SPLK-1004 Multiple Select — 30 Questions

Question 1

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. Option B is correct because the Field Extractor UI tool in Splunk (accessible via Settings > Fields > Field Extractions or from the search results) provides a guided, interactive way to define regex-based or delimiter-based field extractions and automatically writes the resulting configuration to props.conf and transforms.conf. Option E is correct because editing props.conf and transforms.conf directly is the underlying, supported configuration method for creating field extractions: props.conf defines the stanza (sourcetype/host/source) and references a transform via REPORT or EXTRACT, while transforms.conf defines the regex or delimiter-based extraction logic. Option A is incorrect because indexes.conf controls index-level settings such as storage paths, retention, and sizing, not field extraction definitions. Option C is incorrect because modifying raw log files on disk alters the source data itself and does not create any Splunk extraction configuration. Option D is incorrect because there is no 'index' search command that creates field extractions; the search bar is used for querying and testing extractions, not for defining them.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 2

Which TWO of the following are benefits of using the CIM?

Accepted Answer

Simplified correlation across disparate sources. The Common Information Model (CIM) in Splunk provides a normalized, schema-based layer on top of indexed data, so option B is correct: by mapping fields from many different sourcetypes to common field names and tags, CIM enables simplified correlation across disparate sources (e.g., joining firewall, proxy, and authentication events on a shared src/dest/user model). Option E is also correct because CIM defines a standardized set of field names and data models, giving analysts a consistent search syntax and field vocabulary for common data regardless of the original source format. The unmarked options do not belong: CIM does not automatically generate raw log files (A), does not automatically delete sensitive data (C), and does not increase disk space for indexes (D) — it is a knowledge-layer normalization scheme, not a data-collection, retention, or storage-expansion mechanism.

Answer

Automatic generation of raw log files

Answer

Automatic deletion of sensitive data

Answer

Increased disk space for indexes

Question 3

Which THREE of the following are valid sources of information for a Workflow Action link?

Accepted Answer

Values from fields in the search result. Option A is correct because a Workflow Action link can dynamically pull values from fields in the search result, allowing the URI to be constructed based on the specific event or record returned. Option C is correct because fixed text in the URI string is a valid static source, enabling the link to include constant portions such as a base URL or static path. Option E is correct because values from the search query parameters can be referenced, letting the action link incorporate the user's original search terms or filters. Option B is not valid because user passwords are never exposed as a source for constructing action links, as that would be a severe security risk. Option D is not valid because system time is not a supported dynamic source for Workflow Action links in this context.

Answer

User password

Answer

System time

Question 4

A Splunk administrator is designing a lookup that will be used in a real-time alert to enrich incoming events with user department information. The lookup must support rapid updates without restarting Splunk, allow multiple users to modify entries concurrently, and provide the ability to define a lookup with a case-sensitive match. The administrator wants to use a KV Store lookup instead of a CSV lookup. Which two statements accurately describe KV Store lookups in this context? (Choose two.)

Accepted Answer

KV Store lookups can be updated in real time without restarting Splunk, and changes are immediately available to searches.. KV Store lookups leverage MongoDB, allowing concurrent updates and immediate visibility of changes without restarting Splunk. These features make them ideal for dynamic enrichment in real-time alerts. The other statements are incorrect because KV Store replication requires explicit configuration, case sensitivity is not a mandatory setting, and KV Store lookups are not created by CSV upload.

Answer

KV Store lookups can only be created by uploading a CSV file through the Splunk web interface.

Answer

KV Store lookups require a lookup definition with a case-sensitive match setting to be configured in transforms.conf.

Answer

KV Store lookups automatically replicate data across all search heads in a distributed environment without additional configuration.

Question 5

Which TWO of the following are true regarding the order of operations when a macro is used in a search?

Accepted Answer

Macros are expanded before search execution. Option A is correct because macro expansion occurs at search time, before the search is actually executed — the search head parses the search string, resolves any macro references into their underlying search fragments, and then runs the resulting expanded search. Option B is correct because macro expansion is context-sensitive: the current app context determines which macros are visible and how they resolve, so the same macro name can expand differently depending on the app in which the search runs. Option C is wrong because the indexer handles indexing and search-time data retrieval, not macro expansion, which is a search-head parsing activity. Option D is wrong because the browser merely submits the search; expansion happens server-side on the search head, not client-side. Option E is wrong because expansion must precede execution — a macro cannot be resolved after the search has already finished.

Answer

Macros are expanded by the Indexer

Answer

Macros are expanded by the browser

Answer

Macros are expanded after the search finishes

Question 6

Which THREE of the following are valid aggregation functions used with 'stats'?

Accepted Answer

dc. The 'stats' command in Splunk supports aggregation functions such as dc (distinct count), avg (average), and count, so options A, C, and D are all valid. Option A, dc, is correct because it returns the number of distinct values for a field, e.g., 'stats dc(user)'. Option C, avg, is correct because it computes the arithmetic mean of a numeric field, e.g., 'stats avg(response_time)'. Option D, count, is correct because it counts the number of events or occurrences, e.g., 'stats count by host'. Option B, where, is not an aggregation function; it is a filtering command used to filter search results based on a condition. Option E, rename, is not an aggregation function; it is a command used to rename fields in the results.

Answer

where

Answer

rename

Question 7

Which TWO settings in a lookup definition affect how the lookup matches the data?

Accepted Answer

Match type. In a Splunk lookup definition, the Match type setting (A) determines whether the lookup matches on the entire field value (exact match) or on a portion of it (CIDR, wildcard, or regex matching), directly controlling how lookup keys are compared to event field values. The Case sensitive match setting (B) controls whether the lookup comparison treats uppercase and lowercase characters as distinct, which also directly affects whether a match is found. Together these two settings govern the matching logic of the lookup. Owner permissions (C) only control access rights to the lookup object, not how values are matched. Lookup file compression (D) is not a matching setting and relates to file storage/size handling. Refresh interval (E) controls how often the lookup file is reloaded into memory, not how matches are performed.

Answer

Owner permissions

Answer

Lookup file compression

Answer

Refresh interval

Question 8

Which TWO of the following commands are considered 'transforming' commands?

Accepted Answer

timechart. In Splunk's Search Processing Language (SPL), transforming commands are those that order the results into a data table, typically aggregating or grouping events into statistical output — and both A (timechart) and B (stats) do exactly this. The timechart command is a transforming command because it aggregates events into a time-series table, bucketing by _time and splitting by a field to produce statistical values per time interval. The stats command is likewise transforming because it computes aggregations (such as count, sum, avg, dc) and returns a tabular result set grouped by specified by-clauses. By contrast, C (rex) is a field-extraction command that only adds fields to events without restructuring them into a table, D (fields) is a filtering/field-selection command that includes or excludes fields, and E (where) is a filtering command that evaluates a boolean expression to keep or drop events — none of these transform the result set into statistical tabular output.

Answer

rex

Answer

fields

Answer

where

Question 9

A Splunk power user is designing a new data model to support Pivot users who need to analyze web traffic. The data model must be efficient and provide accurate field mappings. Which two actions should the user take to ensure the data model is optimized for Pivot and CIM compliance? (Choose two.)

Accepted Answer

Map fields to the Common Information Model (CIM) field names to enable compatibility with other CIM-based apps and dashboards.. Constraining the root event object to relevant data reduces the dataset size and improves performance. Mapping fields to CIM names ensures compatibility with other CIM-based apps and dashboards, which is essential for a data model intended for broad use. These two actions optimize the data model for Pivot and CIM compliance.

Answer

Add a large number of calculated fields to the data model to provide maximum flexibility for Pivot users.

Answer

Set the acceleration to run every minute to ensure near real-time data availability in Pivot.

Answer

Accelerate the data model with a summary range of 'All time' to ensure the fastest possible Pivot performance for any time range.

Question 10

Which THREE pieces of information are displayed in the 'Search Macros' listing page in Splunk Web?

Accepted Answer

Arguments. In Splunk Web, the Settings > Advanced Search > Search Macros listing page presents a table of existing macros with columns that include the Macro Name (E), the Arguments (B) that the macro accepts, and the Definition (D) showing the macro's search string or SPL content. These three fields are exactly what the listing displays so users can identify, parameterize, and inspect macros without opening each one. The page does not show a Last run time (A), since Splunk does not track or display macro execution timestamps in this listing. It also does not show an Owner role (C); ownership/permissions are managed separately and are not a column on the Search Macros listing page.

Answer

Last run time

Answer

Owner role

Question 11

Which TWO of the following are valid lookup types in Splunk?

Accepted Answer

KV Store lookup. KV Store lookups (A) are a valid Splunk lookup type, defined with a transforms.conf stanza using external_type = kvstore and backed by the app's MongoDB-based KV Store collections, allowing lookups to be created and edited via the Splunk Web UI or REST API. CSV lookups (D) are also valid, defined with external_type = csv and a filename pointing to a .csv file in the app's lookups directory, and are the most common file-based lookup type. The remaining options are not Splunk lookup types: there is no 'Database lookup' (B) type (external database access is done via DB Connect, which surfaces data as lookups or via dbxquery), no 'Log lookup' (C) type, and no 'Text lookup' (E) type — Splunk supports CSV, KV Store, and external/scripted lookup types, not these.

Answer

Database lookup

Answer

Log lookup

Answer

Text lookup

Question 12

Which TWO pieces of information must be provided when defining a lookup table file upload?

Accepted Answer

Destination Filename. When defining a lookup table file upload, the two required pieces of information are the Destination Filename (B) and the Destination App (E). The Destination Filename (B) specifies the exact name of the lookup file (for example, a .csv file) that will be created or replaced in the destination app, so the system knows where to write the uploaded lookup data. The Destination App (E) identifies the Splunk app context in which the lookup file will be stored, ensuring the file is placed in the correct app's lookups directory and is available to knowledge objects in that app. The Lookup definition (A) is not required at upload time because the lookup definition (transform) can be created or referenced separately after the file exists. The Lookup index (C) is not applicable, since lookup files are stored as files in an app's lookups directory, not indexed as events in an index. Field aliases (D) are optional configuration applied to a lookup definition to map lookup fields to event fields, and are not required to upload the file itself.

Answer

Lookup definition

Answer

Lookup index

Answer

Field aliases

Question 13

Which THREE of the following are potential causes for a data model to fail to accelerate?

Accepted Answer

The indexer is running out of disk space. Option B is correct because data model acceleration builds and maintains summary files (tsidx) on the indexers, so if the indexer runs out of disk space the acceleration process cannot write or update those summaries and the model fails to accelerate. Option C is correct because acceleration is driven by the base search defined in the data model; if that base search is invalid or returns no results, there is nothing to accelerate and the acceleration job fails or produces no data. Option D is correct because acceleration must be explicitly enabled on the data model (the 'accelerated' setting), and if it is not set to accelerated, no acceleration job runs at all. Option A does not belong because having 'admin' rights is a permissions/role attribute that does not by itself prevent acceleration. Option E does not belong because browser caching affects client-side display of search results, not the server-side acceleration process.

Answer

The user has 'admin' rights

Answer

The browser is cached

Question 14

Which THREE of the following are common issues that cause a lookup to fail?

Accepted Answer

Incorrect object permissions.. Option A is correct because lookup operations run under the permissions of the user or role executing the search, so if that user lacks read access to the lookup definition or the underlying lookup file, the lookup fails with a permission error. Option B is correct because lookup matching is typically case-sensitive by default (for example, in Splunk's lookup matching), so a value like "User1" in the event will not match "user1" in the lookup table unless case sensitivity is explicitly handled. Option C is correct because if the lookup file (such as a CSV) was never uploaded or the lookup definition points to a nonexistent file, the lookup cannot resolve and returns no results or an error. Option D is not a common cause because lookup execution does not require admin privileges; a non-admin user with the appropriate capabilities and object permissions can run lookups successfully. Option E is not a common cause because indexes store event data, not lookup tables, and an index being full does not prevent a lookup from resolving against its lookup file.

Answer

The user is not an admin.

Answer

The index is full.

Question 15

Which TWO of the following are benefits of using a lookup instead of a join?

Accepted Answer

Reduced memory consumption.. Option A (Reduced memory consumption) is correct because a lookup enriches events by matching field values against a compact lookup table (e.g., a CSV or KV Store lookup) rather than building and holding the larger intermediate result sets that a join creates when combining two searches, so less memory is used. Option B (Improved search performance) is correct because lookup matching is a fast, single-pass enrichment against a small table, avoiding the expensive subsearch execution and result correlation that joins require, which typically yields faster searches. Option C is not correct because handling real-time streaming data is a property of ingestion/indexing (e.g., real-time search or streaming commands), not a specific benefit of lookups over joins. Option D is not correct because subsearches are a feature of the search language itself and can be used with joins as well; lookups do not provide subsearch support as a distinguishing benefit. Option E is not correct because lookups do not automatically update indexes; index updates occur through indexing, and lookup tables must be refreshed or managed separately.

Answer

Ability to handle real-time streaming data.

Answer

Support for subsearches.

Answer

Automatic index updating.

Question 16

Which TWO of the following are steps required to configure a CSV lookup?

Accepted Answer

Upload the CSV file.. Option A is correct because configuring a CSV lookup begins by uploading the CSV file to Splunk, typically via Settings > Lookups > Lookup table files, so the lookup table data is available to the search head. Option C is correct because after the file is uploaded you must create a lookup definition (Settings > Lookups > Lookup definitions) that maps the lookup name to the CSV file and defines fields, which is what allows the lookup to be invoked in SPL. Option B is not required because CSV headers are part of the uploaded file itself and are not modified as a separate configuration step. Option D is not required because lookup configuration does not need an indexer restart; lookups are resolved on the search head. Option E is not required because the license manager governs indexing volume, not lookup table configuration.

Answer

Modify the raw data to include the CSV headers.

Answer

Restart the Splunk indexer.

Answer

Add the CSV to the license manager.

Question 17

Which TWO of the following are required components to successfully implement a CSV-based automatic lookup?

Accepted Answer

A lookup table file (.csv). To implement a CSV-based automatic lookup, you must have a lookup table file (.csv) (option D), which contains the actual key-value data that will be used to enrich events, and a lookup definition (option E), which tells the search head how to interpret that file (filename, fields, match type) and is what gets referenced when configuring the automatic lookup. The lookup definition is the object that binds the CSV file to the fields used for matching and output, making both D and E the essential building blocks. A KV store collection (A) is only needed for KV Store lookups, not CSV file lookups, so it is not required here. A script to parse the CSV (B) is unnecessary because Splunk natively parses CSV lookup files via the lookup definition. A saved search (C) is used for scheduled or report-based workflows and is not a component of an automatic lookup configuration.

Answer

A KV store collection

Answer

A script to parse the CSV

Answer

A saved search

Question 18

Which TWO actions can be performed by the 'eval' command?

Accepted Answer

Concatenating strings. Option B is correct because the eval command can concatenate strings using functions such as + or the concatenation operator, for example eval full_name = first_name . " " . last_name, which builds a new field from existing string values. Option C is correct because eval is specifically designed to perform mathematical calculations, such as eval total = price * quantity, using arithmetic operators and functions like round() or abs(). The other options do not belong: eval does not create new data inputs (that is done by inputs.conf or data ingestion), it cannot change user permissions (that is handled by role and user management), and it cannot remove events from the index (that requires delete or index management commands).

Answer

Creating new data inputs

Answer

Changing user permissions

Answer

Removing events from the index

Question 19

Which THREE of the following items are stored within a data model JSON definition?

Accepted Answer

Field mappings to indexed data. In a Splunk data model JSON definition, option B (field mappings to indexed data) is correct because each object's fields are defined with constraints and attribute mappings that bind them to fields in indexed events, such as extracted or indexed fields. Option C (root search constraints) is correct because the data model's root object contains a base search (constraints) that filters the indexed data the model is built upon. Option E (the object hierarchy, parent/child) is correct because the JSON defines objects and their child objects, establishing the parent/child structure of the model. Option A (the user's password) is not part of a data model definition, as credentials are stored in authentication configuration, not in data model JSON. Option D (the raw event data) is not stored in the data model; the model stores metadata, constraints, and field mappings, while the actual events remain in indexes.

Answer

The user's password

Answer

The raw event data

Question 20

Which TWO of the following features are supported by Search Macros?

Accepted Answer

Hiding complex search syntax. Option A (Hiding complex search syntax) is correct because Search Macros in Splunk let you encapsulate long or complicated search strings behind a simple macro name, so users can run advanced searches without writing the full SPL themselves. Option B (Accepting arguments) is correct because macros can be defined with argument placeholders (e.g., $arg1$, $arg2$) that are substituted at runtime, allowing a single macro to be reused with different values. Option C (Automatic scheduling) is not a Search Macro feature; scheduling is handled by saved searches and alerts, not by macros. Option D (Real-time data visualization) is not provided by macros; visualization is a function of dashboards and panels, not macro definitions. Option E (Database auto-discovery) is unrelated to Search Macros; discovery of data sources is handled by other Splunk components such as the monitoring console or DB Connect, not by macros.

Answer

Automatic scheduling

Answer

Real-time data visualization

Answer

Database auto-discovery