SPLK-1003 Practice Test 13 — 15 Questions

Question 1

A security analyst needs to enrich authentication logs with employee department information stored in a CSV file called 'employees.csv'. The CSV has fields: 'emp_id', 'name', 'department'. The authentication logs contain a field 'user_id' that matches 'emp_id'. Which search correctly enriches the events with the department field?

Accepted Answer

`index=auth | lookup employees.csv emp_id AS user_id OUTPUT department`. Option D is correct because it uses the correct lookup syntax: `lookup

AS OUTPUT `. Here, `emp_id AS user_id` maps the lookup field emp_id to the search field user_id. Option A and B reverse the mapping, and option C uses inputlookup incorrectly which returns the lookup table contents rather than enriching events.

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department`

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department, name`

Answer

`index=auth | inputlookup employees.csv where user_id=emp_id | table *`

Question 2

What action can the administrator take to resolve this warning?

Accepted Answer

Increase the max_mem_usage_mb setting in limits.conf. The error indicates the lookup file exceeds the maximum memory allocation. Increasing the max_mem_usage_mb setting in limits.conf allows loading larger files.

Answer

Split the lookup into multiple smaller files

Answer

Convert the lookup to a KV Store lookup

Answer

Increase max_match in the lookup definition

Answer

Use the lookup command with local=t

Question 3

Which TWO of the following are best practices when creating lookup table files?

Accepted Answer

Ensure the lookup file is in CSV format with the .csv extension.. B and C are correct. Using CSV format with a header row is standard (B). Placing the file in the app's lookups directory ensures proper access (C). A is wrong because spaces in field names cause issues. D is unnecessary (full paths are not recommended). E is not a best practice for file creation; automatic refresh is configured separately.

Answer

Use header rows with spaces in field names for readability.

Answer

Enable automatic lookup refresh for frequently updated files.

Answer

Use full paths in the lookup definition.

Question 4

An analyst needs to create a time-series chart showing the percentage of total HTTP status codes per day. Which approach is most efficient?

Accepted Answer

timechart count by status | eventstats sum(count) as total by _time | eval pct = round(count/total*100,2) | chart first(pct) over _time by status. Option A is correct because using timechart to get counts by status, then eventstats to compute total per day, and eval to calculate percentage, is efficient and clear. Option B is incorrect because using chart with a single stats command cannot compute percentages across groups per time bucket. Option C is incorrect because addtotals adds overall totals but does not compute per-day percentages. Option D is incorrect because overcomplicates with subsearches.

Answer

chart count by status over _time | eval pct = count / sum(count) * 100

Answer

timechart count by status | addtotals | eval pct = count / total * 100

Answer

timechart count by status | append [timechart count] | eval pct = count / [| timechart count] * 100

Question 5

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. Option D is correct because the error 'Could not find lookup table' indicates the lookup definition (transforms.conf stanza) is missing or incorrect. Option A is incorrect because if the file were missing but definition existed, the error would mention 'file not found'. Option B is incorrect because permissions errors produce a different message. Option C is incorrect because the error is about the table, not the field.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 6

Which TWO configurations are required to create a geospatial visualization of server locations?

Accepted Answer

A mappings.json file in the app directory.. Options A and D are correct. A lookup table with latitude and longitude fields provides the location data, and a mappings.json file defines the geographic shapes for the visualization. Options B, C, and E are not strictly required; they are optional or used for other purposes.

Answer

A sourcetype that includes country codes.

Answer

An index that contains geographic data.

Answer

The use of the geostats command.

Question 7

A Splunk administrator is troubleshooting a slow dashboard that uses a timechart with a large dataset. Which of the following is a best practice to improve performance?

Accepted Answer

Use data model acceleration. Data model acceleration pre-computes data for faster searches. Increasing bucket count, using eval, or increasing concurrent searches do not directly improve performance and may worsen it.

Answer

Increase the number of concurrent searches

Answer

Use the eval command to add fields

Answer

Increase the search bucket count

Question 8

A Splunk administrator wants to create a static lookup table from a search result. Which approach is recommended?

Accepted Answer

Use the `outputlookup` command to save the search result as a CSV file.. Option A is correct. The outputlookup command is designed to save search results directly to a CSV file in the lookups directory. Option B is manual and error-prone. Option C, inputlookup, reads a lookup file. Option D, lookup, applies a lookup but does not create a file.

Answer

Use `inputlookup` to write to a CSV file.

Answer

Use the `lookup` command to create the file.

Answer

Manually copy the results into a spreadsheet and upload as CSV.

Question 9

Which THREE steps are necessary to create a file-based lookup?

Accepted Answer

Upload the lookup file to the correct directory.. A, B, and D are necessary. Upload the file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply changes (D). C is not required; props.conf is for field extractions, not lookup definitions. E is optional only if you want automatic lookup.

Answer

Create a lookup definition in props.conf.

Answer

Define an automatic lookup in props.conf.

Question 10

An automatic lookup is configured in props.conf and transforms.conf, but the expected fields are not appearing in search results. Which is the first thing to verify?

Accepted Answer

Verify the transforms.conf definition for the lookup. Option B is correct because checking the transforms.conf definition ensures the lookup table name, file path, and field mappings are correct. Option A is incorrect because permissions alone would cause a different error. Option C is incorrect because field extraction is not related to lookups. Option D is incorrect because search-time manual usage is not needed if automatic lookups are configured.

Answer

Run a search using the lookup command manually to test

Answer

Verify that the source field is extracted at search time

Answer

Verify that the user has read permissions on the lookup table

Question 11

An analyst creates a timechart to display the average CPU usage over time for multiple hosts. The chart shows a single line representing the overall average instead of separate lines per host. What is the most likely cause?

Accepted Answer

The search uses 'timechart span=1h avg(cpu)' without splitting.. Option C is correct because the timechart command without a 'by' clause produces a single series showing the overall average. Options A, B, and D would produce different issues but not the described symptom.

Answer

The search uses 'timechart avg(cpu) by host' but the host field is null.

Answer

The visualization type is set to 'Column' instead of 'Line'.

Answer

The search uses 'timechart avg(cpu) over date' without a by clause.

Question 12

Which THREE of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Use the REST API to upload a CSV file.. Options A, B, and E are correct. You can upload a CSV via the Settings menu, use the outputlookup command to create a lookup from search results, or use the REST API. Options C and D are incorrect because props.conf does not create lookups, and inputlookup reads but does not create.

Answer

Define a lookup in props.conf with a filename.

Answer

Use the 'inputlookup' command to create a new file.

Question 13

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

Accepted Answer

Define the lookup in transforms.conf and props.conf. For an automatic lookup that updates when the file changes, you must define the lookup in both transforms.conf and props.conf. Simply defining in transforms.conf or uploading the file is insufficient without props.conf to enable the automatic lookup.

Answer

Use the lookup command in searches

Answer

Upload the CSV to the lookups folder only

Answer

Only define in transforms.conf

Question 14

A dashboard panel uses a timechart to show error counts over time. Users report that the time range picker does not affect the panel. What is the most likely cause?

Accepted Answer

The search uses a fixed earliest and latest time.. Option B is correct because if the search uses fixed earliest/latest times, the time picker has no effect. Option A is wrong because stats can still respect the time range. Option C is wrong because the index being non-time-based would prevent any time range from working, but the panel would show no data. Option D is wrong because sharing doesn't affect time range behavior.

Answer

The dashboard is not shared.

Answer

The panel uses 'stats' instead of 'timechart'.

Answer

The index is not time-based.

Question 15

A lookup definition is correctly configured, but when used in a search, no results are returned. The lookup file exists and contains data. What is the most likely cause?

Accepted Answer

The lookup definition has the wrong case sensitivity setting.. Option B is correct because case sensitivity mismatch is a common issue: if the lookup definition expects exact case but the search field has different case, no match occurs. Option A is unlikely as too many fields do not prevent matching. Option C, disabling field extraction, would affect other parts but not lookup matching directly. Option D, format mismatch, would cause an error, not silently return no results.

Answer

The lookup file has too many fields.

Answer

The lookup file is in JSON format but the definition expects CSV.

Answer

The search time field extraction for the matching field is disabled.