SPLK-1003 Advanced Visualization and Lookups — 10 Questions

Question 1

A security analyst creates a timechart of login failures by source IP. The chart shows expected spikes, but the top 5 IPs account for <10% of all failures. The analyst suspects a DDoS attack using spoofed IPs. Which visualization type would BEST highlight the distribution of failures across all IPs?

Accepted Answer

Treemap. A treemap is the best choice because it uses nested rectangles to represent the proportional contribution of each source IP to the total login failures, making it easy to visually identify the distribution across all IPs, even when no single IP dominates. Unlike other chart types, a treemap can efficiently display hundreds of IPs without cluttering the view, which is critical when the top 5 IPs account for less than 10% of failures, indicating a highly distributed attack pattern.

Answer

Pie chart

Answer

Scatter plot

Answer

Stacked column chart

Question 2

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

Accepted Answer

The lookup definition name does not match the filename.. The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Answer

The engineer lacks permissions to read the lookup.

Answer

The lookup file is not in the correct directory.

Answer

The lookup file has a .csv extension but contains other data.

Question 3

A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?

Accepted Answer

The search is not scheduled or set to 'Auto' for the panel.. Option B is correct because the single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.

Answer

The 'Token delay' is too high.

Answer

The time range picker is set to 'All time'.

Answer

The dashboard's 'Auto-refresh' interval is not set.

Question 4

A user creates a lookup definition for a CSV file containing user roles. The lookup is used in a search: `| lookup user_roles username OUTPUT role`. The search returns no additional field. The lookup file has columns: 'username', 'role', 'department'. What is the MOST likely issue?

Accepted Answer

The lookup definition uses a different filename than the CSV.. Option C is correct because the lookup definition must reference the exact filename of the CSV file. If the definition points to a different filename than the actual CSV, the lookup will fail to load the file, and no fields will be returned. The search syntax is otherwise correct, so the issue lies in the mismatch between the definition and the file.

Answer

The username field in the search is not extracted.

Answer

The lookup file is not in the lookups directory.

Answer

The 'role' field is misspelled in the search.

Question 5

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 6

Which TWO are valid methods to join data from a CSV file in a Splunk search?

Accepted Answer

`| lookup myfile.csv`. Option C is correct because the `| lookup` command can reference a CSV file defined as a lookup table in Splunk, allowing field-based enrichment of search results. This is a standard method for joining data from a CSV file within a search, provided the lookup is properly configured in transforms.conf and props.conf.

Answer

`| append myfile.csv`

Answer

`| join myfile.csv`

Answer

`| csvlookup myfile.csv`

Question 7

Which THREE are best practices for creating lookups in Splunk?

Accepted Answer

Use case-insensitive matching by default for user-facing lookups.. Option A is correct because using case-insensitive matching by default in user-facing lookups ensures that users do not need to worry about the case of the lookup key, which improves usability and reduces errors. In Splunk, this is configured via the `LOOKUP` command or in transforms.conf with the `case_sensitive_match = false` setting, which is the default behavior for most lookup types. This best practice avoids confusion when users query data with varying case formats, such as user names or hostnames.

Answer

Use wildcard matching in lookups for better performance.

Answer

Use a time-based lookup for static reference data.

Question 8

What is the MOST likely reason the search returns no results?

Accepted Answer

The `inputlookup` command expects the definition name, not the filename.. The `inputlookup` command in Splunk expects the lookup definition name as its argument, not the filename of the CSV file. If a user specifies the filename (e.g., `| inputlookup myfile.csv`) instead of the lookup definition name (e.g., `| inputlookup my_lookup`), Splunk will not find the lookup and returns no results. This is a common mistake because the command syntax requires the logical name defined in the lookup table configuration, not the physical file path.

Answer

The user does not have permission to read the lookup.

Answer

The lookup definition is not configured.

Answer

The CSV file has no header row.

Question 9

What is the MOST likely cause of this error?

Accepted Answer

The CSV file has a trailing space in the column header 'asset_type'.. The error is most likely caused by a trailing space in the CSV column header 'asset_type'. When `inputlookup` reads a CSV file, it treats column headers as literal strings; a trailing space makes the field name 'asset_type ' (with a space) instead of 'asset_type'. This mismatch causes the `where` command to fail because it references 'asset_type' without the space, leading to a field-not-found error.

Answer

The lookup is not configured to output all fields.

Answer

The lookup definition filename is incorrect.

Answer

The `where` command cannot be used after `inputlookup`.

Question 10

A security analyst needs to correlate IP addresses from firewall logs with a lookup table containing known malicious IPs. The lookup table is updated hourly and contains 10,000 entries. Which lookup type should be used to ensure the fastest search performance?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is the correct choice because it is stored entirely in memory on the search head, providing the fastest access for small to medium-sized static datasets (like 10,000 entries). Since the lookup is updated hourly, a CSV file can be reloaded efficiently without the overhead of network calls or database queries, making it ideal for high-speed correlation in security searches.

Answer

External lookup

Answer

KV Store lookup

Answer

Geospatial lookup