SPLK-1002 Practice Test 16 — 15 Questions

Question 1

Which THREE statements about the `transaction` command are true?

Accepted Answer

Transaction can correlate events based on more than one field.. The `transaction` command groups events based on one or more fields (option A true). It can include multivalue fields from constituent events (B true). The `maxpause` option sets the maximum pause between events, not the total time span; the `maxtime` option sets the maximum time span (so C false). When using `startswith` and `endswith`, a `duration` field is added (D true). Transaction is memory-intensive and not recommended for large datasets, making E false. Therefore, the correct options are A, B, and D.

Answer

The maxpause option sets the maximum time span of the transaction.

Answer

Transaction is the most efficient way to group events from large datasets.

Question 2

A Splunk administrator is troubleshooting a slow dashboard that uses a timechart with a large dataset. Which of the following is a best practice to improve performance?

Accepted Answer

Use data model acceleration. Data model acceleration pre-computes data for faster searches. Increasing bucket count, using eval, or increasing concurrent searches do not directly improve performance and may worsen it.

Answer

Increase the number of concurrent searches

Answer

Use the eval command to add fields

Answer

Increase the search bucket count

Question 3

What action can the administrator take to resolve this warning?

Accepted Answer

Increase the max_mem_usage_mb setting in limits.conf. The error indicates the lookup file exceeds the maximum memory allocation. Increasing the max_mem_usage_mb setting in limits.conf allows loading larger files.

Answer

Split the lookup into multiple smaller files

Answer

Convert the lookup to a KV Store lookup

Answer

Increase max_match in the lookup definition

Answer

Use the lookup command with local=t

Question 4

Which TWO configurations are required to create a geospatial visualization of server locations?

Accepted Answer

A mappings.json file in the app directory.. The correct answers are C and D. A lookup table containing latitude and longitude fields provides the geographic coordinates for each server location. A mappings.json file in the app directory defines the geographic boundary or map layer to visualize those coordinates. Options A, B, and E are not strictly required: geospatial visualizations can use any sourcetype, data can come from any index, and the geostats command is optional.

Answer

A sourcetype that includes country codes.

Answer

An index that contains geographic data.

Answer

The use of the geostats command.

Question 5

A Splunk administrator wants to create a static lookup table from a search result. Which approach is recommended?

Accepted Answer

Use the `outputlookup` command to save the search result as a CSV file.. The outputlookup command is designed to save search results directly to a CSV file in the lookups directory. Option B is manual and error-prone. Option C, inputlookup, reads a lookup file. Option D, lookup, applies a lookup but does not create a file.

Answer

Use `inputlookup` to write to a CSV file.

Answer

Use the `lookup` command to create the file.

Answer

Manually copy the results into a spreadsheet and upload as CSV.

Question 6

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

Accepted Answer

Define the lookup in transforms.conf and props.conf. To create a dynamic lookup that automatically updates from a CSV file, you must define the lookup in both transforms.conf and props.conf. The transforms.conf defines the lookup table and its source file, while props.conf enables automatic lookup and associates it with the appropriate sourcetype. Simply uploading the CSV or defining only in transforms.conf is insufficient; using the lookup command in searches is not required for the automatic update mechanism.

Answer

Use the lookup command in searches

Answer

Upload the CSV to the lookups folder only

Answer

Only define in transforms.conf

Question 7

Which THREE of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Use the REST API to upload a CSV file.. The correct methods to create a lookup table in Splunk are: uploading a CSV via the REST API (A), uploading a CSV via the Lookups menu in Settings (C), and using the 'outputlookup' command in a search to save results as a lookup (D). Option B is incorrect because defining a lookup in props.conf only references an existing file; it does not create the lookup. Option E is incorrect because 'inputlookup' reads from a lookup, not creates one.

Answer

Define a lookup in props.conf with a filename.

Answer

Use the 'inputlookup' command to create a new file.

Question 8

An analyst creates a timechart to display the average CPU usage over time for multiple hosts. The chart shows a single line representing the overall average instead of separate lines per host. What is the most likely cause?

Accepted Answer

The search uses 'timechart span=1h avg(cpu)' without splitting.. The search uses 'timechart span=1h avg(cpu)' without a 'by' clause, which produces a single series showing the overall average over time. Options A, C, and D would not result in a single line representing the overall average across all hosts.

Answer

The search uses 'timechart avg(cpu) by host' but the host field is null.

Answer

The visualization type is set to 'Column' instead of 'Line'.

Answer

The search uses 'timechart avg(cpu) over date' without a by clause.

Question 9

A lookup table file contains 10GB of data. When performing a lookup using the lookup command, search performance is extremely slow. Which approach will most effectively improve performance without losing functionality?

Accepted Answer

Convert the lookup to a KV store lookup.. Converting the lookup to a KV store lookup leverages a key-value store optimized for fast retrieval, significantly improving performance for large datasets. Options A, B, C, and D are less effective or reduce functionality: splitting into multiple files (A) adds complexity without addressing performance; loading into memory (B) may cause memory issues; increasing max_memtable_bytes (C) can lead to instability; time-based lookup (D) restricts the lookup to a limited time range, losing functionality.

Answer

Split the lookup into multiple smaller files and use a chain of lookups.

Answer

Use the inputlookup command to load the entire table into memory.

Answer

Set the max_memtable_bytes in limits.conf to increase memory.

Answer

Create a time-based lookup with limited time range.

Question 10

A lookup definition is correctly configured, but when used in a search, no results are returned. The lookup file exists and contains data. What is the most likely cause?

Accepted Answer

The lookup definition has the wrong case sensitivity setting.. Case sensitivity mismatch is a common issue: if the lookup definition expects exact case but the search field has different case, no match occurs. Option A is unlikely as too many fields do not prevent matching. Option C, disabling field extraction, would affect other parts but not lookup matching directly. Option D, format mismatch, would cause an error, not silently return no results.

Answer

The lookup file has too many fields.

Answer

The lookup file is in JSON format but the definition expects CSV.

Answer

The search time field extraction for the matching field is disabled.

Question 11

A large lookup file with 10 million rows is used in a search that joins with main index data. The search is slow. Which optimization should be applied first?

Accepted Answer

Convert the lookup to a KV store collection.. Converting a large lookup to a KV store collection significantly improves performance by enabling indexed lookups, reducing the time needed for join operations. Option A is incorrect because 'lookup local=true' only controls where the lookup file is searched (local versus peers), not its performance. Option B is incorrect because adding a filter using a subsearch adds overhead and is not an optimization; it can make the search slower. Option D is incorrect because 'inputlookup' loads the entire lookup into memory, which for 10 million rows would be slow and memory-intensive, not a performance improvement.

Answer

Use 'lookup local=true' to reduce time.

Answer

Add a filter on the lookup using a subsearch.

Answer

Use 'inputlookup' instead of 'lookup'.

Question 12

A user wants to create a trellis chart with multiple panels, each showing data for a different department. What attribute should be used to split the visualization?

Accepted Answer

Split by. In trellis charts, the 'Split by' attribute divides the visualization into multiple panels based on a field value. Overlay, color, and drilldown are not used for splitting.

Answer

Overlay

Answer

Drilldown

Answer

Color

Question 13

A lookup table must be updated multiple times per minute from an external API. Which lookup method provides the best performance for search-time enrichment?

Accepted Answer

KV Store lookup updated via REST API. KV Store lookups can be updated via REST API calls without reindexing and provide fast search-time lookups. Option A is incorrect because file lookups require rewriting the file and reloading. Option B is incorrect because index-time lookups require reindexing. Option C is incorrect because scripted lookups call the API on every search, causing severe performance issues.

Answer

CSV file lookup updated by a scheduled script

Answer

Index-time lookup using a transformation that queries the API during indexing

Answer

Scripted lookup that calls the API on each search

Question 14

A search produces a table with many rows. Which visualization type is best suited to show the distribution of a single field's values?

Accepted Answer

Pie chart. A pie chart effectively shows the proportional distribution of a single field's values across categories. Area charts, scatter charts, and line charts are better suited for showing trends over time or relationships between variables, not distribution of a single field.

Answer

Area chart

Answer

Scatter chart

Answer

Line chart

Question 15

An admin configured an automatic lookup but events for mysourcetype are not being enriched. What is the most likely problem?

Accepted Answer

The match_type should be 'EXACT' instead of 'WILDCARD'.. The WILDCARD match_type requires the event value to contain wildcard characters or be matched glob-style; typical exact matches require EXACT match_type. Option C is possible but the syntax can omit INPUT if the field names match. Options A and D are less likely.

Answer

The lookup file is too large and memory limit is exceeded.

Answer

The LOOKUP stanza in props.conf is missing the input field specification.

Answer

The lookup is defined in transforms.conf but not referenced in any search.