or 'Interesting Fields' list.. When a calculated field (defined via props.conf EVAL- or a calculated field in the UI) does not appear, the most likely cause is that the field was not extracted or the search did not return it in the current result set. The fastest, least invasive first step is to check whether the field appears in the 'Selected Fields' or 'Interesting Fields' sidebar, since Splunk only lists fields that were actually extracted in the returned events. This confirms whether the field exists at all before escalating to configuration or infrastructure changes.

Answer

Restart the Splunk service.

Answer

Change the indexer's cluster master.

Answer

Delete the index and re-ingest the data.

Question 9

What is the purpose of the 'tags.conf' file?

Accepted Answer

It stores user-defined tags.. tags.conf stores user-defined tags that are applied to field-value pairs, enabling analysts to search by meaningful labels (e.g., tag=production) instead of memorizing specific field values. Tags are defined in tags.conf under [=] stanzas with tagName = enabled. This makes tags a knowledge object for search-time enrichment, not a parsing or lookup mechanism.

Answer

It defines the search string for an event type.

Answer

It manages lookup table file paths.

Answer

It configures the web interface dashboard colors.

Question 10

How can you view all existing field aliases in the Splunk Web interface?

Accepted Answer

Settings > Fields > Field aliases.. In Splunk Web, field aliases are managed under Settings > Fields > Field aliases, where administrators can create, view, edit, and delete aliases that map existing field names to common names without modifying the underlying data. This location lists all aliases defined in the current app context, allowing you to review them. The other Settings menus handle unrelated configuration areas such as data ingestion, lookups, and index storage.

Answer

Settings > Data inputs.

Answer

Settings > Lookups.

Answer

Settings > Indexes.

Question 11

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. Option B is correct because the Field Extractor UI tool in Splunk (accessible via Settings > Fields > Field Extractions or from the search results) provides a guided, interactive way to define regex-based or delimiter-based field extractions and automatically writes the resulting configuration to props.conf and transforms.conf. Option E is correct because editing props.conf and transforms.conf directly is the underlying, supported configuration method for creating field extractions: props.conf defines the stanza (sourcetype/host/source) and references a transform via REPORT or EXTRACT, while transforms.conf defines the regex or delimiter-based extraction logic. Option A is incorrect because indexes.conf controls index-level settings such as storage paths, retention, and sizing, not field extraction definitions. Option C is incorrect because modifying raw log files on disk alters the source data itself and does not create any Splunk extraction configuration. Option D is incorrect because there is no 'index' search command that creates field extractions; the search bar is used for querying and testing extractions, not for defining them.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 12

When creating a calculated field, what does the 'EVAL-' prefix in props.conf indicate?

Accepted Answer

It indicates a calculated field definition.. In Splunk's props.conf, the 'EVAL-' prefix defines a calculated field — a field whose value is computed at search time using an expression. For example, EVAL-total = price * quantity creates a field named 'total' derived from other fields. This is the standard syntax for search-time field extraction via calculated fields, and it does not require the field to be indexed.

Answer

It identifies a field for a lookup table.

Answer

It marks the field as a source for an alias.

Answer

It forces the field to be indexed.

Question 13

You have a field 'ip_address' and want to tag it with 'internal' for specific subnets. What is the most efficient way to manage this?

Accepted Answer

Create an event type for the subnet, then tag the event type.. Event types let you define a reusable search-based classification (e.g., src_ip within internal subnets), and tags applied to the event type automatically propagate to all matching events. This is far more efficient than tagging individual events and keeps the tagging logic centralized and maintainable.

Answer

Manually tag every IP event one by one.

Answer

Write a search that updates the raw data.

Answer

Use a calculated field to add the tag.

Question 14

Which TWO of the following are steps required to configure a CSV lookup?

Accepted Answer

Upload the CSV file.. Option A is correct because configuring a CSV lookup begins by uploading the CSV file to Splunk, typically via Settings > Lookups > Lookup table files, so the lookup table data is available to the search head. Option C is correct because after the file is uploaded you must create a lookup definition (Settings > Lookups > Lookup definitions) that maps the lookup name to the CSV file and defines fields, which is what allows the lookup to be invoked in SPL. Option B is not required because CSV headers are part of the uploaded file itself and are not modified as a separate configuration step. Option D is not required because lookup configuration does not need an indexer restart; lookups are resolved on the search head. Option E is not required because the license manager governs indexing volume, not lookup table configuration.

Answer

Modify the raw data to include the CSV headers.

Answer

Restart the Splunk indexer.

Answer

Add the CSV to the license manager.

Question 15

Which THREE of the following are standard configuration files for field management?

Accepted Answer

transforms.conf. In Splunk, field management (field extraction and field transformations) is configured through transforms.conf, fields.conf, and props.conf. transforms.conf [B] defines field transformations and regex-based extractions (e.g., REGEX, FORMAT, SOURCE_KEY) that create or modify fields. fields.conf [C] controls how indexed and search-time fields are handled, particularly specifying whether a field is indexed (INDEXED=true/false) and how it is extracted at search time. props.conf [E] is where field extractions are associated with source types, hosts, or sources via TRANSFORMS and REPORT stanzas, tying the extraction logic to incoming data. The unmarked options do not belong: indexes.conf [A] configures index storage, retention, and paths, not field management, and inputs.conf [D] configures data inputs such as monitors, TCP/UDP ports, and scripted inputs, not field extraction or transformation.

Answer

indexes.conf

Answer

inputs.conf