SPLK-1002 Advanced Visualization and Lookups Practice Test 3 — 15 Questions

Question 1

Arrange the steps to create a scheduled report in Splunk in the correct order.

Accepted Answer

Run a search, Save as report, Set schedule, Set time range. Scheduled reports require saving a search as a report, then configuring its schedule and time range.

Answer

Run a search, Set schedule, Save as report, Set time range

Answer

Set schedule, Run a search, Save as report, Set time range

Answer

Run a search, Save as report, Set time range, Set schedule

Question 2

Arrange the steps to configure a lookup table file in Splunk.

Accepted Answer

Upload the lookup file to Splunk via Settings > Lookups > Lookup table files > New, then define the lookup table file by specifying the filename and options.. Lookups require uploading the file, then defining the lookup table file in Splunk settings.

Answer

Define the lookup table file first via Settings > Lookups > Lookup table files, then upload the file.

Answer

Create a lookup definition first via Settings > Lookups > Lookup definitions, then upload the file, then define the lookup table file.

Answer

Upload the file to a custom directory, then create a lookup definition without defining the lookup table file.

Question 3

Match each Splunk role to its typical permission level.

Accepted Answer

admin: Full access to all Splunk features. Splunk roles determine user permissions: admin grants full access, power allows most features except administrative functions, and user restricts to own data and basic searches.

Answer

admin: Access to only search and reports

Answer

power: Full access to all Splunk features

Question 4

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 5

An analyst needs to add a field called 'Region' to events based on a lookup table that maps 'StoreID' to 'Region'. The lookup table is defined in transforms.conf as a CSV lookup. Which command should be used in the search to perform this enrichment?

Accepted Answer

lookup. The lookup command enriches events with fields from a lookup table. inputlookp reads a lookup as results, outputlookp writes events to a lookup, others are irrelevant.

Answer

inputlookp

Answer

outputlookp

Answer

table

Question 6

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

Accepted Answer

Time-based lookup. Time-based lookups use event time to match against time ranges in the lookup table.

Answer

CSV lookup

Answer

KV Store lookup

Answer

External lookup

Question 7

A dashboard developer wants to display the count of errors over the last 24 hours with a line chart. Which search command should be the final command before the visualization?

Accepted Answer

timechart. timechart automatically creates a time-based chart suitable for line chart visualization without additional formatting.

Answer

chart

Answer

trendline

Answer

stats

Question 8

A search includes a lookup that is used for every event. The lookup file has 500,000 rows. The search is running slowly. Which change could improve performance?

Accepted Answer

Use the lookup command with output fields limited to needed fields. Limiting output fields reduces data transfer and can improve lookup performance. KV Store may help but requires extra setup.

Answer

Use the stats command instead of lookup

Answer

Convert the lookup to a KV Store lookup

Answer

Use the inputlookp command with append=t

Answer

Increase the max_match in the lookup definition

Question 9

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart

Question 10

A lookup table maps combinations of 'source_ip' and 'dest_port' to a 'policy' field. The lookup is defined in transforms.conf with a max_match of 1. Which lookup command syntax will correctly perform the lookup?

Accepted Answer

lookup policy_lookup source_ip dest_port OUTPUT policy. The lookup command takes a space-separated list of event fields to match against lookup fields in order.

Answer

lookup policy_lookup source_ip dest_port

Answer

lookup policy_lookup (source_ip, dest_port) OUTPUT policy

Answer

lookup policy_lookup source_ip, dest_port OUTPUT policy

Question 11

A team wants to create a custom visualization that requires JavaScript and CSS modifications. Which Splunk feature should be used?

Accepted Answer

Custom visualization framework. The Custom Visualization Framework (option D) is the correct choice because it is the only Splunk feature that allows developers to create entirely new visualizations using JavaScript and CSS. This framework provides the necessary APIs and hooks to register custom visualization types that can then be used in dashboards, whereas the other options either restrict customization or do not support custom JavaScript/CSS modifications.

Answer

Splunk Web Framework

Answer

Simple XML dashboard

Answer

Dashboard studio

Question 12

A lookup is not returning any results even though the search events contain the matching field. The lookup definition in transforms.conf includes 'default_match = false'. What is the most likely issue?

Accepted Answer

The lookup is case-sensitive and the event fields have different case. Lookups are case-sensitive by default; if event fields have different case than lookup fields, no match occurs. default_match=false causes no default value on mismatch.

Answer

The lookup has a time restriction that excludes the events

Answer

The lookup field names do not match the event field names

Answer

The lookup command is missing the 'OUTPUT' clause

Answer

The lookup file is empty

Question 13

During peak hours, a search that uses a KV Store lookup frequently times out. The search runs on daily data but the KV Store collection has millions of records. Which approach is most effective to reduce lookup time while maintaining data freshness?

Accepted Answer

Pre-compute the lookup results using a scheduled search and write to a CSV, then use the CSV lookup. Pre-computing lookup results into a smaller CSV that is refreshed frequently can improve performance while keeping data up-to-date.

Answer

Increase the KV Store collection's replication factor

Answer

Reduce the fields stored in the KV Store collection

Answer

Use the 'lookup' command with the 'local=t' option

Question 14

Which two lookup types in Splunk support automatic time-based matching? (Choose 2)

Accepted Answer

Time-based lookup. Time-based lookup (Option A) is correct because it explicitly supports automatic time-based matching by allowing you to define a time range in the lookup definition, which Splunk uses to correlate events based on timestamps. KV Store lookup (Option E) is correct because it supports automatic time-based matching through the `time_field` and `time_format` settings in the lookup definition, enabling Splunk to match events based on time ranges stored in the KV Store collection.

Answer

File lookup

Answer

CSV lookup

Answer

External lookup

Question 15

Which three considerations are important when creating a visualization for a dashboard that will be displayed on a large monitor? (Choose 3)

Accepted Answer

Ensure the chart type is appropriate for the data. High contrast improves readability, appropriate chart type is fundamental, and drill-down actions provide interactive details. Small fonts and minimizing data points are detrimental.

Answer

Use small font sizes to fit more information

Answer

Minimize the number of data points