SPLK-1002 Practice Test 17 — 15 Questions

Question 1

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

Accepted Answer

It defines the time interval for each data point (1 hour).. The span argument in the timechart command specifies the time interval for each data point or bucket. Here, span=1h means each bucket represents one hour. Option A is incorrect because span does not limit the number of status values; that's controlled by other means. Option B is incorrect because span=1h groups events into 1-hour, not 1-minute, intervals. Option C is incorrect because the time range of the chart is set by the search time picker, not the span argument.

Answer

It limits the number of status values displayed.

Answer

It groups events into 1-minute intervals.

Answer

It sets the time range of the chart.

Question 2

A dashboard uses a drop-down input to select a server. The drop-down is populated by a search that returns server names. Which setting ensures that the drop-down updates automatically when the underlying data changes?

Accepted Answer

Change the 'refresh' setting on the input. The 'refresh' setting on the input causes the search that populates the drop-down to re-run at intervals, keeping the list current. Token filters, delay, or 'search on change' do not provide automatic periodic updates.

Answer

Set the 'delay' option

Answer

Use a token filter

Answer

Enable 'search on change'

Question 3

Which ONE setting is required in a transforms.conf stanza for a file-based lookup to work? (Select one.)

Accepted Answer

filename. In Splunk transforms.conf, only the 'filename' setting is mandatory for a file-based lookup. The 'match_type' setting is optional and defaults to 'EXACT' if not specified. Therefore, only D is correct.

Answer

max_matches

Answer

match_type

Answer

case_sensitive_match

Answer

default_match

Question 4

What type of visualization is produced by the pie command?

Accepted Answer

A pie chart.. The `pie` command in Splunk generates a pie chart from the statistical results. Option A (bar chart) is produced by the `chart` command, not `pie`. Option C (scatter chart) and D (line chart) are not applicable here.

Answer

A bar chart.

Answer

A scatter chart.

Answer

A line chart.

Question 5

An admin wants to create a dashboard that shows the count of errors by sourcetype over the last 7 days, with the ability to click on a sourcetype to drill down to a detailed search. Which visualization and configuration supports this?

Accepted Answer

Use a bar chart and set the 'drilldown' option to 'search' in the dashboard XML.. A bar chart is suitable for comparing counts across sourcetypes and allows drilldown via the dashboard XML configuration. Option A is incorrect because a line chart is typically used for trends over time, not for comparing counts across categories, and drilldown is not configured via the search command but in the dashboard XML. Option C is incorrect because pie charts are less effective when there are many categories, and drilldown is not configured via the search command. Option D is incorrect because tables do support drilldown, but the configuration described is not standard; drilldown is set in the dashboard XML, not via a 'link' in the search string.

Answer

Use a line chart and set the 'drilldown' to 'search' in the search command.

Answer

Use a pie chart and set the 'drilldown' option to 'search' in the dashboard XML.

Answer

Use a table and set the 'link' in search string.

Question 6

Which TWO of the following statements about lookup tables in Splunk are true?

Accepted Answer

KV Store lookups require defining a collection in collections.conf.. CSV lookups can be updated by replacing the file; Splunk automatically reloads them. KV Store lookups require a collection definition in collections.conf. The other options are false: lookup files can be stored in app directories, external lookups can connect to various data sources via scripts, and lookups can replace field values if configured with overwrite=true.

Answer

Lookups can only add new fields to events; they cannot replace existing field values.

Answer

External lookups can only retrieve data from CSV files.

Answer

Lookup files can only be stored in $SPLUNK_HOME/etc/system/lookups/.

Question 7

Which THREE practices improve lookup performance in Splunk? (Select three.)

Accepted Answer

Use KV Store lookups for data that is updated frequently. The three practices that improve lookup performance in Splunk are: Use KV Store lookups for data that is updated frequently (B), use index-time lookups for static reference data that rarely changes (D), and keep lookup files small and focused for fast search-time loading (E). Option A is incorrect because large CSV files used as automatic lookups can degrade performance. Option C is incorrect because the 'format' command does not reduce lookup size; it formats results and does not improve lookup performance.

Answer

Use large CSV files configured as automatic lookups for always-current data

Answer

Apply formatting options like 'format' command to reduce lookup size

Question 8

An IT administrator notices that a lookup table used to enrich firewall logs is not updating correctly. The lookup file is stored in $SPLUNK_HOME/etc/apps/search/lookups/. What is the most likely cause if the lookup is defined as a 'file-based lookup' with automatic lookup?

Accepted Answer

The lookup filename contains a space character. Splunk does not support spaces in lookup filenames. A space in the filename causes the lookup to fail. Option C is correct.

Answer

The lookup file is too large (over 100 MB)

Answer

The lookup is not referenced in any search

Answer

The lookup file permissions are set to read-only

Question 9

Which TWO SPL commands can be used to create a time-based chart showing event counts over time? (Select two.)

Accepted Answer

chart (with time span). The correct answers are B and C. timechart automatically creates a time-based chart showing event counts over time by default. chart with a time span (e.g., chart count over _time span=1h) also creates a time-based chart. eventstats (A) adds statistics to existing events but does not produce a chart. where (D) filters events based on a condition. stats (E) returns a table of statistics but does not produce a chart.

Answer

eventstats

Answer

where

Answer

stats

Question 10

An analyst wants to create a visualization showing the average response time by hour over the past day, with each server in a separate line. Which command should they use?

Accepted Answer

`... | timechart span=1h avg(response_time) by server`. It uses `timechart` with a span of 1 hour to create a time-based chart, averaging response time and splitting by server, resulting in separate lines per server over the past day. Option B is incorrect because omitting `span=1h` means Splunk may use a default span that might not be exactly one hour, and the request specifically required hourly intervals. Option C uses `chart` which is not time-based and would produce a non-time chart, not a line chart over time. Option D uses `stats` which outputs a tabular result, not a visualization.

Answer

`... | timechart avg(response_time) by server`

Answer

`... | chart avg(response_time) by hour, server`

Answer

`... | stats avg(response_time) by hour, server`

Question 11

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

Accepted Answer

city and country are set to 'NotFound'. The lookup definition in the exhibit sets `default_match='NotFound'`, and `OUTPUTNEW` adds fields only if they are not already present. When no match occurs, the default values 'NotFound' are used for both `city` and `country`. Option A is incorrect because the search does not fail; it continues with the default values. Option B is incorrect because fields are still added with default values. Option C is incorrect because the default_match overrides any default empty string behavior.

Answer

The search fails with an error

Answer

No fields are added

Answer

city and country are set to empty strings

Question 12

A team is designing a dashboard to monitor real-time server CPU utilization. They want to update every 10 seconds and use a gauge visualization. What is the best search mode to use for real-time performance?

Accepted Answer

Fast mode. Fast mode reduces computational overhead by limiting field extraction, which is ideal for real-time dashboards. Smart mode may do more work, Verbose mode returns all fields, and Real-time is not a search mode.

Answer

Smart mode

Answer

Real-time mode

Answer

Verbose mode

Question 13

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

Accepted Answer

The match_type should be 'match_type = cidr' without brackets. In Splunk's transforms.conf, the 'match_type' is a setting within a stanza, not a stanza name itself. The bracket syntax [match_type = cidr] incorrectly defines a new stanza. The correct syntax is to place 'match_type = cidr' as a line under the [geo_ip] stanza.

Answer

The max_matches setting should be 0

Answer

The filename should include the full path

Answer

The stanza name should be 'geo_ip' without brackets

Question 14

In a dashboard, a bar chart shows sales by region. The user wants to click on a bar and have a table filter to show only that region's details. Which drilldown technique should be used?

Accepted Answer

Set a token using $click.value$ in the drilldown and add a dependency on the token in the table search. In Splunk dashboards, drilldowns can set tokens using $click.value$ to capture the clicked field value. By setting a token in the drilldown of the bar chart (e.g., token = region_selection with value = $click.value$), the table search can then reference this token (e.g., index=... region=$region_selection$) to filter dynamically. Option A is incorrect because simply enabling drilldown without token setup does not pass the value to another panel. Option B is incorrect because form input dropdowns are for user input, not for capturing drilldown clicks. Option D is incorrect because a static filter cannot respond to user clicks.

Answer

Enable drilldown in the bar chart and set the search to automatically apply the clicked field

Answer

Configure a form input dropdown and set default value from drilldown

Answer

Use a static filter with a predefined list of regions

Question 15

Which TWO features are available for customizing dashboards in Splunk's Simple XML?

Accepted Answer

Automatically refreshing panels using token 'refresh'.. Options C and D are correct. C: The 'refresh' token in Simple XML allows automatic panel refreshing without user interaction. D: Drilldown actions can be added to tables and charts to enable interactivity, such as linking to other dashboards or searches. A is incorrect because HTML panels in Simple XML cannot embed custom JavaScript; they only support basic HTML. B is incorrect because CSS customization in Simple XML is limited to the dashboard level, not individual panels, and color changes require CSS files or inline styles. E is incorrect because Splunk does not support multiple dashboard versions per user role; role-based access is managed via permissions, not separate dashboard versions.

Answer

Using HTML in a panel to embed custom JavaScript.

Answer

Using CSS to change the color of all panels.

Answer

Creating multiple dashboard versions for different user roles.