SPLK-1002 Advanced Visualization and Lookups Practice Test 4 — 15 Questions

Question 1

A lookup configured with WILDCARD match_type for pattern '10.*.25' is not matching some events. Which of the following event values would NOT be matched by this lookup?

Accepted Answer

10.1.25.1. The wildcard pattern '10.*.25' matches any value that starts with '10.' and ends with '.25', with any characters (including none) in between due to the wildcard '*'. Options A (10.1.2.25), C (10.1.25), D (10.2.25), and E (10.10.25) all start with '10.' and end with '.25', so they match. Option B (10.1.25.1) ends with '.1', not '.25', so it does not match the pattern. Therefore, option B is the value that would NOT be matched.

Answer

10.1.2.25

Answer

10.1.25

Answer

10.2.25

Answer

10.10.25

Question 2

An admin wants to create a dashboard that shows the count of errors by sourcetype over the last 7 days, with the ability to click on a sourcetype to drill down to a detailed search. Which visualization and configuration supports this?

Accepted Answer

Use a bar chart and set the 'drilldown' option to 'search' in the dashboard XML.. A bar chart is the appropriate visualization for comparing a categorical metric (count of errors) across discrete categories (sourcetypes), and drilldown is configured in the dashboard's XML via the element with or . Setting drilldown to 'search' allows a click on a bar to launch a new search filtered by that sourcetype, which is exactly the requested behavior.

Answer

Use a line chart and set the 'drilldown' to 'search' in the search command.

Answer

Use a pie chart and set the 'drilldown' option to 'search' in the dashboard XML.

Answer

Use a table and set the 'link' in search string.

Question 3

An admin creates a dashboard with a timechart panel that drills down to a search for that time range. The drilldown search works but does not include the time range. What is the likely cause?

Accepted Answer

The drilldown is set to 'search' without including tokens for time.. In Splunk Simple XML dashboards, a drilldown configured as type 'search' does not automatically inherit the panel's time range; the search string must explicitly reference the time tokens (for example, $earliest$ and $latest$, or the $time.earliest$ and $time.latest$ tokens) to carry the selected time range into the target search. Without those tokens, the drilldown search runs against the default time range, which is why the time range appears to be missing.

Answer

The timechart uses a fixed time range in the search string.

Answer

The dashboard's time input is disabled.

Answer

The drilldown is configured to use 'range' token but the panel's time range is not passed.

Question 4

Which TWO configurations are required to create a geospatial visualization of server locations?

Accepted Answer

A mappings.json file in the app directory.. Option C is correct because a mappings.json file placed in the app directory (typically under appserver/static or the visualization's directory) defines how geographic feature codes such as country codes, region codes, or coordinates are mapped to shapes or points, which the geospatial visualization requires to render locations. Option D is correct because a lookup table containing latitude and longitude fields supplies the precise coordinates needed to plot each server's location on the map. Together, the mappings.json provides the geographic definitions and the lat/long lookup provides the actual positional data for the visualization. Option A is not required because a sourcetype containing country codes alone lacks the coordinate or mapping definitions needed for plotting. Option B is not required because an index holding geographic data is too generic and does not by itself provide the mappings.json or lat/long lookup the visualization needs. Option E is not required because the geostats command is a search command for aggregating geographic statistics, not a configuration element for creating the visualization.

Answer

A sourcetype that includes country codes.

Answer

An index that contains geographic data.

Answer

The use of the geostats command.

Question 5

Which TWO components must be configured to enable an automatic lookup that populates fields at index time?

Accepted Answer

transforms.conf to define the lookup table and the field mapping.. Option A is correct because transforms.conf is where you define the lookup definition (the stanza that names the lookup table file and maps its columns to event fields), which is required for any automatic lookup to know what table to use and how to populate fields. Option D is correct because props.conf is where you add the automatic lookup stanza (e.g., LOOKUP- = AS OUTPUT ) under the appropriate sourcetype, host, or source, which is what actually triggers the lookup to run at index time. Option B is not required because placing the file in the lookup directory is a prerequisite for the table to exist, but it is not a configuration component that enables the automatic lookup behavior itself. Option C is incorrect because indexes.conf does not enable lookup acceleration; lookup acceleration is configured in transforms.conf (or via the Lookups UI) and is unrelated to enabling an automatic lookup. Option E is incorrect because automatic lookups can be defined through configuration files (props.conf and transforms.conf) and are not limited to the Splunk Web Lookups menu.

Answer

The lookup table file must be placed in the lookup directory of the app.

Answer

indexes.conf to enable lookup acceleration.

Answer

The lookup must be defined via the Lookups menu in Splunk Web only.

Question 6

Which THREE of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Use the REST API to upload a CSV file.. Option A is correct because Splunk's REST API (e.g., POST to /servicesNS///data/lookup-table-files or /data/transforms/lookups) allows you to programmatically upload a CSV file and register it as a lookup table definition. Option C is correct because the Settings > Lookups menu in Splunk Web provides a UI workflow to upload a CSV file and define it as a lookup table, which is the standard GUI method. Option D is correct because the 'outputlookup' command writes the results of a search to a lookup file (e.g., | outputlookup mylookup.csv), creating or updating a lookup table. Option B is not correct because props.conf is used for field extractions, transforms, and lookup *references* (via LOOKUP- stanzas), not for defining a lookup table file itself; lookup definitions belong in transforms.conf. Option E is not correct because 'inputlookup' only reads an existing lookup file into a search; it cannot create a new lookup file.

Answer

Define a lookup in props.conf with a filename.

Answer

Use the 'inputlookup' command to create a new file.

Question 7

An analyst runs this search and gets no results. The lookup file server_list.csv exists and contains data. What is the most likely issue?

Accepted Answer

The field names in the CSV do not match the search fields.. The search likely uses fields (e.g., status, hostname, ip_address) that do not match the column headers in server_list.csv. The inputlookup command returns results only if field names align; a mismatch leads to no output. Other options are less likely: the file exists so it is in the correct directory (A); index specification is irrelevant for lookups (C); inputlookup is appropriate for inline lookups (D).

Answer

The lookup file is not in the correct lookup directory.

Answer

The search should include an index specification.

Answer

The search should use 'lookup' instead of 'inputlookup'.

Question 8

An admin configured an automatic lookup but events for mysourcetype are not being enriched. What is the most likely problem?

Accepted Answer

The match_type should be 'EXACT' instead of 'WILDCARD'.. Automatic lookups in Splunk are configured via a LOOKUP-<name> stanza in props.conf that references a lookup definition in transforms.conf. The match_type setting in transforms.conf controls how field values are matched against the lookup table. When match_type is set to WILDCARD, Splunk performs wildcard matching, which requires the lookup table to contain wildcard patterns (e.g., '10.10.*') and is significantly slower and more resource-intensive. For typical automatic lookups that enrich events based on exact field values (e.g., matching a user ID or IP address), the default and correct setting is EXACT. If match_type is incorrectly set to WILDCARD, Splunk will attempt wildcard matching, which will fail to match normal exact values unless the lookup table itself contains wildcards, resulting in no enrichment. Therefore, the most likely problem is that match_type should be EXACT instead of WILDCARD.

Answer

The lookup file is too large and memory limit is exceeded.

Answer

The LOOKUP stanza in props.conf is missing the input field specification.

Answer

The lookup is defined in transforms.conf but not referenced in any search.

Question 9

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 10

An IT administrator notices that a lookup table used to enrich firewall logs is not updating correctly. The lookup file is stored in $SPLUNK_HOME/etc/apps/search/lookups/. What is the most likely cause if the lookup is defined as a 'file-based lookup' with automatic lookup?

Accepted Answer

The lookup filename contains a space character. Splunk lookup definitions and automatic lookups can fail if the lookup filename contains a space character, because the lookup stanza in transforms.conf may not correctly parse the filename, leading to the lookup not being applied. This is a common cause of lookup tables not updating correctly when the file is otherwise valid.

Answer

The lookup file is too large (over 100 MB)

Answer

The lookup is not referenced in any search

Answer

The lookup file permissions are set to read-only

Question 11

A team is designing a dashboard to monitor real-time server CPU utilization. They want to update every 10 seconds and use a gauge visualization. What is the best search mode to use for real-time performance?

Accepted Answer

Fast mode. Fast mode is correct because it disables field extraction and event pattern detection, which are unnecessary for a gauge visualization that only needs aggregated CPU metrics. This reduces search overhead significantly, allowing the dashboard to refresh every 10 seconds without performance degradation. For real-time dashboards, Fast mode provides the best balance of speed and functionality when the underlying data is already structured or when only statistical aggregations are required.

Answer

Smart mode

Answer

Real-time mode

Answer

Verbose mode

Question 12

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

Accepted Answer

Define the lookup in transforms.conf and props.conf. To create a dynamic lookup that automatically updates from a CSV file, you must define the lookup in transforms.conf (to specify the filename, fields, and lookup type) and reference it in props.conf (to associate the lookup with a source type, host, or other field). This configuration enables Splunk to automatically apply the lookup during search time without manual intervention, and the CSV file can be updated externally, with changes reflected in subsequent searches. The combination of transforms.conf and props.conf is essential for automatic lookup functionality.

Answer

Use the lookup command in searches

Answer

Upload the CSV to the lookups folder only

Answer

Only define in transforms.conf

Question 13

A dashboard uses a drop-down input to select a server. The drop-down is populated by a search that returns server names. Which setting ensures that the drop-down updates automatically when the underlying data changes?

Accepted Answer

Change the 'refresh' setting on the input. In Splunk dashboards, the 'refresh' setting on an input controls how often the input's search re-runs to repopulate its choices. Setting a refresh interval (e.g., '30s' or '1m') causes the drop-down to automatically re-execute its populating search and update the available options when the underlying data changes. This is distinct from 'search on change,' which controls whether selecting a value triggers dependent searches.

Answer

Set the 'delay' option

Answer

Use a token filter

Answer

Enable 'search on change'

Question 14

An administrator is designing a dashboard with multiple panels that share a common time picker. Which THREE dashboard features can be used to synchronize time across panels?

Accepted Answer

Use the $time_token$ variable in panel searches. Option B is correct because the $time_token$ variable (a time token) can be referenced inside each panel's search, so every panel resolves its time range from the same shared token value. Option C is correct because a single time input that emits a token lets all panels consume that one token, giving them a synchronized time window from one control. Option E is correct because using the earliest and latest fields bound to a shared token passes the same time boundaries into every panel's search, keeping them aligned. Option A is not a real dashboard feature for time synchronization, and Option D is the opposite of synchronization because independent per-panel time ranges deliberately desynchronize the panels.

Answer

Use the 'link time' option in dashboard editor

Answer

Set each panel's time range independently

Question 15

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

Accepted Answer

The match_type should be 'match_type = cidr' without brackets. In transforms.conf, the CIDR match lookup requires the setting 'match_type = cidr' to be written as a proper key-value pair. The exhibit shows the value wrapped in brackets (e.g., '[cidr]'), which Splunk interprets as a literal value rather than the CIDR matching mode, so the lookup falls back to default exact-match behavior and never matches IP ranges. Removing the brackets so the stanza reads 'match_type = cidr' enables CIDR-based matching against the lookup file.

Answer

The max_matches setting should be 0

Answer

The filename should include the full path

Answer

The stanza name should be 'geo_ip' without brackets