SPLK-1002 Advanced Visualization and Lookups Practice Test 2 — 15 Questions

Question 1

An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The lookup definition is not configured as a CIDR type. The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet. Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.

Answer

The IP addresses in the events are in lowercase

Answer

The lookup file is not in CSV format

Answer

The lookup file is compressed and not being read correctly

Question 2

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

Accepted Answer

Choropleth map. C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Answer

Single value

Answer

Gauge

Answer

Scatter plot

Question 3

Which TWO of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Upload a CSV file through the Splunk Web interface. Splunk Web provides a direct interface to upload a CSV file and define it as a lookup table, automatically creating the lookup definition and file. Option D is correct because the `outputlookup` command in a search writes search results to a CSV file in the lookups directory, effectively creating a lookup table from dynamic data.

Answer

Use the eval command to create a lookup definition

Answer

Use the stats command to aggregate data into a lookup

Answer

Use the inputlookup command in a search

Question 4

Which THREE of the following are best practices when using lookups in Splunk?

Accepted Answer

Use the lookup command instead of inputlookup when possible to reduce memory usage. Using the `lookup` command with the `local=t` argument (or when the lookup table is small enough to be loaded into memory) can reduce memory usage compared to `inputlookup`, which always loads the entire lookup file into memory. The `lookup` command can stream results and only loads necessary fields, making it more efficient for large datasets. This is a best practice to avoid out-of-memory errors in distributed search environments.

Answer

Store lookup tables in KV Store when the table has more than 1 million rows

Answer

Always use KV Store lookups for faster performance compared to CSV lookups

Question 5

The exhibit shows a search that reads a lookup file. Which of the following must be true for this search to work correctly?

Accepted Answer

The lookup must be defined in transforms.conf. For a lookup to work in a Splunk search, it must be defined in transforms.conf. This configuration file specifies the lookup type (e.g., file-based, KV-store, external), the filename, the field mapping, and other parameters. Without this definition, Splunk cannot resolve the lookup command or the lookup table reference in the search string, even if the file exists on disk.

Answer

The lookup file must be stored on the indexer

Answer

The file must be in the default lookup directory

Answer

The file server_status.csv must be in the $SPLUNK_HOME/etc/apps/search/lookups directory

Question 6

The exhibit shows an error when using a lookup. What is the most likely missing configuration?

Accepted Answer

A lookup definition must be added to transforms.conf. When a lookup file is placed in the expected directory but still produces an error, the most common missing configuration is the lookup definition in transforms.conf. This file maps the lookup file to a logical name and specifies its type (e.g., CSV, KV store), which is required for Splunk to recognize and use the lookup in searches. Without this definition, the lookup file exists but is not registered for use.

Answer

The lookup file must be uploaded via the UI instead of placed manually

Answer

The search head must be configured as a lookup server

Answer

The lookup file must be in the $SPLUNK_HOME/etc/system/lookups directory

Question 7

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. It uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10

Question 8

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 9

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 10

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 11

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 12

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Accepted Answer

Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart. Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Answer

Use | where status=401 | dedup src_ip | timechart count by region

Answer

Use | where status=401 | mvexpand region | timechart count by region

Answer

Use | where status=401 | top limit=100 region

Question 13

A Splunk admin is tasked with creating a dashboard that shows the average response time per server over the last hour, updated every 60 seconds. The data comes from a sourcetype 'app_log' with fields: server, response_time. The admin wants to use a single search with a timechart and set the dashboard's time range picker to 'Last 60 minutes'. However, the chart shows only one data point (the average for the entire hour) instead of per-minute intervals. What is the most likely cause and solution?

Accepted Answer

The timechart command does not have a span specified; add | timechart span=1m avg(response_time) by server. The `timechart` command without an explicit `span` defaults to a single bucket for the entire search time range when the range is fixed (e.g., 'Last 60 minutes'). By adding `span=1m`, you force the command to create 1-minute buckets, producing a data point per minute. This is the most direct fix for the described behavior.

Answer

The dashboard uses a summary index; switch to a base search

Answer

The search is not set to real-time; change to a real-time search

Answer

The dashboard time range picker is set to 'All time'; change to 'Last 60 minutes'

Question 14

A security analyst needs to correlate authentication events from multiple Windows domain controllers to identify failed logon attempts from a specific user account, and then enrich the results with the user's department and manager from an HR database. Which TWO Splunk features should the analyst use?

Accepted Answer

Data model acceleration. Data model acceleration (B) is correct because it pre-computes and indexes authentication event data from multiple Windows domain controllers, enabling fast, efficient correlation of failed logon attempts for a specific user. Lookup definition (D) is correct because it allows the analyst to define a lookup that enriches the authentication events with the user's department and manager from an external HR database, mapping fields like username to the HR data.

Answer

Time-based lookup

Answer

Subsearch

Answer

Calculated field

Question 15

A large e-commerce company uses Splunk to monitor its web application performance. The operations team has created a dashboard with a timechart showing the 95th percentile of page load times over the last 24 hours. Recently, the dashboard stopped showing data for the last hour. The Splunk administrator confirms that the index is receiving data and the sourcetype is correctly configured. The search string is:

`index=web_app sourcetype=access_combined earliest=-24h@h latest=@h | timechart perc95(page_load_time) by host`

The dashboard panel uses a base search and a post-process search. The base search is:

`index=web_app sourcetype=access_combined earliest=-7d@d latest=@h`

What is the most likely cause of the missing last hour of data?

Accepted Answer

The base search time range is set to latest=@h, which excludes data from the current partial hour.. The base search uses `latest=@h`, which snaps the end time to the beginning of the current hour (e.g., 14:00:00), excluding any data from the current partial hour (e.g., 14:00:01 to 14:59:59). Since the dashboard panel relies on this base search, the post-process search inherits that time range, causing the last hour of data to be missing even though the index is actively receiving data.

Answer

The post-process search has a time range override that conflicts with the base search.

Answer

The base search uses a macro that is not defined in the app context.

Answer

The index is not being searched because the base search uses a wrong sourcetype.