SPLK-1004 Quick Quiz — 10 Questions

Question 1

You want to extend a data model object to include new fields. Which object type allows you to add child objects that inherit base constraints?

Accepted Answer

Child object. A child object in a data model is the object type specifically designed to inherit constraints from a parent (base) object and add new fields or constraints. Child objects extend the base event or search object, inheriting its constraints while allowing additional field definitions. This is the mechanism Splunk provides for building hierarchical data models without duplicating base constraints.

Answer

Lookup object

Answer

Event object

Answer

Pivot object

Question 2

A dashboard has multiple inputs. When a user changes one, you want the others to reset. How can you achieve this using Simple XML?

Accepted Answer

Define a 'change' block with for the other tokens.. In Simple XML, a block attached to an input fires whenever that input's token value changes, and the element inside it removes the values of other tokens. By placing inside the change handler, the dependent inputs lose their current selection and revert to their default state, effectively resetting them. This is the documented Splunk pattern for cascading input resets.

Answer

Use an 'on_load' script.

Answer

Use a 'global' scope for all tokens.

Answer

Use the 'reset' attribute on the input.

Question 3

You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?

Accepted Answer

The source fields required for the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time and depend on the source fields they reference being present in the events. If the fields used in the regex extraction or math calculation are not extracted (either via props.conf/transforms.conf or field extractions), the calculated field cannot compute a value and will not appear in results. The calculation itself does not require indexing of the extracted fields, only that the source fields exist at search time.

Answer

The underlying extracted fields are not indexed.

Answer

The lookup table is not defined.

Answer

The user lacks the 'can_run_calculated_fields' capability.

Question 4

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. Option B is correct because the Field Extractor UI tool in Splunk (accessible via Settings > Fields > Field Extractions or from the search results) provides a guided, interactive way to define regex-based or delimiter-based field extractions and automatically writes the resulting configuration to props.conf and transforms.conf. Option E is correct because editing props.conf and transforms.conf directly is the underlying, supported configuration method for creating field extractions: props.conf defines the stanza (sourcetype/host/source) and references a transform via REPORT or EXTRACT, while transforms.conf defines the regex or delimiter-based extraction logic. Option A is incorrect because indexes.conf controls index-level settings such as storage paths, retention, and sizing, not field extraction definitions. Option C is incorrect because modifying raw log files on disk alters the source data itself and does not create any Splunk extraction configuration. Option D is incorrect because there is no 'index' search command that creates field extractions; the search bar is used for querying and testing extractions, not for defining them.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 5

A security team wants every event tagged with the sourcetype 'cisco:asa' to also carry the tag 'firewall' so analysts can search 'tag=firewall' without typing the sourcetype. A power user opens Settings > Tags and sees no existing tags for that sourcetype. What is the most efficient way to apply the tag to ALL current and future cisco:asa events?

Accepted Answer

Create a tag named 'firewall' and apply it directly to the 'cisco:asa' sourcetype field value in the Tags settings page. Tags in Splunk are knowledge objects attached to specific field/value pairs, and tagging a sourcetype value applies that tag to every event with that sourcetype. This is the only listed method that persists the tag for both existing and future events without altering raw data or creating a parallel dataset.

Answer

Run a search that adds 'tag=firewall' to each event and save the results to a summary index

Answer

Create a calculated field named 'firewall' with the eval expression 'if(sourcetype=="cisco:asa", "true", "false")'

Answer

Edit each event's raw text with the 'replace' command to append the string 'firewall'

Question 6

A security analyst needs to correlate failed login attempts with subsequent successful logins for the same user within 10 minutes. The relevant events are in the 'auth' index with fields 'user', 'action' (failed or success), and '_time'. Which command should be used to achieve this correlation?

Accepted Answer

transaction user maxspan=10m startswith=action="failed" endswith=action="success". The transaction command is designed to group related events into a single transaction based on a common field and time constraints. By specifying startswith and endswith, it ensures that only sequences beginning with a failed login and ending with a successful login within 10 minutes are grouped. This precisely matches the analyst's need to correlate failed attempts with subsequent successful logins for the same user.

Answer

stats count by user, action | where action="failed" AND action="success"

Answer

join user [ search index=auth action=success ]

Answer

eventstats values(action) as actions by user | where mvcount(actions)>1

Question 7

What is the purpose of the 'CIM Validator' tool?

Accepted Answer

To verify data model CIM compliance. The CIM Validator tool is designed to verify that indexed data conforms to the Common Information Model — checking whether the fields, tags, and eventtypes required by a given CIM data model are correctly present and populated. It runs validation searches against your data and reports which CIM-required fields are missing or malformed. This helps ensure that data model acceleration and CIM-based apps work correctly.

Answer

To check for syntax errors in SPL

Answer

To update lookup files

Answer

To monitor indexer health

Question 8

Which TWO of the following are benefits of using the CIM?

Accepted Answer

Simplified correlation across disparate sources. The Common Information Model (CIM) in Splunk provides a normalized, schema-based layer on top of indexed data, so option B is correct: by mapping fields from many different sourcetypes to common field names and tags, CIM enables simplified correlation across disparate sources (e.g., joining firewall, proxy, and authentication events on a shared src/dest/user model). Option E is also correct because CIM defines a standardized set of field names and data models, giving analysts a consistent search syntax and field vocabulary for common data regardless of the original source format. The unmarked options do not belong: CIM does not automatically generate raw log files (A), does not automatically delete sensitive data (C), and does not increase disk space for indexes (D) — it is a knowledge-layer normalization scheme, not a data-collection, retention, or storage-expansion mechanism.

Answer

Automatic generation of raw log files

Answer

Automatic deletion of sensitive data

Answer

Increased disk space for indexes

Question 9

You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?

Accepted Answer

props.conf. Automatic lookups that run for every search on a specific sourcetype are configured in props.conf using the `LOOKUP-<name>` setting. This setting associates a lookup definition (defined in transforms.conf) with a sourcetype, and the lookup is applied automatically at search time. This is the most appropriate place because props.conf controls sourcetype-specific configurations.

Answer

indexes.conf

Answer

lookups.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 10

Which THREE of the following are valid sources of information for a Workflow Action link?

Accepted Answer

Values from fields in the search result. Option A is correct because a Workflow Action link can dynamically pull values from fields in the search result, allowing the URI to be constructed based on the specific event or record returned. Option C is correct because fixed text in the URI string is a valid static source, enabling the link to include constant portions such as a base URL or static path. Option E is correct because values from the search query parameters can be referenced, letting the action link incorporate the user's original search terms or filters. Option B is not valid because user passwords are never exposed as a source for constructing action links, as that would be a severe security risk. Option D is not valid because system time is not a supported dynamic source for Workflow Action links in this context.

Answer

User password

Answer

System time