SPLK-1002 Advanced Visualization and Lookups Practice Test 2 — 15 Questions

Question 1

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart. Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Answer

Use | where status=401 | dedup src_ip | timechart count by region

Answer

Use | where status=401 | mvexpand region | timechart count by region

Answer

Use | where status=401 | top limit=100 region

Question 2

A security analyst needs to correlate authentication events from multiple Windows domain controllers to identify failed logon attempts from a specific user account, and then enrich the results with the user's department and manager from an HR database. Which TWO Splunk features should the analyst use?

Accepted Answer

Data model acceleration. Option B (Data model acceleration) is correct because accelerated data models let the analyst run fast, repeated searches over large volumes of Windows Security event data (e.g., EventCode 4625 failed logons) from multiple domain controllers, which is essential for efficiently correlating authentication events across many hosts. Option D (Lookup definition) is correct because a lookup definition (configured in Settings > Lookups) maps the user account field in the event data to external HR data such as department and manager, enabling the enrichment step described in the scenario. Option A (Time-based lookup) is not appropriate here because it is used to return a value based on when a search runs (e.g., current shift or holiday), not to join user identity to HR attributes. Option C (Subsearch) is not the right fit because a subsearch is used to feed results of one search into another as a filter or argument, not to enrich events with external reference data. Option E (Calculated field) is incorrect because it derives a new field from existing fields via an eval expression, but it cannot pull in department and manager values from an external HR database.

Answer

Time-based lookup

Answer

Subsearch

Answer

Calculated field

Question 3

A large e-commerce company uses Splunk to monitor its web application performance. The operations team has created a dashboard with a timechart showing the 95th percentile of page load times over the last 24 hours. Recently, the dashboard stopped showing data for the last hour. The Splunk administrator confirms that the index is receiving data and the sourcetype is correctly configured. The search string is:

`index=web_app sourcetype=access_combined earliest=-24h@h latest=@h | timechart perc95(page_load_time) by host`

The dashboard panel uses a base search and a post-process search. The base search is:

`index=web_app sourcetype=access_combined earliest=-7d@d latest=@h`

What is the most likely cause of the missing last hour of data?

Accepted Answer

The base search time range is set to latest=@h, which excludes data from the current partial hour.. The base search uses `latest=@h`, which snaps the end time to the beginning of the current hour (e.g., 14:00:00), excluding any data from the current partial hour (e.g., 14:00:01 to 14:59:59). Since the dashboard panel relies on this base search, the post-process search inherits that time range, causing the last hour of data to be missing even though the index is actively receiving data.

Answer

The post-process search has a time range override that conflicts with the base search.

Answer

The base search uses a macro that is not defined in the app context.

Answer

The index is not being searched because the base search uses a wrong sourcetype.

Question 4

Arrange the steps to create a scheduled report in Splunk in the correct order.

Accepted Answer

Run a search, Save as report, Set schedule, Set time range. Scheduled reports require saving a search as a report, then configuring its schedule and time range.

Answer

Run a search, Set schedule, Save as report, Set time range

Answer

Set schedule, Run a search, Save as report, Set time range

Answer

Run a search, Save as report, Set time range, Set schedule

Question 5

Arrange the steps to configure a lookup table file in Splunk.

Accepted Answer

Upload the lookup file to Splunk via Settings > Lookups > Lookup table files > New, then define the lookup table file by specifying the filename and options.. Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Answer

Define the lookup table file first via Settings > Lookups > Lookup table files, then upload the file.

Answer

Create a lookup definition first via Settings > Lookups > Lookup definitions, then upload the file, then define the lookup table file.

Answer

Upload the file to a custom directory, then create a lookup definition without defining the lookup table file.

Question 6

Match each Splunk role to its typical permission level.

Accepted Answer

admin: Full access to all Splunk features. Splunk roles determine user permissions: admin grants full access, power allows most features except administrative functions, and user restricts to own data and basic searches.

Answer

admin: Access to only search and reports

Answer

power: Full access to all Splunk features

Question 7

An analyst needs to add a field called 'Region' to events based on a lookup table that maps 'StoreID' to 'Region'. The lookup table is defined in transforms.conf as a CSV lookup. Which command should be used in the search to perform this enrichment?

Accepted Answer

lookup. The lookup command is used to enrich events with fields from a lookup table. When a lookup table is defined in transforms.conf as a CSV lookup, the lookup command can reference it to match fields (e.g., StoreID) and add the corresponding fields (e.g., Region) to the events. This is the standard way to perform field enrichment in Splunk.

Answer

inputlookp

Answer

outputlookp

Answer

table

Question 8

A search includes a lookup that is used for every event. The lookup file has 500,000 rows. The search is running slowly. Which change could improve performance?

Accepted Answer

Use the lookup command with output fields limited to needed fields. Limiting output fields reduces data transfer and can improve lookup performance. KV Store may help but requires extra setup.

Answer

Use the stats command instead of lookup

Answer

Convert the lookup to a KV Store lookup

Answer

Use the inputlookp command with append=t

Answer

Increase the max_match in the lookup definition

Question 9

A lookup table maps combinations of 'source_ip' and 'dest_port' to a 'policy' field. The lookup is defined in transforms.conf with a max_match of 1. Which lookup command syntax will correctly perform the lookup?

Accepted Answer

lookup policy_lookup source_ip dest_port OUTPUT policy. The lookup command takes a space-separated list of event fields to match against lookup fields in order.

Answer

lookup policy_lookup source_ip dest_port

Answer

lookup policy_lookup (source_ip, dest_port) OUTPUT policy

Answer

lookup policy_lookup source_ip, dest_port OUTPUT policy

Question 10

A lookup is not returning any results even though the search events contain the matching field. The lookup definition in transforms.conf includes 'default_match = false'. What is the most likely issue?

Accepted Answer

The lookup is case-sensitive and the event fields have different case. Lookups are case-sensitive by default; if event fields have different case than lookup fields, no match occurs. default_match=false causes no default value on mismatch.

Answer

The lookup has a time restriction that excludes the events

Answer

The lookup field names do not match the event field names

Answer

The lookup command is missing the 'OUTPUT' clause

Answer

The lookup file is empty

Question 11

During peak hours, a search that uses a KV Store lookup frequently times out. The search runs on daily data but the KV Store collection has millions of records. Which approach is most effective to reduce lookup time while maintaining data freshness?

Accepted Answer

Pre-compute the lookup results using a scheduled search and write to a CSV, then use the CSV lookup. Pre-computing lookup results into a smaller CSV that is refreshed frequently can improve performance while keeping data up-to-date.

Answer

Increase the KV Store collection's replication factor

Answer

Reduce the fields stored in the KV Store collection

Answer

Use the 'lookup' command with the 'local=t' option

Question 12

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Accepted Answer

Time-based lookup. Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Answer

File lookup

Answer

CSV lookup

Answer

External lookup

Question 13

Which two methods can reduce the resource consumption of a large CSV lookup in Splunk? (Choose 2)

Accepted Answer

Use the lookup command to only return required fields. Option D is correct because using the lookup command with only the required fields returned (rather than all fields from the CSV) reduces the amount of data processed and returned per event, lowering memory and CPU consumption during the lookup. Option E is correct because migrating the lookup to a KV Store lookup with a smaller, curated data set reduces the size of the lookup table that must be loaded and searched, which decreases resource usage compared to a large CSV-based lookup. Option A is not correct because gzipping a CSV only reduces storage size and does not reduce the in-memory resource consumption when Splunk loads and matches the lookup. Option B is not correct because increasing max_match allows more matches per event, which increases rather than reduces resource consumption. Option C is not correct because a time-based lookup limits matches by time but does not inherently reduce the resource consumption of a large CSV lookup.

Answer

Convert the CSV to a gzip file and reference it

Answer

Increase the max_match parameter

Answer

Use a time-based lookup to limit matches by time

Question 14

An analyst runs a search with the command 'lookup region_lookup region_code OUTPUT region_name'. The events have a region_code field with values like 'us-east' and 'eu-west'. The lookup file contains 'US-EAST' and 'EU-WEST'. The lookup returns no results. What is the most likely cause?

Accepted Answer

The case_sensitive_match is set to true. The lookup is case-sensitive ('Case_sensitive_match = true'), and the event fields have lowercase values while the lookup file has uppercase, causing no match.

Answer

The lookup file format is incorrect

Answer

The default_match setting prevents missing matches

Answer

The match_type is WILDCARD but no wildcards used

Answer

The max_match setting limits results

Question 15

The search returns a timechart with multiple series but the series colors are all the same. What is the most likely reason?

Accepted Answer

The number of distinct description values exceeds the default color palette. If the number of distinct description values exceeds the default color palette (typically 10), colors will repeat. This is a common issue with many series.

Answer

The 'timechart' command cannot handle multiple series from a lookup

Answer

The lookup should be performed before the eval

Answer

The 'eval' command is misspelled (status=code instead of status_code?)

Answer

The lookup is not working correctly