SPLK-1002 Advanced Visualization and Lookups Practice Test 10 — 15 Questions

Question 1

A large CSV lookup file (over 10 million rows) is causing search performance degradation. Which solution best improves performance without sacrificing accuracy?

Accepted Answer

Convert to a KV Store lookup and update the collection as needed. Converting the large CSV lookup to a KV Store lookup improves performance because KV Store uses an indexed, persistent database (backed by MongoDB) that supports efficient key-based lookups, unlike CSV lookups which are loaded into memory and linearly scanned. KV Store lookups can handle large datasets without the memory pressure and replication overhead that CSV files impose on search heads. Accuracy is preserved because the full dataset remains available and queryable.

Answer

Increase the max_memory setting in transforms.conf

Answer

Convert to an index-time lookup with automatic re-indexing

Answer

Reduce the CSV file to only the most common lookup keys

Question 2

In a dashboard, a bar chart shows sales by region. The user wants to click on a bar and have a table filter to show only that region's details. Which drilldown technique should be used?

Accepted Answer

Set a token using $click.value$ in the drilldown and add a dependency on the token in the table search. In Splunk dashboards, drilldown tokens like $click.value$ capture the value of the clicked element (e.g., the region bar). Setting this token in the drilldown and then adding a token dependency to the table's search ensures the table filters dynamically based on the clicked region. This is the standard token-based drilldown pattern in Simple XML dashboards.

Answer

Enable drilldown in the bar chart and set the search to automatically apply the clicked field

Answer

Configure a form input dropdown and set default value from drilldown

Answer

Use a static filter with a predefined list of regions

Question 3

A lookup table must be updated multiple times per minute from an external API. Which lookup method provides the best performance for search-time enrichment?

Accepted Answer

KV Store lookup updated via REST API. KV Store lookups can be updated via REST API calls without reindexing and provide fast search-time lookups. Option A is incorrect because file lookups require rewriting the file and reloading. Option B is incorrect because index-time lookups require reindexing. Option C is incorrect because scripted lookups call the API on every search, causing severe performance issues.

Answer

CSV file lookup updated by a scheduled script

Answer

Index-time lookup using a transformation that queries the API during indexing

Answer

Scripted lookup that calls the API on each search

Question 4

Which ONE setting is required in a transforms.conf stanza for a file-based lookup to work? (Select one.)

Accepted Answer

filename. In transforms.conf, a file-based lookup stanza requires the 'filename' setting to specify the CSV file (relative to $SPLUNK_HOME/etc/apps/<app>/lookups/) that contains the lookup data. Without 'filename', Splunk has no source file to read, and the lookup definition is invalid. All other settings like max_matches, match_type, case_sensitive_match, and default_match are optional and only tune lookup behavior.

Answer

max_matches

Answer

match_type

Answer

case_sensitive_match

Answer

default_match

Question 5

Which TWO SPL commands can be used to create a time-based chart showing event counts over time? (Select two.)

Accepted Answer

chart (with time span). Option B, chart (with time span), is correct because the chart command can bucket the _time field using a span (e.g., chart count BY _time span=5m) to produce a time-based chart of event counts over time. Option C, timechart, is correct because timechart is purpose-built for time-series visualizations, automatically bucketing _time by a span (e.g., timechart span=5m count) and plotting event counts over time. Option A, eventstats, is incorrect because it only computes aggregate statistics and adds them as fields to each event without creating a chart. Option D, where, is incorrect because it merely filters search results by a boolean expression and does not aggregate or chart data. Option E, stats, is incorrect because although it can aggregate counts, it does not inherently produce a time-based chart unless combined with a time field and charting, so it is not one of the two intended charting commands.

Answer

eventstats

Answer

where

Answer

stats

Question 6

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. The error indicates that Splunk cannot find the lookup definition named [geo_lookup], which is defined in transforms.conf. A lookup definition must exist in transforms.conf (referencing the CSV in lookups/) before it can be used in a search; if the stanza is missing or misnamed, Splunk throws an error about the lookup definition not being found. The file itself may exist, but without the transforms.conf stanza the definition is unavailable.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 7

An analyst creates a timechart to display the average CPU usage over time for multiple hosts. The chart shows a single line representing the overall average instead of separate lines per host. What is the most likely cause?

Accepted Answer

The search uses 'timechart span=1h avg(cpu)' without splitting.. The `timechart` command without a `by` clause produces a single series that aggregates the statistic across all events, so `timechart span=1h avg(cpu)` returns one line representing the overall average CPU across all hosts. To get separate lines per host, the search must include a split-by field such as `by host`, which creates one series per distinct value of that field. Since the question states the chart shows a single overall average line, the missing `by host` clause is the direct cause.

Answer

The search uses 'timechart avg(cpu) by host' but the host field is null.

Answer

The visualization type is set to 'Column' instead of 'Line'.

Answer

The search uses 'timechart avg(cpu) over date' without a by clause.

Question 8

An analyst notices that a timechart command with 'by host' shows only 10 hosts even though there are 50 distinct hosts. What could be the reason?

Accepted Answer

The 'limit' parameter is set to 10 by default.. The timechart command has a default 'limit' parameter of 10, which controls the maximum number of series (e.g., hosts) displayed when using a 'by' clause. With 50 distinct hosts, only the top 10 by the aggregated value are shown by default. To display more, you must explicitly set 'limit' to a higher value (e.g., limit=50) or use 'limit=0' for no limit.

Answer

The visualization is set to 'Pie' which only shows top 10.

Answer

The search is using 'join' to combine data.

Answer

The 'useother' parameter is set to false.

Question 9

An analyst observes that a lookup command with a large lookup file is causing the search to timeout. The lookup is used to extract additional fields based on a field value. What is the most effective immediate solution?

Accepted Answer

Reduce the lookup file size by removing unused columns or rows.. The most effective immediate fix for a lookup-induced search timeout is to reduce the lookup file's size by removing unused columns and rows, which directly decreases the memory and CPU the lookup consumes during the search. Splunk loads the lookup into memory (or streams it) and matches each event against it, so a smaller file means faster matching and lower resource usage. This addresses the root cause rather than masking the symptom.

Answer

Change the match_type to WILDCARD to be more flexible.

Answer

Use the inputlookup command to load the entire table.

Answer

Increase the search timeout in limits.conf.

Question 10

A security analyst wants to create a visualization that shows the count of failed login attempts per user over the last 7 days. Which visualization type is most appropriate?

Accepted Answer

Bar chart with users on x-axis and count on y-axis. A bar chart with users on the x-axis and count on the y-axis is the most appropriate visualization for comparing the count of failed login attempts per user. Bar charts excel at comparing categorical values (users) against a numeric measure (count), making differences between users immediately visible.

Answer

Pie chart showing proportion of attempts per user

Answer

Line chart with time on x-axis and count on y-axis

Answer

Scatter chart showing correlation between user and time

Question 11

A user wants to join data from two datasets in a search. Which command is used to combine results based on a common field, but only returns matching results?

Accepted Answer

join. The join command in Splunk combines results from a subsearch with the main search based on a common field, and by default it returns only matching results (inner join). This is exactly what the question describes: combining datasets and returning only matches.

Answer

append

Answer

union

Answer

lookup

Question 12

A Splunk administrator is troubleshooting a slow dashboard that uses a timechart with a large dataset. Which of the following is a best practice to improve performance?

Accepted Answer

Use data model acceleration. Data model acceleration is a best practice to improve the performance of slow dashboards using timechart with large datasets. It pre-computes and stores summaries of data model datasets, allowing searches to run faster by querying the accelerated data instead of raw events. This reduces search time and resource consumption.

Answer

Increase the number of concurrent searches

Answer

Use the eval command to add fields

Answer

Increase the search bucket count

Question 13

An analyst needs to create a visualization that shows the relationship between source IP and destination port in network traffic. Which visualization type is most appropriate?

Accepted Answer

Sankey diagram. A Sankey diagram is ideal for visualizing the flow and relationship between two categorical fields, such as source IP and destination port. It shows the magnitude of flows between nodes, making it easy to see which source IPs communicate with which destination ports and the volume of traffic. This matches the analyst's need to show the relationship between source IP and destination port.

Answer

Choropleth map

Answer

Single value

Answer

Column chart

Question 14

A user wants to create a trellis chart with multiple panels, each showing data for a different department. What attribute should be used to split the visualization?

Accepted Answer

Split by. In Splunk, a trellis chart (also called a small multiples chart) displays multiple panels of the same visualization, each representing a different subset of data. The 'Split by' attribute is used to divide the data into these subsets based on a field, such as department. This creates a separate panel for each distinct value of the specified field, allowing side-by-side comparison.

Answer

Overlay

Answer

Drilldown

Answer

Color

Question 15

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Accepted Answer

Use the timechart command with a split-by field. Option A is correct because the timechart command is the Splunk search command designed to plot a metric (here, count of events) over time, and adding a split-by clause (e.g., timechart count by status) produces one series per status value, which is the data foundation for a stacked bar chart. Option E is correct because, after the timechart results are rendered, the user must set the visualization's stack mode to 'stacked' in the Format/Visualization options to actually stack the success and failure series into a single bar per time bucket. Option B is not required because the count-by-status series can be produced directly by timechart's split-by field without creating any new field via eval. Option C is not appropriate because the chart command does not inherently bin results by time the way timechart does, so it would not give the time-based x-axis needed here. Option D is incorrect because a line chart type would not produce the requested stacked bar chart.

Answer

Use the eval command to create a new field

Answer

Use the chart command with a split-by field

Answer

Select the 'line' chart type