SPLK-1004 Field Management And Calculated Fields Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are common issues that cause a lookup to fail?

Accepted Answer

Incorrect object permissions.. Option A is correct because lookup operations run under the permissions of the user or role executing the search, so if that user lacks read access to the lookup definition or the underlying lookup file, the lookup fails with a permission error. Option B is correct because lookup matching is typically case-sensitive by default (for example, in Splunk's lookup matching), so a value like "User1" in the event will not match "user1" in the lookup table unless case sensitivity is explicitly handled. Option C is correct because if the lookup file (such as a CSV) was never uploaded or the lookup definition points to a nonexistent file, the lookup cannot resolve and returns no results or an error. Option D is not a common cause because lookup execution does not require admin privileges; a non-admin user with the appropriate capabilities and object permissions can run lookups successfully. Option E is not a common cause because indexes store event data, not lookup tables, and an index being full does not prevent a lookup from resolving against its lookup file.

Answer

The user is not an admin.

Answer

The index is full.

Question 2

Which THREE of the following are true regarding the order of operations for search-time field extractions?

Accepted Answer

Tags are applied after all other field operations.. Option B is correct because in Splunk's search-time knowledge object processing order, tags are applied last, after all other field operations such as extraction, aliasing, calculated fields, and lookups. Option C is correct because calculated fields are evaluated after field aliases, meaning aliases are resolved first and calculated fields can then reference the aliased names. Option E is correct because field extraction occurs before field aliases, so aliases can only rename fields that have already been extracted. Option A is incorrect because lookups run after field extraction, not before, since lookups typically require extracted fields as input. Option D is incorrect because field aliases happen after field extraction, not before, as aliases depend on fields already existing from extraction.

Answer

Lookups happen before field extraction.

Answer

Field aliases happen before field extraction.

Question 3

Which THREE of the following items are configured in props.conf?

Accepted Answer

Field alias.. In Splunk, props.conf is the configuration file that controls how the indexer or search head parses, transforms, and enriches incoming data at search time and index time. Option C (Field alias) is correct because field aliases are defined in props.conf using the FIELDALIAS- setting to map an existing field name to an alternate name. Option D (Automatic lookups) is correct because automatic lookups are configured in props.conf via LOOKUP- stanzas, which apply lookup tables to events automatically at search time. Option E (Field extraction) is correct because inline, transform, and regex-based field extractions are defined in props.conf through settings such as EXTRACT-, REPORT-, and TRANSFORMS-. Option A (Index retention policy) is not configured in props.conf; retention is controlled in indexes.conf using settings like frozenTimePeriodInSecs and maxTotalDataSizeMB. Option B (Search head distribution) is not configured in props.conf; search head clustering and distribution are handled through server.conf and the search head clustering configuration, not props.conf.

Answer

Index retention policy.

Answer

Search head distribution.

Question 4

A security team wants every event tagged with the sourcetype 'cisco:asa' to also carry the tag 'firewall' so analysts can search 'tag=firewall' without typing the sourcetype. A power user opens Settings > Tags and sees no existing tags for that sourcetype. What is the most efficient way to apply the tag to ALL current and future cisco:asa events?

Accepted Answer

Create a tag named 'firewall' and apply it directly to the 'cisco:asa' sourcetype field value in the Tags settings page. Tags in Splunk are knowledge objects attached to specific field/value pairs, and tagging a sourcetype value applies that tag to every event with that sourcetype. This is the only listed method that persists the tag for both existing and future events without altering raw data or creating a parallel dataset.

Answer

Run a search that adds 'tag=firewall' to each event and save the results to a summary index

Answer

Create a calculated field named 'firewall' with the eval expression 'if(sourcetype=="cisco:asa", "true", "false")'

Answer

Edit each event's raw text with the 'replace' command to append the string 'firewall'

Question 5

A Splunk administrator wants to create a calculated field that combines the values of two existing extracted fields, 'src_ip' and 'dest_ip', into a new field named 'conversation' with a hyphen separating them. The administrator needs this field to be available in searches immediately without editing any configuration files on the indexers. Where should the administrator define this calculated field?

Accepted Answer

In the calculated fields configuration page under Settings > Fields > Calculated Fields. Calculated fields are defined through the Calculated Fields configuration page in Splunk Web, which automatically updates props.conf with EVAL-<fieldname> directives. This method meets the requirement of immediate availability without direct file edits on indexers. The other options involve configuration files that either do not support calculated fields or require manual editing and restarts.

Answer

In the fields.conf file using the FIELDNAME and FIELDVALUE settings

Answer

In the transforms.conf file using the REGEX and FORMAT directives

Answer

In the search app's props.conf using the EVAL-conversation directive

Question 6

A Splunk power user is troubleshooting a search that uses a calculated field named 'response_time' defined as 'duration_ms / 1000'. The field 'duration_ms' is extracted from raw events, but the calculated field returns null values for some events. Upon investigation, the user finds that 'duration_ms' is sometimes missing or contains non-numeric characters. Which of the following is the most likely reason for the null values in 'response_time'?

Accepted Answer

The eval expression fails to handle non-numeric or missing values, resulting in null for those events.. Calculated fields use eval expressions that return null when operations encounter non-numeric or missing values. Since 'duration_ms' sometimes lacks numeric content, the division yields null. The correct approach is to use functions like tonumber() or coalesce() to handle such cases, ensuring a numeric result or a default value.

Answer

The field 'duration_ms' is not indexed, so it is not available for calculated fields.

Answer

The calculated field expression is evaluated before field extraction, so 'duration_ms' is not yet available.

Answer

The calculated field is defined with the wrong data type, causing Splunk to discard invalid results.

Question 7

A security analyst needs a calculated field named `risk_score` that evaluates to the numeric value 10 for every event in the `firewall` sourcetype, regardless of whether any other fields are present. The analyst has created the field in Settings > Fields > Calculated Fields, set the App context to `search`, and set the eval expression to `10`. However, searches in the `main` index for `sourcetype=firewall` do not display the `risk_score` field. Which of the following is the most likely cause?

Accepted Answer

The search is running in a different app context than the one where the calculated field was defined, so the field is not applied.. Calculated fields are app-scoped objects. When a search runs in an app other than the one where the calculated field was created, the field definition is not available, so the field does not appear. To make the field available across apps, it must be defined in a globally shared app or the search must run in the same app context.

Answer

Calculated fields are only applied to events that already have at least one extracted field, so events without fields are skipped.

Answer

The calculated field was created in the `search` app context, but the user lacks permission to access that app's calculated fields.

Answer

Calculated fields cannot contain a constant expression; they must reference at least one existing field.

Question 8

A Splunk user wants to create a calculated field that extracts the domain from an email address field named 'email'. The user writes the following eval expression: 'mvindex(split(email, "@"), 1)'. After saving the calculated field, the user notices that the new field 'domain' is not appearing in the Fields sidebar for some events. What is the most likely cause?

Accepted Answer

The field 'email' is not present in all events, so the calculated field cannot be computed for those events.. Calculated fields are only computed when all referenced fields are present in an event. If 'email' is missing, the 'domain' field will not be created, and it will not appear in the Fields sidebar for those events. This is expected behavior and not an error in the expression or configuration.

Answer

The mvindex() function is not supported in calculated fields and only works in the search pipeline.

Answer

The calculated field must be defined in transforms.conf instead of props.conf to work with multivalue fields.

Answer

The eval expression is incorrect because split() returns a multivalue field and mvindex() requires a numeric index.

Question 9

A Splunk administrator wants to rename the extracted field `src_ip` to `client_ip` at search time without modifying the original data or creating a new field. The administrator also wants the original field name `src_ip` to remain available in searches. Which of the following should the administrator configure?

Accepted Answer

A field alias in props.conf using the syntax `FIELDALIAS-client_ip = src_ip AS client_ip`.. Field aliases are the correct tool to provide an alternate name for an existing field while keeping the original field intact. The FIELDALIAS setting in props.conf maps a source field to one or more aliases, making both names searchable. This avoids data duplication and maintains consistency across searches.

Answer

A field extraction using the regex `(?<client_ip>...)` in transforms.conf.

Answer

A calculated field using the eval expression `client_ip = src_ip`.

Answer

A lookup definition that maps `src_ip` to `client_ip`.

Question 10

A knowledge manager needs an ad-hoc calculated field named `resp_seconds` available only within a single dashboard panel that computes `round(duration_ms/1000, 2)` from an existing numeric field. The value must not persist to the knowledge object store and must not appear in other searches. Which approach should be used?

Accepted Answer

Add an `eval resp_seconds=round(duration_ms/1000, 2)` command inline in the panel's search string.. An inline eval in the panel search computes the new value at search time and discards it when the search finishes, which is exactly the ad-hoc, panel-scoped behavior requested. Saved calculated fields, props.conf EVAL stanzas, and field aliases all persist as configuration and thus would leak the field into other searches.

Answer

Add a field alias named `resp_seconds` pointing to `duration_ms` in the sourcetype definition.

Answer

Define `EVAL-resp_seconds = round(duration_ms/1000, 2)` in props.conf for the sourcetype.

Answer

Create a calculated field in Settings > Fields with the eval expression and a `resp_seconds` name.

Question 11

A Splunk power user is configuring a calculated field that uses the eval function 'coalesce' to handle null values. The user wants to ensure the calculated field is evaluated correctly. Which TWO of the following statements about calculated fields in props.conf are true? (Choose two.)

Accepted Answer

Calculated fields can use the coalesce function to return the first non-null value from a list of fields.. Calculated fields are defined with the EVAL- prefix in props.conf and can use any eval function, including coalesce, to manipulate field values. They are evaluated at search time and can reference search-time fields. They are not stored in the index and do not increase storage. The correct statements are that they use the EVAL- prefix and can use coalesce.

Answer

Calculated fields are stored in the index and increase storage requirements.

Answer

Calculated fields can only reference fields that are extracted at index time.

Answer

Calculated fields are evaluated before field aliases are applied.

Question 12

A security team wants every event that contains the string 'Failed password' to be automatically tagged as 'brute_force' so that analysts can later run a simple tag-based search without typing the full string each time. The tag should appear on matching events as soon as the search runs, with no index-time processing. Which of the following is the correct way to implement this?

Accepted Answer

Define an event type in eventtypes.conf whose search matches 'Failed password', then add the tag 'brute_force' to that event type so matching events receive the tag at search time.. Event types are search-time knowledge objects, and tags are applied by associating them with an event type. When a search evaluates the event type's search string, every matching event inherits the tag, so analysts can retrieve those events with tag=brute_force. This requires no index-time processing or reindexing, and the tag becomes visible as soon as the event type and tag configuration are saved and knowledge objects are refreshed.

Answer

Create a saved search that runs every five minutes and writes the tag into a lookup file, then use the lookup command in each analyst search.

Answer

Add a TRANSFORMS stanza in props.conf that runs a regex at index time and assigns the tag to the event's metadata.

Answer

Create a field alias in props.conf that maps a new field named 'brute_force' to the raw event text so that tag=brute_force resolves.

Question 13

An administrator is configuring a calculated field in props.conf to derive a new field from two extracted fields. The stanza is applied to a sourcetype, but users report the calculated field does not appear in search results. The extracted fields are present and correct. Which of the following is the most likely cause?

Accepted Answer

The calculated field was defined with the EVAL- prefix but placed in a stanza that does not match the sourcetype of the events being searched.. Calculated fields are configured in props.conf with EVAL-<fieldname> and are bound to the stanza where they are declared. If that stanza does not match the events' host, source, or sourcetype, the calculation is never evaluated and the field will not appear. Verifying that the stanza correctly targets the relevant sourcetype is the most likely fix when the underlying extracted fields are confirmed present and correct.

Answer

The calculated field references an extracted field that is itself created by a search-time extraction, and calculated fields cannot depend on other calculated or extracted fields.

Answer

Calculated fields require the field to be listed in a FIELDALIAS stanza before they can be referenced in an EVAL expression.

Answer

The calculated field name conflicts with a field alias defined in the same app, and field aliases always take precedence over calculated fields.

Question 14

A Splunk administrator is configuring a field extraction for a custom sourcetype. The raw event data contains a field named `user` that sometimes includes a domain prefix (e.g., `DOMAIN\username`). The administrator wants to create a new field `username` that contains only the username portion, stripping the domain prefix if present. The extraction should work at search time and be available for all users. Which of the following is the most efficient and correct method?

Accepted Answer

Create a calculated field using `EVAL-username = replace(user, "^[^\\]+\\", "")` in `props.conf`.. Calculated fields using `EVAL-` in `props.conf` allow for dynamic transformation of field values at search time. Using `replace()` with a regular expression to strip the domain prefix is efficient and only executes when the field is referenced. This method ensures the transformation is applied consistently and is available to all users of the app. Other methods like field aliases or lookups do not perform the necessary string manipulation.

Answer

Use a field alias in `props.conf` to map `username` to `user`.

Answer

Define a search-time field extraction using a regular expression in `props.conf` with `EXTRACT-username = (?<username>[^\\]+)$`.

Answer

Create a lookup table that maps `user` to `username` and configure an automatic lookup.

Question 15

A knowledge manager is reviewing how calculated fields and field aliases interact within a search. Which TWO of the following statements are accurate? (Choose two.)

Accepted Answer

A calculated field can be referenced by other calculated fields defined in the same props.conf stanza, provided the evaluation order is correct.. Field aliases map an existing extracted field to an alternate name, letting users search on either name without reindexing. Calculated fields use EVAL expressions to create new fields at search time and can reference one another within the same props.conf stanza when the evaluation order is satisfied. Both are search-time mechanisms, so configuration changes apply immediately, but they do not compute values the way the other does.

Answer

Calculated fields and field aliases both require the underlying data to be reindexed before they take effect.

Answer

Calculated fields are evaluated at index time, so changing an EVAL expression requires reindexing the affected data.

Answer

Field aliases create a new field with values computed from an expression, similar to a calculated field.