SPLK-1002 Advanced Visualization and Lookups Practice Test 5 — 15 Questions

Question 1

Which THREE steps are necessary to create a file-based lookup?

Accepted Answer

Upload the lookup file to the correct directory.. To create a file-based lookup in Splunk, three steps are necessary: upload the lookup file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply the changes (E). The lookup definition maps the file to a lookup table name. Props.conf is not used for defining lookups; it is for field extractions and event processing. Restarting Splunk is required because changes to transforms.conf take effect only after a restart. Automatic lookups (D) are optional and defined separately if needed.

Answer

Create a lookup definition in props.conf.

Answer

Define an automatic lookup in props.conf.

Question 2

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. The filename is relative; Splunk looks for it in the lookups directory of the app where the transforms.conf is defined. Therefore, option D is correct because the file 'departments.csv' must be placed in the lookups directory of the same app where the lookup definition (transforms.conf) resides. Option A is incorrect because $SPLUNK_HOME contains many directories, not specifically lookups. Option B is incorrect because while the search app's lookups directory could work if transforms.conf is in that app, the definition is not necessarily in the search app. Option C is incorrect because $SPLUNK_HOME/etc/system/lookups is a system-wide lookup directory, but for app-specific definitions, it should be in the app's lookups directory.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.

Question 3

What type of visualization is produced by the pie command?

Accepted Answer

A pie chart.. The `pie` command in Splunk generates a pie chart from the statistical results. Option A (bar chart) is produced by the `chart` command, not `pie`. Option C (scatter chart) and D (line chart) are not applicable here.

Answer

A bar chart.

Answer

A scatter chart.

Answer

A line chart.

Question 4

A company needs to enrich events with lookup data that changes over time, such as daily exchange rates. Which lookup method is most appropriate?

Accepted Answer

Use a time-based lookup with a time_field parameter. A time-based lookup with a time_field parameter allows the lookup to return different values based on the event timestamp. Option A is incorrect because a KV Store lookup is not time-aware by default and would require additional logic. Option B is incorrect because a file lookup without time context cannot handle time-varying data. Option D is incorrect because index-time lookups are static and require reindexing to reflect changes.

Answer

Use a KV Store lookup with a time-range filter in the search

Answer

Use a file lookup without time context

Answer

Use an index-time lookup

Question 5

A security analyst wants to visualize the count of login failures per hour, grouped by source IP. Which SPL command should they use?

Accepted Answer

timechart count by src_ip. Timechart automatically creates a time-based chart and can split by a field using 'by src_ip'. Option B is incorrect because stats produces a table, not a time-based chart, and does not automatically bin by time. Option C is incorrect because chart requires an explicit 'span' to create time-based bins, unlike timechart. Option D is incorrect because eventstats adds a new field but does not produce a visualization.

Answer

stats count by _time, src_ip

Answer

chart count by src_ip over _time

Answer

eventstats count by src_ip

Question 6

A large CSV lookup file (over 10 million rows) is causing search performance degradation. Which solution best improves performance without sacrificing accuracy?

Accepted Answer

Convert to a KV Store lookup and update the collection as needed. KV Store lookups provide indexed lookups and can be updated without reindexing, improving performance for large, dynamic datasets. Option A is incorrect because increasing max_memory in transforms.conf does not fundamentally improve lookup efficiency for large CSV files. Option B is incorrect because index-time lookups require reindexing and are not suitable for frequently changing data. Option D is incorrect because reducing the CSV file to only the most common keys would lose accuracy for less common lookup keys.

Answer

Increase the max_memory setting in transforms.conf

Answer

Convert to an index-time lookup with automatic re-indexing

Answer

Reduce the CSV file to only the most common lookup keys

Question 7

In a dashboard, a bar chart shows sales by region. The user wants to click on a bar and have a table filter to show only that region's details. Which drilldown technique should be used?

Accepted Answer

Set a token using $click.value$ in the drilldown and add a dependency on the token in the table search. In Splunk dashboards, drilldowns can set tokens using $click.value$ to capture the clicked field value. By setting a token in the drilldown of the bar chart (e.g., token = region_selection with value = $click.value$), the table search can then reference this token (e.g., index=... region=$region_selection$) to filter dynamically. Option A is incorrect because simply enabling drilldown without token setup does not pass the value to another panel. Option B is incorrect because form input dropdowns are for user input, not for capturing drilldown clicks. Option D is incorrect because a static filter cannot respond to user clicks.

Answer

Enable drilldown in the bar chart and set the search to automatically apply the clicked field

Answer

Configure a form input dropdown and set default value from drilldown

Answer

Use a static filter with a predefined list of regions

Question 8

An analyst needs to create a time-series chart showing the percentage of total HTTP status codes per day. Which approach is most efficient?

Accepted Answer

timechart count by status | eventstats sum(count) as total by _time | eval pct = round(count/total*100,2) | chart first(pct) over _time by status. Using timechart to get counts by status, then eventstats to compute total per day, and eval to calculate percentage, is efficient and clear. Option B is incorrect because using chart with a single stats command cannot compute percentages across groups per time bucket. Option C is incorrect because addtotals adds overall totals but does not compute per-day percentages. Option D is incorrect because overcomplicates with subsearches.

Answer

chart count by status over _time | eval pct = count / sum(count) * 100

Answer

timechart count by status | addtotals | eval pct = count / total * 100

Answer

timechart count by status | append [timechart count] | eval pct = count / [| timechart count] * 100

Question 9

A network engineer wants to add geographic location (city, country) to firewall logs based on source IP. Which lookup type is most appropriate?

Accepted Answer

File-based lookup (CSV). File-based lookup (CSV). A CSV file containing IP-to-location mappings is simple, efficient, and well-suited for static geographic data. Option A (KV Store lookup) is designed for dynamic, frequently updated data, not static IP-to-location mappings. Option B (Scripted lookup) is for complex external data sources requiring external commands or scripts. Option C (Automatic lookup configured in props.conf) is a method to apply lookups automatically at search time, but it requires a lookup definition file (like CSV) first; it is not a lookup type. Therefore, the most appropriate lookup type for this use case is a file-based CSV lookup.

Answer

KV Store lookup

Answer

Scripted lookup

Answer

Automatic lookup configured in props.conf

Question 10

An automatic lookup is configured in props.conf and transforms.conf, but the expected fields are not appearing in search results. Which is the first thing to verify?

Accepted Answer

Verify the transforms.conf definition for the lookup. The first step to troubleshoot an automatic lookup is to verify the transforms.conf definition, ensuring that the lookup table name, file path, and field mappings are correctly specified. Option B is incorrect because manually running the lookup command is a diagnostic step that comes after verifying the configuration. Option C is incorrect because the source field extraction is not directly related to automatic lookup functionality; the lookup is based on field values, not extraction. Option D is incorrect because read permissions on the lookup table would typically cause an error message, not a silent failure of fields appearing.

Answer

Run a search using the lookup command manually to test

Answer

Verify that the source field is extracted at search time

Answer

Verify that the user has read permissions on the lookup table

Question 11

A lookup table must be updated multiple times per minute from an external API. Which lookup method provides the best performance for search-time enrichment?

Accepted Answer

KV Store lookup updated via REST API. KV Store lookups can be updated via REST API calls without reindexing and provide fast search-time lookups. Option A is incorrect because file lookups require rewriting the file and reloading. Option B is incorrect because index-time lookups require reindexing. Option C is incorrect because scripted lookups call the API on every search, causing severe performance issues.

Answer

CSV file lookup updated by a scheduled script

Answer

Index-time lookup using a transformation that queries the API during indexing

Answer

Scripted lookup that calls the API on each search

Question 12

A dashboard developer wants to color-code the bars in a column chart based on a severity field (critical=red, high=orange, medium=yellow, low=green). How can this be achieved?

Accepted Answer

Use the chart command with 'useColors=true' and specify a color palette or use Eval to create a color field. In Splunk, to color-code a chart based on a field like severity, you can use the `eval` command to create a color field that maps severity values to color names (e.g., `| eval color=case(severity="critical","red", severity="high","orange", ...)`), and then use that field in the chart's visualization options for color. The `chart` command itself does not have a `useColors=true` parameter; the phrase refers to a conceptual use of color palettes or visualization settings. Option A is incorrect because drilldown is for navigation, not coloring. Option C is incorrect because the `overlay` option overlays a second chart, not for color coding. Option D is incorrect because CSS is not the standard method for dynamic field-based coloring in Simple XML dashboards.

Answer

Configure drilldown to change colors when clicked

Answer

Use the 'overlay' option in the chart command

Answer

Add CSS styling to the Simple XML dashboard

Question 13

Which ONE setting is required in a transforms.conf stanza for a file-based lookup to work? (Select one.)

Accepted Answer

filename. In Splunk transforms.conf, only the 'filename' setting is mandatory for a file-based lookup. The 'match_type' setting is optional and defaults to 'EXACT' if not specified. Therefore, only D is correct.

Answer

max_matches

Answer

match_type

Answer

case_sensitive_match

Answer

default_match

Question 14

Which THREE practices improve lookup performance in Splunk? (Select three.)

Accepted Answer

Use KV Store lookups for data that is updated frequently. The three practices that improve lookup performance in Splunk are: Use KV Store lookups for data that is updated frequently (B), use index-time lookups for static reference data that rarely changes (D), and keep lookup files small and focused for fast search-time loading (E). Option A is incorrect because large CSV files used as automatic lookups can degrade performance. Option C is incorrect because the 'format' command does not reduce lookup size; it formats results and does not improve lookup performance.

Answer

Use large CSV files configured as automatic lookups for always-current data

Answer

Apply formatting options like 'format' command to reduce lookup size

Question 15

Which TWO SPL commands can be used to create a time-based chart showing event counts over time? (Select two.)

Accepted Answer

chart (with time span). The correct answers are B and C. timechart automatically creates a time-based chart showing event counts over time by default. chart with a time span (e.g., chart count over _time span=1h) also creates a time-based chart. eventstats (A) adds statistics to existing events but does not produce a chart. where (D) filters events based on a condition. stats (E) returns a table of statistics but does not produce a chart.

Answer

eventstats

Answer

where

Answer

stats