SPLK-1002 Advanced Visualization and Lookups — 10 Questions

Question 1

Which statement best describes the search result?

Accepted Answer

It returns the count of events where the price is greater than 100, grouped by product_name.. The search uses a lookup to add product_name and price fields to the events, then filters for price > 100, and finally counts events by product_name. Option A is wrong because price is added by the lookup, so it is a field before the filter. Option B is wrong because the search counts events, not distinct product_ids. Option D is wrong because it does not mention grouping by product_name.

Answer

It returns an error because price is not a field before the lookup.

Answer

It returns the count of distinct product_ids that have a price > 100.

Answer

It returns the count of successful web events, but only for products with price > 100.

Question 2

A security analyst wants to create a visualization that shows the count of failed login attempts per user over the last 7 days. Which visualization type is most appropriate?

Accepted Answer

Bar chart with users on x-axis and count on y-axis. The question asks for a visualization showing the count of failed login attempts per user over the last 7 days. This requires a categorical comparison of total counts per user, not a trend over time. A bar chart with users on the x-axis and count on the y-axis directly displays the total attempts per user, making it the most appropriate choice. A line chart would show changes over time but typically aggregates across all users, not per user, unless multiple series are used, which is not specified. A pie chart shows proportions but not absolute counts, and a scatter plot is for correlations.

Answer

Pie chart showing proportion of attempts per user

Answer

Line chart with time on x-axis and count on y-axis

Answer

Scatter chart showing correlation between user and time

Question 3

Which visualization type is best for comparing the proportion of each error type to the total errors over time?

Accepted Answer

Area chart. (Area chart) is correct because a stacked area chart effectively shows how each error type contributes to the total over time. Option A (Pie chart) is not time-based and only shows a single snapshot. Option B (Column chart) can display multiple categories over time but does not emphasize proportion as clearly as a stacked area chart. Option C (Line chart) focuses on trends of individual values rather than proportions of a whole.

Answer

Pie chart (with multiple series)

Answer

Column chart

Answer

Line chart

Question 4

A security analyst creates a timechart of login failures by source IP. The chart shows expected spikes, but the top 5 IPs account for <10% of all failures. The analyst suspects a DDoS attack using spoofed IPs. Which visualization type would BEST highlight the distribution of failures across all IPs?

Accepted Answer

Treemap. A treemap is the best choice because it uses nested rectangles to represent the proportional contribution of each source IP to the total login failures, making it easy to visually identify the distribution across all IPs, even when no single IP dominates. Unlike other chart types, a treemap can efficiently display hundreds of IPs without cluttering the view, which is critical when the top 5 IPs account for less than 10% of failures, indicating a highly distributed attack pattern.

Answer

Pie chart

Answer

Scatter plot

Answer

Stacked column chart

Question 5

An engineer runs `| inputlookup asset_lookup.csv | table asset_id asset_name` and gets no results despite the file existing in $SPLUNK_HOME/etc/apps/search/lookups/. The lookup definition is correctly configured. What is the MOST likely cause?

Accepted Answer

The lookup definition name does not match the filename.. The `inputlookup` command references a lookup by its definition name, not the filename. Even if the file exists in the correct directory, the command will fail if the lookup definition name in the configuration does not match the filename. Option D is correct because the engineer likely used the filename in the command instead of the lookup definition name.

Answer

The engineer lacks permissions to read the lookup.

Answer

The lookup file is not in the correct directory.

Answer

The lookup file has a .csv extension but contains other data.

Question 6

A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?

Accepted Answer

The search is not scheduled or set to 'Auto' for the panel.. The single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.

Answer

The 'Token delay' is too high.

Answer

The time range picker is set to 'All time'.

Answer

The dashboard's 'Auto-refresh' interval is not set.

Question 7

A user creates a lookup definition for a CSV file containing user roles. The lookup is used in a search: `| lookup user_roles username OUTPUT role`. The search returns no additional field. The lookup file has columns: 'username', 'role', 'department'. What is the MOST likely issue?

Accepted Answer

The lookup definition uses a different filename than the CSV.. The lookup definition must reference the exact filename of the CSV file. If the definition points to a different filename than the actual CSV, the lookup will fail to load the file, and no fields will be returned. The search syntax is otherwise correct, so the issue lies in the mismatch between the definition and the file.

Answer

The username field in the search is not extracted.

Answer

The lookup file is not in the lookups directory.

Answer

The 'role' field is misspelled in the search.

Question 8

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 9

Which TWO are valid methods to join data from a CSV file in a Splunk search?

Accepted Answer

`| lookup myfile.csv`. The `| lookup` command can reference a CSV file defined as a lookup table in Splunk, allowing field-based enrichment of search results. This is a standard method for joining data from a CSV file within a search, provided the lookup is properly configured in transforms.conf and props.conf.

Answer

`| append myfile.csv`

Answer

`| join myfile.csv`

Answer

`| csvlookup myfile.csv`

Question 10

Which THREE are best practices for creating lookups in Splunk?

Accepted Answer

Use case-insensitive matching by default for user-facing lookups.. Using case-insensitive matching by default in user-facing lookups ensures that users do not need to worry about the case of the lookup key, which improves usability and reduces errors. In Splunk, this is configured via the `LOOKUP` command or in transforms.conf with the `case_sensitive_match = false` setting, which is the default behavior for most lookup types. This best practice avoids confusion when users query data with varying case formats, such as user names or hostnames.

Answer

Use wildcard matching in lookups for better performance.

Answer

Use a time-based lookup for static reference data.