SPLK-1003 Practice Test 6 — 10 Questions

Question 1

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 2

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. Option C is correct because in Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 3

Which THREE of the following are components of the Splunk Common Information Model (CIM)? (choose three)

Accepted Answer

Endpoint. Option B (Endpoint) is correct because the Splunk Common Information Model (CIM) includes the Endpoint data model, which normalizes data from endpoint security solutions such as antivirus, EDR, and host-based intrusion detection. This data model covers processes, file system changes, registry modifications, and other host-level activities, making it a core component of the CIM.

Answer

Application State

Answer

Change Analysis

Question 4

Which TWO of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Upload a CSV file through the Splunk Web interface. Option C is correct because Splunk Web provides a direct interface to upload a CSV file and define it as a lookup table, automatically creating the lookup definition and file. Option D is correct because the `outputlookup` command in a search writes search results to a CSV file in the lookups directory, effectively creating a lookup table from dynamic data.

Answer

Use the eval command to create a lookup definition

Answer

Use the stats command to aggregate data into a lookup

Answer

Use the inputlookup command in a search

Question 5

Which THREE are best practices for creating lookups in Splunk?

Accepted Answer

Use case-insensitive matching by default for user-facing lookups.. Option A is correct because using case-insensitive matching by default in user-facing lookups ensures that users do not need to worry about the case of the lookup key, which improves usability and reduces errors. In Splunk, this is configured via the `LOOKUP` command or in transforms.conf with the `case_sensitive_match = false` setting, which is the default behavior for most lookup types. This best practice avoids confusion when users query data with varying case formats, such as user names or hostnames.

Answer

Use wildcard matching in lookups for better performance.

Answer

Use a time-based lookup for static reference data.

Question 6

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Accepted Answer

Navigate to Settings > Advanced search > Search macros and click 'New'.. Option C is correct because Splunk provides a GUI-based method to create macros via Settings > Advanced search > Search macros, which is a standard and supported approach. Option D is correct because manually creating a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid configuration method that Splunk reads at startup to define macros.

Answer

Add a macro definition to props.conf under a [source] stanza.

Answer

Use the CLI command `splunk add macro` with the macro definition.

Answer

Edit the macros.conf file in the app's default directory.

Question 7

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. Option A is correct because the CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 8

A Splunk admin notices that a scheduled search using inputlookup is returning inconsistent results. The lookup file is stored on the search head and is updated via a script every 15 minutes. What is the most likely cause of the inconsistency?

Accepted Answer

The lookup file is cached and not automatically refreshed. The most likely cause is that the lookup file is cached by Splunk after the first read, and subsequent updates via the script do not automatically refresh the in-memory cache. By default, Splunk caches lookup files on the search head to improve performance, and changes to the file are not reflected until the cache expires or is manually cleared. This leads to inconsistent results when the scheduled search runs against a stale cached version.

Answer

The search head is not configured as a lookup server

Answer

The lookup file contains duplicate entries with different timestamps

Answer

The lookup file exceeds the maximum file size

Question 9

The exhibit shows a search that reads a lookup file. Which of the following must be true for this search to work correctly?

Accepted Answer

The lookup must be defined in transforms.conf. For a lookup to work in a Splunk search, it must be defined in transforms.conf. This configuration file specifies the lookup type (e.g., file-based, KV-store, external), the filename, the field mapping, and other parameters. Without this definition, Splunk cannot resolve the lookup command or the lookup table reference in the search string, even if the file exists on disk.

Answer

The lookup file must be stored on the indexer

Answer

The file must be in the default lookup directory

Answer

The file server_status.csv must be in the $SPLUNK_HOME/etc/apps/search/lookups directory

Question 10

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

Accepted Answer

Choropleth map. C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Answer

Single value

Answer

Gauge

Answer

Scatter plot