SPLK-1002 Advanced Visualization and Lookups Practice Test 3 — 15 Questions

Question 1

A security analyst needs to enrich authentication logs with employee department information stored in a CSV file called 'employees.csv'. The CSV has fields: 'emp_id', 'name', 'department'. The authentication logs contain a field 'user_id' that matches 'emp_id'. Which search correctly enriches the events with the department field?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

`index=auth | lookup employees.csv emp_id AS user_id OUTPUT department`. It uses the proper lookup syntax: `lookup

AS OUTPUT `. Here, `employees.csv emp_id AS user_id` maps the lookup field `emp_id` to the event field `user_id`, and outputs the `department` field. Option A incorrectly maps `user_id` to `emp_id`, which would look for a lookup field `user_id` and rename it, but the lookup table column is `emp_id`, so it will not match correctly. Option C has the same mapping error as A, and additionally outputs `name`, which is not required. Option D uses `inputlookup` which returns the contents of the lookup table, not enriching the events with a join.

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department`

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department, name`

Answer

`index=auth | inputlookup employees.csv where user_id=emp_id | table *`

Question 2

A lookup definition is correctly configured, but when used in a search, no results are returned. The lookup file exists and contains data. What is the most likely cause?

Accepted Answer

The lookup definition has the wrong case sensitivity setting.. The lookup definition's case sensitivity setting controls whether the lookup matches field values exactly as they appear in the lookup file. If the definition is set to case-sensitive but the search field values differ in case from the lookup file, no matches will occur. This is the most likely cause when the lookup file exists, contains data, and the definition is otherwise correctly configured.

Answer

The lookup file has too many fields.

Answer

The lookup file is in JSON format but the definition expects CSV.

Answer

The search time field extraction for the matching field is disabled.

Question 3

Which TWO of the following are best practices when creating lookup table files?

Accepted Answer

Ensure the lookup file is in CSV format with the .csv extension.. Options B and D are correct best practices when creating lookup table files. B is correct because lookup files should be in CSV format with a .csv extension for proper parsing. D is correct because placing the lookup file in the $SPLUNK_HOME/etc/apps/search/lookups directory ensures it is accessible within the app. A is incorrect because header rows with spaces in field names can cause issues; use underscores instead. C is incorrect because automatic lookup refresh is not a best practice for the creation of lookup files; it is configured separately and not related to file creation. E is incorrect because using full paths in the lookup definition is not recommended; relative paths within the app directory are preferred.

Answer

Use header rows with spaces in field names for readability.

Answer

Enable automatic lookup refresh for frequently updated files.

Answer

Use full paths in the lookup definition.

Question 4

Which THREE steps are necessary to create a file-based lookup?

Accepted Answer

Upload the lookup file to the correct directory.. Option A is correct because a file-based lookup requires the CSV (or other supported) lookup file to be placed in the appropriate lookup directory, such as $SPLUNK_HOME/etc/apps/<app>/lookups/, so Splunk can find it. Option B is correct because transforms.conf is where you define the lookup definition stanza (e.g., [my_lookup]) with filename = my_lookup.csv, which tells Splunk which file to use and how to interpret it. Option E is correct because after adding or modifying lookup files and transforms.conf definitions, Splunk must be restarted (or the configuration reloaded) for the changes to take effect. Option C is incorrect because props.conf is used for field extractions, event processing, and automatic lookup references, not for defining the lookup itself. Option D is incorrect because an automatic lookup in props.conf is an optional enhancement that runs a lookup automatically at search time; it is not required to create a basic file-based lookup.

Answer

Create a lookup definition in props.conf.

Answer

Define an automatic lookup in props.conf.

Question 5

Which statement best describes the search result?

Accepted Answer

It returns the count of events where the price is greater than 100, grouped by product_name.. The search uses a lookup to enrich events with a 'price' field from an external lookup table, then filters with 'price > 100' and aggregates with 'stats count by product_name'. Because 'stats count by product_name' counts the number of events per product_name, the result is the count of events where the enriched price exceeds 100, grouped by product_name. The lookup provides the price field, so no error occurs, and the count is of events, not distinct product_ids.

Answer

It returns an error because price is not a field before the lookup.

Answer

It returns the count of distinct product_ids that have a price > 100.

Answer

It returns the count of successful web events, but only for products with price > 100.

Question 6

An analyst needs to create a time-series chart showing the percentage of total HTTP status codes per day. Which approach is most efficient?

Accepted Answer

timechart count by status | eventstats sum(count) as total by _time | eval pct = round(count/total*100,2) | chart first(pct) over _time by status. Using timechart to get counts by status, then eventstats to compute total per day, and eval to calculate percentage, is efficient and clear. Option B is incorrect because using chart with a single stats command cannot compute percentages across groups per time bucket. Option C is incorrect because addtotals adds overall totals but does not compute per-day percentages. Option D is incorrect because overcomplicates with subsearches.

Answer

chart count by status over _time | eval pct = count / sum(count) * 100

Answer

timechart count by status | addtotals | eval pct = count / total * 100

Answer

timechart count by status | append [timechart count] | eval pct = count / [| timechart count] * 100

Question 7

A network engineer wants to add geographic location (city, country) to firewall logs based on source IP. Which lookup type is most appropriate?

Accepted Answer

File-based lookup (CSV). A file-based lookup (CSV) is the most appropriate because geographic location data (city, country) mapped from source IP is static reference data that can be maintained in a CSV file and uploaded to Splunk. This lookup can then be used in search to enrich firewall logs with location information. It is simple, efficient, and does not require external scripts or KV Store.

Answer

KV Store lookup

Answer

Scripted lookup

Answer

Automatic lookup configured in props.conf

Question 8

An automatic lookup is configured in props.conf and transforms.conf, but the expected fields are not appearing in search results. Which is the first thing to verify?

Accepted Answer

Verify the transforms.conf definition for the lookup. The first step to troubleshoot an automatic lookup is to verify the transforms.conf definition, ensuring that the lookup table name, file path, and field mappings are correctly specified. Option B is incorrect because manually running the lookup command is a diagnostic step that comes after verifying the configuration. Option C is incorrect because the source field extraction is not directly related to automatic lookup functionality; the lookup is based on field values, not extraction. Option D is incorrect because read permissions on the lookup table would typically cause an error message, not a silent failure of fields appearing.

Answer

Run a search using the lookup command manually to test

Answer

Verify that the source field is extracted at search time

Answer

Verify that the user has read permissions on the lookup table

Question 9

A dashboard developer wants to color-code the bars in a column chart based on a severity field (critical=red, high=orange, medium=yellow, low=green). How can this be achieved?

Accepted Answer

Use the chart command with 'useColors=true' and specify a color palette or use Eval to create a color field. In Splunk, to color-code a chart based on a field like severity, you can use the `eval` command to create a color field that maps severity values to color names (e.g., `| eval color=case(severity="critical","red", severity="high","orange", ...)`), and then use that field in the chart's visualization options for color. The `chart` command itself does not have a `useColors=true` parameter; the phrase refers to a conceptual use of color palettes or visualization settings. Option A is incorrect because drilldown is for navigation, not coloring. Option C is incorrect because the `overlay` option overlays a second chart, not for color coding. Option D is incorrect because CSS is not the standard method for dynamic field-based coloring in Simple XML dashboards.

Answer

Configure drilldown to change colors when clicked

Answer

Use the 'overlay' option in the chart command

Answer

Add CSS styling to the Simple XML dashboard

Question 10

Which THREE practices improve lookup performance in Splunk? (Select three.)

Accepted Answer

Use KV Store lookups for data that is updated frequently. Option B is correct because KV Store lookups are designed for frequently updated data and provide fast, indexed key-value access without reloading a whole file, making them ideal for dynamic enrichment. Option D is correct because index-time lookups apply static reference data (e.g., a rarely changing host-to-owner mapping) once during indexing, so the enrichment is already present at search time and no per-search lookup cost is incurred. Option E is correct because keeping lookup files small and focused reduces the amount of data Splunk must load and match at search time, directly improving lookup performance. Option A is not correct because large CSV files used as automatic lookups add heavy per-search overhead and are not suited to always-current data. Option C is not correct because the 'format' command is used to prepare search results for subsearch usage, not to reduce lookup size or improve lookup performance.

Answer

Use large CSV files configured as automatic lookups for always-current data

Answer

Apply formatting options like 'format' command to reduce lookup size

Question 11

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

Accepted Answer

city and country are set to 'NotFound'. When a source IP does not match any entry in geo.csv, the lookup command in Splunk adds the default values specified in the lookup definition. In this case, the lookup definition sets the default values for city and country to 'NotFound'. Therefore, the event will have city='NotFound' and country='NotFound' added.

Answer

The search fails with an error

Answer

No fields are added

Answer

city and country are set to empty strings

Question 12

Refer to the exhibit. What happens when a user clicks on a status value in the table?

Accepted Answer

The chart updates to show methods for that status. In Splunk dashboards, clicking a table cell that has a token set via <set> or drilldown updates the token, which is then used by the chart's search. The exhibit shows the chart's search referencing the clicked status token, so the chart re-renders to show methods for the selected status. The table itself is not filtered by this token, so only the chart updates.

Answer

Nothing happens; the token is not used

Answer

Both the table and chart update

Answer

The table filters to show only events with that status

Question 13

A company needs to enrich search results with additional fields from a CSV file. Which method should they use to define the lookup table so that it is available in all searches?

Accepted Answer

Define the lookup in transforms.conf with a filename and field mapping.. Defining the lookup in transforms.conf with a filename and field mapping creates a lookup definition that can be referenced by name in any search across the Splunk deployment. This makes the lookup table available globally (or per app) so users can invoke it with the lookup command without specifying the file path each time.

Answer

Define the lookup in props.conf with an automatic lookup stanza.

Answer

Use the inputlookup command in a search.

Answer

Use the lookup command with the file path.

Answer

Use the eval command with the lookup function directly in search.

Question 14

A lookup table file contains 10GB of data. When performing a lookup using the lookup command, search performance is extremely slow. Which approach will most effectively improve performance without losing functionality?

Accepted Answer

Convert the lookup to a KV store lookup.. Converting a large CSV lookup to a KV store lookup is the most effective performance improvement because KV store lookups use an indexed, persistent database (MongoDB-backed) that supports efficient key-based retrieval, whereas CSV lookups are loaded into memory and can be slow for large files. KV store lookups also support replication and can handle large datasets without the memory constraints of CSV lookups. This preserves full lookup functionality while dramatically improving search performance.

Answer

Split the lookup into multiple smaller files and use a chain of lookups.

Answer

Use the inputlookup command to load the entire table into memory.

Answer

Set the max_memtable_bytes in limits.conf to increase memory.

Answer

Create a time-based lookup with limited time range.

Question 15

A search produces a table with many rows. Which visualization type is best suited to show the distribution of a single field's values?

Accepted Answer

Pie chart. A pie chart is designed to show the distribution of a single field's values as proportional slices of a whole. In Splunk, when you have a table with many rows and want to visualize how a single field's values break down (e.g., count by status code), a pie chart directly displays each distinct value's relative contribution. This makes it the best choice for distribution analysis of one field.

Answer

Area chart

Answer

Scatter chart

Answer

Line chart