SPLK-1004 Hard Questions — 25 Difficult Questions

Question 1

You notice that an alert is not triggering. You have checked the search logic and permissions. What is another likely configuration issue?

Accepted Answer

Alert actions are not enabled.. If the search logic and permissions are correct but the alert still does not trigger, a common cause is that the alert actions themselves are disabled in the alert configuration. In Splunk, an alert can be saved with actions (email, webhook, etc.) that are toggled off, meaning the search runs but no notification is sent. Enabling the action is required for the alert to actually notify.

Answer

The app is not visible.

Answer

The owner does not have write access.

Answer

The search is too short.

Question 2

Which THREE of the following are components of a drilldown interaction in a dashboard?

Accepted Answer

Condition. In dashboard drilldown design, a Condition (A) is a required component because it defines the trigger or filter logic that determines when and how the drilldown fires based on user interaction or data state. A Link (B) is also required because it specifies the destination—such as a URL, report, or dashboard—that the user is taken to when the drilldown is activated. A Set (E) is the third required component because it defines the values or parameters (for example, token or field values) that are passed along to the target of the drilldown to contextualize the destination view. The remaining options do not belong: a Field (C) is a data element used within conditions or sets rather than a standalone drilldown component, and a Search (D) is a query or retrieval action, not a structural component of a drilldown interaction.

Answer

Field

Answer

Search

Question 3

A dashboard has multiple inputs. When a user changes one, you want the others to reset. How can you achieve this using Simple XML?

Accepted Answer

Define a 'change' block with for the other tokens.. In Simple XML, a block attached to an input fires whenever that input's token value changes, and the element inside it removes the values of other tokens. By placing inside the change handler, the dependent inputs lose their current selection and revert to their default state, effectively resetting them. This is the documented Splunk pattern for cascading input resets.

Answer

Use an 'on_load' script.

Answer

Use a 'global' scope for all tokens.

Answer

Use the 'reset' attribute on the input.

Question 4

A security analyst needs to correlate failed login attempts with subsequent successful logins for the same user within 10 minutes. The relevant events are in the 'auth' index with fields 'user', 'action' (failed or success), and '_time'. Which command should be used to achieve this correlation?

Accepted Answer

transaction user maxspan=10m startswith=action="failed" endswith=action="success". The transaction command is designed to group related events into a single transaction based on a common field and time constraints. By specifying startswith and endswith, it ensures that only sequences beginning with a failed login and ending with a successful login within 10 minutes are grouped. This precisely matches the analyst's need to correlate failed attempts with subsequent successful logins for the same user.

Answer

stats count by user, action | where action="failed" AND action="success"

Answer

join user [ search index=auth action=success ]

Answer

eventstats values(action) as actions by user | where mvcount(actions)>1

Question 5

You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?

Accepted Answer

props.conf. Automatic lookups that run for every search on a specific sourcetype are configured in props.conf using the `LOOKUP-<name>` setting. This setting associates a lookup definition (defined in transforms.conf) with a sourcetype, and the lookup is applied automatically at search time. This is the most appropriate place because props.conf controls sourcetype-specific configurations.

Answer

indexes.conf

Answer

lookups.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 6

Which THREE of the following are valid sources of information for a Workflow Action link?

Accepted Answer

Values from fields in the search result. Option A is correct because a Workflow Action link can dynamically pull values from fields in the search result, allowing the URI to be constructed based on the specific event or record returned. Option C is correct because fixed text in the URI string is a valid static source, enabling the link to include constant portions such as a base URL or static path. Option E is correct because values from the search query parameters can be referenced, letting the action link incorporate the user's original search terms or filters. Option B is not valid because user passwords are never exposed as a source for constructing action links, as that would be a severe security risk. Option D is not valid because system time is not a supported dynamic source for Workflow Action links in this context.

Answer

User password

Answer

System time

Question 7

How do you handle case-insensitive filtering in a 'where' clause?

Accepted Answer

where lower(field) = "value". Splunk's where command uses eval-style expressions, and the correct way to perform case-insensitive comparison is to normalize the field with lower() (or upper()) and compare against a lowercase literal. The syntax where lower(field) = "value" is valid eval expression syntax and reliably matches regardless of case.

Answer

where field == /value/i

Answer

where field = '(?i)value'

Answer

where field.case = "ignore"

Question 8

A Splunk administrator is configuring a workflow action that will appear when a user clicks on a field value in search results. The action should open a new browser tab to an external threat intelligence website, passing the field value as a query parameter. The administrator sets the action type to `link` and configures the URI as `https://threatintel.example.com/search?q=$value$`. However, when testing, the link opens in the same tab, replacing the Splunk UI. Which setting must be adjusted to ensure the link opens in a new tab?

Accepted Answer

Set `target` to `_blank` in the workflow action configuration.. For workflow actions of type `link`, the `target` setting determines where the link opens. The default is `_self`, which replaces the current page. To open in a new tab, set `target` to `_blank`. This setting is separate from the URI and must be configured explicitly. Changing the action type or embedding HTML attributes in the URI will not achieve the desired behavior.

Answer

Enable `popup` in the workflow action configuration.

Answer

Set `link.uri` to include `target="_blank"` as an HTML attribute.

Answer

Change the action type from `link` to `search`.

Question 9

In a data model, what is the impact of setting the 'Max Time' for an accelerated model?

Accepted Answer

It sets the age limit for the summary index. The 'Max Time' setting for an accelerated data model specifies the maximum age of events that are summarized in the acceleration summary index. Events older than this limit are not included in the acceleration, effectively setting an age limit for the summary index data.

Answer

It determines the refresh rate

Answer

It limits the number of events indexed

Answer

It restricts search execution time

Question 10

A Splunk administrator is designing a lookup that will be used in a real-time alert to enrich incoming events with user department information. The lookup must support rapid updates without restarting Splunk, allow multiple users to modify entries concurrently, and provide the ability to define a lookup with a case-sensitive match. The administrator wants to use a KV Store lookup instead of a CSV lookup. Which two statements accurately describe KV Store lookups in this context? (Choose two.)

Accepted Answer

KV Store lookups can be updated in real time without restarting Splunk, and changes are immediately available to searches.. KV Store lookups leverage MongoDB, allowing concurrent updates and immediate visibility of changes without restarting Splunk. These features make them ideal for dynamic enrichment in real-time alerts. The other statements are incorrect because KV Store replication requires explicit configuration, case sensitivity is not a mandatory setting, and KV Store lookups are not created by CSV upload.

Answer

KV Store lookups can only be created by uploading a CSV file through the Splunk web interface.

Answer

KV Store lookups require a lookup definition with a case-sensitive match setting to be configured in transforms.conf.

Answer

KV Store lookups automatically replicate data across all search heads in a distributed environment without additional configuration.

Question 11

You want to hide a panel based on the value of a token. Which attribute should you use in the dashboard XML?

Accepted Answer

depends="$token$". The depends attribute in Simple XML controls panel visibility by evaluating a token expression; when the expression is true (token is set and non-empty), the panel is shown, and when false, the panel is hidden. This is the documented mechanism for conditionally displaying panels based on token values.

Answer

hidden="$token$"

Answer

visible="$token$"

Answer

show="true"

Question 12

A Splunk administrator is configuring a field extraction for a custom sourcetype. The raw event data contains a field named `user` that sometimes includes a domain prefix (e.g., `DOMAIN\username`). The administrator wants to create a new field `username` that contains only the username portion, stripping the domain prefix if present. The extraction should work at search time and be available for all users. Which of the following is the most efficient and correct method?

Accepted Answer

Create a calculated field using `EVAL-username = replace(user, "^[^\\]+\\", "")` in `props.conf`.. Calculated fields using `EVAL-` in `props.conf` allow for dynamic transformation of field values at search time. Using `replace()` with a regular expression to strip the domain prefix is efficient and only executes when the field is referenced. This method ensures the transformation is applied consistently and is available to all users of the app. Other methods like field aliases or lookups do not perform the necessary string manipulation.

Answer

Use a field alias in `props.conf` to map `username` to `user`.

Answer

Define a search-time field extraction using a regular expression in `props.conf` with `EXTRACT-username = (?<username>[^\\]+)$`.

Answer

Create a lookup table that maps `user` to `username` and configure an automatic lookup.

Question 13

You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?

Accepted Answer

Field name mismatch between event and lookup.. An automatic lookup joins fields from the lookup table to fields in the event stream at search time. If the field name referenced in the lookup definition (the 'Lookup input field') does not exist in the events, or the case/name differs from what the lookup CSV header expects, the lookup silently returns no matches and the lookup fields remain null. Since the definition and automatic rule were already verified, the most common remaining cause is a field name mismatch between the event data and the lookup table.

Answer

The lookup is set to read-only.

Answer

The lookup is shared globally.

Answer

The lookup table file is too large.

Question 14

Which of the following is a key advantage of using KV Store lookups over CSV lookups?

Accepted Answer

They support dynamic updates and data types.. KV Store lookups support dynamic updates and preserve data types, unlike CSV lookups which are static files. This makes KV Store ideal for lookups that change frequently or require field-type fidelity. CSV lookups are read-only at search time and treat all values as strings.

Answer

They don't require lookup definitions.

Answer

They use less disk space.

Answer

They are faster for static data.

Question 15

You are correlating two searches. What is the primary advantage of using 'join' over 'lookup'?

Accepted Answer

Joins allow for subsearch results to be mapped to the primary search results dynamically.. The primary advantage of 'join' over 'lookup' is that join dynamically maps subsearch results to the primary search results at search time, allowing correlation based on matching field values without pre-building a lookup table. Lookups, by contrast, require a static or pre-defined external table. This dynamic mapping is the key differentiator.

Answer

Lookups cannot be used with stats.

Answer

Joins are faster than lookups.

Answer

Joins are automatically cached.

Question 16

What is the limitation of using 'join' in a search?

Accepted Answer

The subsearch result limit is 100 by default.. The join command in Splunk runs a subsearch to build the right-hand dataset, and that subsearch is capped at 100 results by default (controlled by the maxout setting, which defaults to 100). This means any join whose subsearch returns more than 100 rows will silently truncate, producing incomplete or misleading results. This is the primary practical limitation of join and the reason Splunk recommends alternatives like stats, lookup, or append when working with large datasets.

Answer

Joins only work on numerical fields.

Answer

Joins are deprecated in Splunk.

Answer

Joins cannot be used with subsearches.

Question 17

What is the difference between 'chart' and 'timechart'?

Accepted Answer

Timechart automatically buckets by time.. The key difference is that timechart automatically buckets events by time and plots the results over time, while chart does not automatically bucket by time and can be used with any field. Timechart is specifically designed for time-series visualizations.

Answer

They are identical commands.

Answer

Chart is for time-based data.

Answer

Timechart is for non-time fields.

Question 18

Which configuration file would you modify to assign a tag to a field-value pair manually?

Accepted Answer

tags.conf. The tags.conf file is the Splunk configuration file that defines tag definitions, mapping a tag name to specific field-value pairs (for example, tagging host=web01 with the tag 'production'). Manual assignment of a tag to a field-value pair is done by editing tags.conf, typically via Settings > Tags in Splunk Web or by directly editing the file in an app's local directory.

Answer

props.conf

Answer

eventtypes.conf

Answer

transforms.conf

Question 19

Which TWO of the following are true regarding the order of operations when a macro is used in a search?

Accepted Answer

Macros are expanded before search execution. Option A is correct because macro expansion occurs at search time, before the search is actually executed — the search head parses the search string, resolves any macro references into their underlying search fragments, and then runs the resulting expanded search. Option B is correct because macro expansion is context-sensitive: the current app context determines which macros are visible and how they resolve, so the same macro name can expand differently depending on the app in which the search runs. Option C is wrong because the indexer handles indexing and search-time data retrieval, not macro expansion, which is a search-head parsing activity. Option D is wrong because the browser merely submits the search; expansion happens server-side on the search head, not client-side. Option E is wrong because expansion must precede execution — a macro cannot be resolved after the search has already finished.

Answer

Macros are expanded by the Indexer

Answer

Macros are expanded by the browser

Answer

Macros are expanded after the search finishes

Question 20

Which THREE of the following are valid aggregation functions used with 'stats'?

Accepted Answer

dc. The 'stats' command in Splunk supports aggregation functions such as dc (distinct count), avg (average), and count, so options A, C, and D are all valid. Option A, dc, is correct because it returns the number of distinct values for a field, e.g., 'stats dc(user)'. Option C, avg, is correct because it computes the arithmetic mean of a numeric field, e.g., 'stats avg(response_time)'. Option D, count, is correct because it counts the number of events or occurrences, e.g., 'stats count by host'. Option B, where, is not an aggregation function; it is a filtering command used to filter search results based on a condition. Option E, rename, is not an aggregation function; it is a command used to rename fields in the results.

Answer

where

Answer

rename