SPLK-1004 Search Tuning Performance And Dashboards Practice Test 2 — 15 Questions

Question 1

You need to create a reusable search that multiple panels in the same dashboard can reference without duplicating the search string. Which dashboard XML element should you use?

Accepted Answer

. The element defines a search once at the dashboard level, and panels reference it using post-process searches. This pattern eliminates duplicated search strings, reduces the number of searches that run, and improves dashboard load performance. Each panel's post-process search then applies its own transformations or filters to the shared base results.

Answer

Answer

<panel>

Answer

<post-process>

Question 2

A dashboard panel uses a base search that returns 500,000 events. Several panels reference this base search, and users complain that the dashboard takes over two minutes to load. The base search is defined with the following search string: `index=web status=200 | stats count by host, uri`. Which change would most effectively reduce the dashboard load time while preserving the data displayed in the panels?

Accepted Answer

Add `| tstats` with `summariesonly=t` against the `host` and `uri` fields, using an accelerated data model.. The base search is slow because it scans 500,000 raw events to compute counts by host and uri. Using `tstats` with `summariesonly=t` against an accelerated data model lets Splunk read pre-computed summaries, avoiding raw event scanning while returning the same aggregated results. This directly reduces load time for all panels that depend on the base search, without changing the displayed data.

Answer

Move the base search into a post-process search and add `| head 1000` to limit the number of events returned.

Answer

Increase the dashboard refresh interval to 10 minutes so the search runs less frequently.

Answer

Add `| dedup host, uri` to the base search to reduce the number of rows returned to the panels.

Question 3

A dashboard panel's search is slow because it filters events with a base search that returns millions of events, then applies a transforming command. You want to reduce the amount of data the search reads from disk while preserving the panel's results. Which search optimization technique should you apply?

Accepted Answer

Add a tstats command to replace the base search and use accum for the transforming command.. The tstats command queries indexed fields directly in tsidx files, bypassing raw event retrieval. When the base search only needs indexed fields, replacing it with tstats reduces disk I/O. Using accum or another tstats-supported aggregation preserves the result. The other options do not reduce data read from disk and may increase resource usage.

Answer

Add the fillnull command after the transforming command to reduce null values.

Answer

Set the search's time range to All Time to ensure the search head caches more results.

Answer

Increase the search head's max_searches_per_cpu setting in limits.conf.

Question 4

A dashboard's base search returns 50,000 events, and each of five panels applies a post-process search. Users report the dashboard is slow to load. Which change is most likely to improve performance without altering the panels' displayed results?

Accepted Answer

Move the base search to a scheduled saved search and use a summary index for the panels.. The base search returning 50,000 events is processed once, but the post-process searches still operate on that large result set and the base search itself reads raw data at load time. Moving the base search to a scheduled search that populates a summary index lets the panels read pre-aggregated results, cutting load time while preserving displayed results if the summary captures the needed fields. Truncating or duplicating searches would either change results or increase load.

Answer

Add 'searchWhenChanged="true"' to each panel's post-process search.

Answer

Add '| head 1000' to the base search to limit the number of events returned.

Answer

Convert each panel's post-process search into a separate full search against the index.

Question 5

A power user is building a dashboard and wants a dropdown input to display the label "Select Environment" while storing the value "prod" for use in searches. Which Simple XML configuration achieves this?

Accepted Answer

Use a `Select Environment` inside the input.. A choice element maps a stored value to a visible label via the value attribute and element text. This is the standard Simple XML pattern for dropdowns where the search token must differ from what the user reads. Other approaches either misuse attributes, add unnecessary searches, or create invalid token names.

Answer

Set the input's `label` attribute to "Select Environment" and the `value` attribute to "prod".

Answer

Use a `<populatingSearch>` that returns "prod" and set the label via `fieldForLabel`.

Answer

Define a token named "Select Environment" with a default value of "prod".

Question 6

A dashboard uses a text input to filter results by a user-entered hostname. The token name is 'host_token'. You want the panels to refresh only when the user clicks a Submit button, not on every keystroke. Which XML attribute should you add to the text input element?

Accepted Answer

searchWhenChanged="false". The searchWhenChanged attribute, when set to false, changes the input's behavior so that it does not trigger a search on every change. Instead, the search runs only when the user explicitly submits the input. This is the correct way to implement a Submit button behavior for a text input in a Splunk dashboard.

Answer

default="*"

Answer

token="host_token"

Answer

depends="$host_token$"

Question 7

A dashboard uses a base search and several post-process searches. Users report that some panels show stale data after the base search completes, while others show correct results. You need to ensure that post-process searches always reflect the latest results from the base search. Which two actions should you take? (Choose two.)

Accepted Answer

Set the `refresh` attribute on the dashboard to a value that triggers the base search to re-run and update the post-process searches.. Stale data in post-process searches often stems from the base search being a scheduled saved search that caches results, or from the dashboard not refreshing the base search. Ensuring the base search runs on demand and configuring the dashboard `refresh` attribute to re-run the base search at suitable intervals will update the post-process searches with current data. These two actions directly address freshness.

Answer

Configure the base search to use `| noop` to force a new search ID for each execution.

Answer

Set the base search to run in real-time and set the post-process searches to use the same time range.

Answer

Ensure the base search includes a `| fields` command that keeps only the fields needed by the post-process searches.

Question 8

A dashboard developer is creating a form with a dropdown input that allows users to select a sourcetype. The developer wants the dropdown to be populated dynamically from a search. Which TWO of the following are required to populate the dropdown with search results? (Choose two.)

Accepted Answer

A 'fieldForLabel' attribute specifying which field from the search results to display.. To populate a dropdown dynamically from a search, you need a search element that returns the values and a 'fieldForLabel' attribute to specify which field to display as the label. The search provides the data, and the label field ensures the correct text is shown. Other attributes like 'valueField' and 'token' are used for storing and using the selected value but are not required for the population itself. A static element is for manual options and is not used in this scenario.

Answer

A 'static' element listing the options manually.

Answer

A 'token' attribute to store the selected value.

Answer

A 'valueField' attribute to specify the field for the underlying value.

Question 9

A dashboard has a text input that sets a token named `$host_filter$`. The token is used in a panel search as `index=main host=$host_filter$`. Users report that when they clear the text input, the panel shows no results. You want the panel to show all hosts when the input is empty. Which change should you make to the panel search?

Accepted Answer

Use a token with a default value, such as `$host_filter$` defaulting to `*`, and set the input to use that default when empty.. The cleanest solution is to give the token a default value of `*` and configure the text input to use that default when empty. Then the search `index=main host=$host_filter$` becomes `index=main host=*` when no input is provided, returning all hosts. This preserves the text input for user flexibility and ensures the panel always shows results.

Answer

Change the input to a dropdown with a default value of `*` and a list of all hosts.

Answer

Add `| where host=$host_filter$ OR isnull($host_filter$)` to the search.

Answer

Change the search to `index=main host=$host_filter$ OR host=*`.

Question 10

A dashboard developer is using a base search with post-process searches to power multiple panels. The developer notices that the base search returns a large number of events, and the post-process searches are slow. Which Splunk command should be added to the base search to reduce the volume of data passed to post-process searches while preserving the ability to calculate statistics in the panels?

Accepted Answer

| bin _time span=1h | stats count by _time, sourcetype. The correct answer is to use '| bin _time span=1h | stats count by _time, sourcetype'. This pre-aggregates the data into hourly buckets, significantly reducing the volume passed to post-process searches. It preserves the ability to calculate statistics over time and by sourcetype, which are common panel requirements. The other options either do not reduce volume effectively or may not preserve the necessary granularity for the panels' calculations.

Answer

| tstats summariesonly=true count from datamodel=Web by Web.status

Answer

| fields - _raw

Answer

| stats count by sourcetype

Question 11

A dashboard panel runs a search that aggregates web access logs over the last 30 days. Users complain the panel takes too long to load and the search often times out. The search is `index=web | stats count by status, host`. You want to reduce load time without changing the visual output. Which of the following is the most effective optimization?

Accepted Answer

Create a data model that includes the web index and use `| datamodel` or `| tstats` with the model to accelerate the aggregation.. Data model acceleration is designed to speed up repetitive searches by precomputing results. Using tstats against an accelerated data model avoids scanning raw events, which is the primary cost in this scenario. The other options either do not reduce data scanned or are inapplicable to the fields involved.

Answer

Increase the search job's max concurrent limit in limits.conf.

Answer

Add `| fields - _raw` at the beginning of the search to reduce data processed.

Answer

Add `| tstats count where index=web by status, host` to replace the base search.

Question 12

A dashboard has a panel that uses a base search with post-process. The base search is `index=app | stats count by user`. A post-process search on another panel filters the results to only show users with count > 10. After saving, the second panel shows no results, but the base search panel shows many users with counts below 10. What is the most likely cause?

Accepted Answer

The post-process search is missing a `| where count > 10` command and instead uses a search filter that does not evaluate correctly.. Post-process searches operate on the results of the base search. When filtering numeric fields, the `where` command is appropriate because it evaluates expressions. A simple search filter like `count>10` may not work as expected on numeric fields, leading to no results. The other options are either incorrect requirements or not applicable.

Answer

The base search must be saved as a report before post-process can be used.

Answer

The post-process search cannot use the `count` field because it is not a field in the base search results.

Answer

The post-process search must start with `| search` to reference the base search results.

Question 13

You are developing a dashboard with a base search that returns a large set of raw events. Five panels each use a post-process search to apply different stats commands. Users report that the dashboard takes a long time to load. You want to improve performance without changing the results. Which action should you take?

Accepted Answer

Add `| fields - _raw` to the base search to remove raw data before post-processing.. In a base search with post-process searches, the base search retrieves events that are then processed by each post-process search. If the post-process searches only need aggregated results, the raw event data is unnecessary overhead. Removing the _raw field reduces the volume of data that must be passed to each post-process search, improving dashboard load time without affecting the final results.

Answer

Convert all post-process searches to full searches to avoid the overhead of post-processing.

Answer

Add `| table _time, host, source, sourcetype` to the base search to limit fields.

Answer

Increase the search time range to include more data for better caching.

Question 14

A dashboard panel runs a search that aggregates web access logs over the last 30 days. Users complain that the panel takes too long to load and that the data does not need to be real-time. Which Splunk feature should you use to improve performance while ensuring the panel still shows up-to-date results within a reasonable timeframe?

Accepted Answer

Enable report acceleration on the saved search and use it in the dashboard panel.. Report acceleration precomputes the results of a saved search, storing them in a summary index. When the dashboard panel uses the accelerated saved search, it retrieves the precomputed results, which is much faster than scanning 30 days of raw data. The acceleration is updated periodically, so results are reasonably current. This directly addresses the performance and freshness requirements.

Answer

Use a real-time search to ensure the panel always shows the latest data.

Answer

Schedule the search to run every 15 minutes and use a saved search with a post-process search in the dashboard.

Answer

Add `| tstats` to the search to speed it up.

Question 15

A dashboard user reports that a drilldown is not passing the expected token to a target dashboard. The source panel uses a chart where the click event is defined. Which configuration detail should you verify first?

Accepted Answer

Verify the 'click.value' property is correctly set to the field name.. In a dashboard drilldown, the click event must reference the correct token value from the clicked element. For a chart, the click.value property must be set to the field name whose value should be passed, so verifying that property is the first configuration detail to check when the token is not being passed as expected.

Answer

Check if the target dashboard has a Time Range Picker.

Answer

Rebuild the summary index.

Answer

Ensure the user has write permissions to the target dashboard.