SPLK-1003 Advanced Visualization and Lookups Practice Test 4 — 15 Questions

Question 1

What action can the administrator take to resolve this warning?

Accepted Answer

Increase the max_mem_usage_mb setting in limits.conf. The error indicates the lookup file exceeds the maximum memory allocation. Increasing the max_mem_usage_mb setting in limits.conf allows loading larger files.

Answer

Split the lookup into multiple smaller files

Answer

Convert the lookup to a KV Store lookup

Answer

Increase max_match in the lookup definition

Answer

Use the lookup command with local=t

Question 2

A security analyst needs to enrich authentication logs with employee department information stored in a CSV file called 'employees.csv'. The CSV has fields: 'emp_id', 'name', 'department'. The authentication logs contain a field 'user_id' that matches 'emp_id'. Which search correctly enriches the events with the department field?

Accepted Answer

`index=auth | lookup employees.csv emp_id AS user_id OUTPUT department`. Option D is correct because it uses the correct lookup syntax: `lookup

AS OUTPUT `. Here, `emp_id AS user_id` maps the lookup field emp_id to the search field user_id. Option A and B reverse the mapping, and option C uses inputlookup incorrectly which returns the lookup table contents rather than enriching events.

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department`

Answer

`index=auth | lookup employees.csv user_id AS emp_id OUTPUT department, name`

Answer

`index=auth | inputlookup employees.csv where user_id=emp_id | table *`

Question 3

A Splunk administrator wants to create a static lookup table from a search result. Which approach is recommended?

Accepted Answer

Use the `outputlookup` command to save the search result as a CSV file.. Option A is correct. The outputlookup command is designed to save search results directly to a CSV file in the lookups directory. Option B is manual and error-prone. Option C, inputlookup, reads a lookup file. Option D, lookup, applies a lookup but does not create a file.

Answer

Use `inputlookup` to write to a CSV file.

Answer

Use the `lookup` command to create the file.

Answer

Manually copy the results into a spreadsheet and upload as CSV.

Question 4

A lookup definition is correctly configured, but when used in a search, no results are returned. The lookup file exists and contains data. What is the most likely cause?

Accepted Answer

The lookup definition has the wrong case sensitivity setting.. Option B is correct because case sensitivity mismatch is a common issue: if the lookup definition expects exact case but the search field has different case, no match occurs. Option A is unlikely as too many fields do not prevent matching. Option C, disabling field extraction, would affect other parts but not lookup matching directly. Option D, format mismatch, would cause an error, not silently return no results.

Answer

The lookup file has too many fields.

Answer

The lookup file is in JSON format but the definition expects CSV.

Answer

The search time field extraction for the matching field is disabled.

Question 5

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

Accepted Answer

It defines the time interval for each data point (1 hour).. Option C is correct. The span argument defines the time interval for each data point in the timechart. Here, span=1h means each bucket represents one hour. Option A is incorrect because it says 1-minute. Option B is misleading because the time range is set by the search time picker, not span. Option D is incorrect because the 'by' clause handles splitting, not span.

Answer

It limits the number of status values displayed.

Answer

It groups events into 1-minute intervals.

Answer

It sets the time range of the chart.

Question 6

Which of the following is a recommended practice when creating a lookup table file?

Accepted Answer

Include a header row with field names that contain no spaces.. Option D is correct. Using field names with no spaces or special characters avoids parsing issues. Option A is not recommended because mixed case can cause case-sensitivity problems. Option B, tab-separated, is not standard; CSV with header is preferred. Option C, global lookups directory, is not best practice; it should be in the app's lookups directory.

Answer

Place the file in the global lookups directory.

Answer

Use mixed case field names.

Answer

Use tab-separated values.

Question 7

A team uses a lookup to enrich web logs with customer region. The lookup is file-based and updated daily. Some events are not being enriched even though the lookup file has matching keys. What could be the issue?

Accepted Answer

The lookup file has leading or trailing spaces in key fields.. Option B is correct. Leading or trailing spaces in the lookup file or search field are a common cause of mismatches. Option A, file not sorted, is not required for lookups. Option C, size limit, would cause an error or truncation, not silent failure. Option D, timestamp format, is irrelevant for non-time-based lookups.

Answer

The lookup file exceeds the maximum size.

Answer

The lookup file is not sorted.

Answer

The lookup definition uses the wrong timestamp format.

Question 8

An analyst wants to create a visualization showing the average response time by hour over the past day, with each server in a separate line. Which command should they use?

Accepted Answer

`... | timechart span=1h avg(response_time) by server`. Option C is correct. It uses `timechart` with an explicit span of 1 hour and splits by server. Option A uses `chart` which is not time-based and would produce a non-time chart. Option B omits span, which might default to auto but is less explicit. Option D uses `stats` which does not produce a time-based chart automatically.

Answer

`... | timechart avg(response_time) by server`

Answer

`... | chart avg(response_time) by hour, server`

Answer

`... | stats avg(response_time) by hour, server`

Question 9

What is the purpose of an automatic lookup?

Accepted Answer

To automatically apply a lookup to events based on a source type or index at search time.. Option A is correct. An automatic lookup is configured in transforms.conf or props.conf to apply a lookup to events based on sourcetype or index at search time, enriching events without manual lookup command. Option B describes outputlookup. Option C is not automatic; you need to restart or reload to pick up changes. Option D is not a feature of automatic lookups.

Answer

To automatically validate lookup field names.

Answer

To automatically update a lookup file when the CSV changes.

Answer

To automatically create a lookup table from search results.

Question 10

An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?

Accepted Answer

Splits the count by the 'method' field into separate series.. Option B is correct. The `by` clause in timechart splits the count into separate series for each value of the 'method' field. Option A is not necessarily true—default span depends on time range. Option C is false; there is no limit by default. Option D is incorrect because it does not calculate per day; it uses the time range of the search.

Answer

Calculates the total count per day for each method.

Answer

Bins events into 1-hour intervals by default.

Answer

Shows only the top 10 methods.

Question 11

Which TWO of the following are best practices when creating lookup table files?

Accepted Answer

Ensure the lookup file is in CSV format with the .csv extension.. B and C are correct. Using CSV format with a header row is standard (B). Placing the file in the app's lookups directory ensures proper access (C). A is wrong because spaces in field names cause issues. D is unnecessary (full paths are not recommended). E is not a best practice for file creation; automatic refresh is configured separately.

Answer

Use header rows with spaces in field names for readability.

Answer

Enable automatic lookup refresh for frequently updated files.

Answer

Use full paths in the lookup definition.

Question 12

Which THREE of the following are features of the `timechart` command?

Accepted Answer

It automatically creates a time-based chart with a default span.. A, B, and C are correct. timechart supports aggregation functions (A), automatically creates a time-based chart with default span (B), and can split into multiple series with the `by` clause (C). D is incorrect because `span` is optional. E is incorrect because timechart does not output to a lookup file.

Answer

It can output results to a lookup file.

Answer

It requires the `span` option to be specified.

Question 13

Which THREE steps are necessary to create a file-based lookup?

Accepted Answer

Upload the lookup file to the correct directory.. A, B, and D are necessary. Upload the file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply changes (D). C is not required; props.conf is for field extractions, not lookup definitions. E is optional only if you want automatic lookup.

Answer

Create a lookup definition in props.conf.

Answer

Define an automatic lookup in props.conf.

Question 14

Which statement best describes the search result?

Accepted Answer

It returns the count of events where the price is greater than 100, grouped by product_name.. Option A is correct. The search enriches events with product_name and price, filters for price > 100, then counts events by product_name. Option B is wrong because it counts events, not distinct product_ids. Option C is wrong because price is added by the lookup. Option D is too broad; it doesn't specify the grouping.

Answer

It returns an error because price is not a field before the lookup.

Answer

It returns the count of distinct product_ids that have a price > 100.

Answer

It returns the count of successful web events, but only for products with price > 100.

Question 15

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. Option C is correct. The filename is relative; Splunk looks for it in the lookups directory of the app where the transforms.conf is defined. Option A is not guaranteed; system lookups are global but not the default for app-specific definitions. Option B could work if the definition is in the search app, but generally it follows the app context. Option D is incorrect as Splunk does not search all directories.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.

SPLK-1003 Advanced Visualization and Lookups Practice Test 4 — 15 Questions

Exhibit

SPLK-1003 Advanced Visualization and Lookups Practice Test 4 — 15 Questions

Exhibit