SPLK-1002 Advanced Visualization and Lookups Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

Accepted Answer

city and country are set to 'NotFound'. The lookup definition in the exhibit sets `default_match='NotFound'`, and `OUTPUTNEW` adds fields only if they are not already present. When no match occurs, the default values 'NotFound' are used for both `city` and `country`. Option A is incorrect because the search does not fail; it continues with the default values. Option B is incorrect because fields are still added with default values. Option C is incorrect because the default_match overrides any default empty string behavior.

Answer

The search fails with an error

Answer

No fields are added

Answer

city and country are set to empty strings

Question 2

Refer to the exhibit. What happens when a user clicks on a status value in the table?

Accepted Answer

The chart updates to show methods for that status. Clicking a status value sets a token ($selected_status$) that triggers a search refresh for the chart panel, which depends on that token. This causes the chart to update to show methods for the selected status. The table does not change because it has no dependency on the token. Option A is incorrect because the token is indeed used and the chart updates. Option B is incorrect because only the chart updates, not the table. Option C is incorrect because the table does not filter; only the chart updates.

Answer

Nothing happens; the token is not used

Answer

Both the table and chart update

Answer

The table filters to show only events with that status

Question 3

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. The error 'Could not find lookup table' indicates that Splunk cannot find a lookup definition named 'geo_lookup' in transforms.conf. This is the most likely cause because the lookup definition (stanza) is missing or misconfigured. If the file geo.csv were missing but the definition existed, the error would mention 'file not found'. Permission errors produce a different message, and a misspelled field would not cause this error. Therefore, option A is correct.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 4

A company needs to enrich search results with additional fields from a CSV file. Which method should they use to define the lookup table so that it is available in all searches?

Accepted Answer

Define the lookup in transforms.conf with a filename and field mapping.. To make a lookup table available in all searches, the lookup definition must be created in transforms.conf. This file defines the lookup table filename, field mapping, and other properties. Once defined, the lookup can be used with the lookup command, the inputlookup command, or automatic lookups configured in props.conf. Option C correctly identifies this requirement.

Answer

Define the lookup in props.conf with an automatic lookup stanza.

Answer

Use the inputlookup command in a search.

Answer

Use the lookup command with the file path.

Answer

Use the eval command with the lookup function directly in search.

Question 5

An analyst creates a timechart to display the average CPU usage over time for multiple hosts. The chart shows a single line representing the overall average instead of separate lines per host. What is the most likely cause?

Accepted Answer

The search uses 'timechart span=1h avg(cpu)' without splitting.. The search uses 'timechart span=1h avg(cpu)' without a 'by' clause, which produces a single series showing the overall average over time. Options A, C, and D would not result in a single line representing the overall average across all hosts.

Answer

The search uses 'timechart avg(cpu) by host' but the host field is null.

Answer

The visualization type is set to 'Column' instead of 'Line'.

Answer

The search uses 'timechart avg(cpu) over date' without a by clause.

Question 6

A lookup table file contains 10GB of data. When performing a lookup using the lookup command, search performance is extremely slow. Which approach will most effectively improve performance without losing functionality?

Accepted Answer

Convert the lookup to a KV store lookup.. Converting the lookup to a KV store lookup leverages a key-value store optimized for fast retrieval, significantly improving performance for large datasets. Options A, B, C, and D are less effective or reduce functionality: splitting into multiple files (A) adds complexity without addressing performance; loading into memory (B) may cause memory issues; increasing max_memtable_bytes (C) can lead to instability; time-based lookup (D) restricts the lookup to a limited time range, losing functionality.

Answer

Split the lookup into multiple smaller files and use a chain of lookups.

Answer

Use the inputlookup command to load the entire table into memory.

Answer

Set the max_memtable_bytes in limits.conf to increase memory.

Answer

Create a time-based lookup with limited time range.

Question 7

A search produces a table with many rows. Which visualization type is best suited to show the distribution of a single field's values?

Accepted Answer

Pie chart. A pie chart effectively shows the proportional distribution of a single field's values across categories. Area charts, scatter charts, and line charts are better suited for showing trends over time or relationships between variables, not distribution of a single field.

Answer

Area chart

Answer

Scatter chart

Answer

Line chart

Question 8

A lookup configured with WILDCARD match_type for pattern '10.*.25' is not matching some events. Which of the following event values would NOT be matched by this lookup?

Accepted Answer

10.1.25.1. The wildcard pattern '10.*.25' matches any value that starts with '10.' and ends with '.25', with any characters (including none) in between due to the wildcard '*'. Options A (10.1.2.25), C (10.1.25), D (10.2.25), and E (10.10.25) all start with '10.' and end with '.25', so they match. Option B (10.1.25.1) ends with '.1', not '.25', so it does not match the pattern. Therefore, option B is the value that would NOT be matched.

Answer

10.1.2.25

Answer

10.1.25

Answer

10.2.25

Answer

10.10.25

Question 9

An admin wants to create a dashboard that shows the count of errors by sourcetype over the last 7 days, with the ability to click on a sourcetype to drill down to a detailed search. Which visualization and configuration supports this?

Accepted Answer

Use a bar chart and set the 'drilldown' option to 'search' in the dashboard XML.. A bar chart is suitable for comparing counts across sourcetypes and allows drilldown via the dashboard XML configuration. Option A is incorrect because a line chart is typically used for trends over time, not for comparing counts across categories, and drilldown is not configured via the search command but in the dashboard XML. Option C is incorrect because pie charts are less effective when there are many categories, and drilldown is not configured via the search command. Option D is incorrect because tables do support drilldown, but the configuration described is not standard; drilldown is set in the dashboard XML, not via a 'link' in the search string.

Answer

Use a line chart and set the 'drilldown' to 'search' in the search command.

Answer

Use a pie chart and set the 'drilldown' option to 'search' in the dashboard XML.

Answer

Use a table and set the 'link' in search string.

Question 10

An analyst notices that a timechart command with 'by host' shows only 10 hosts even though there are 50 distinct hosts. What could be the reason?

Accepted Answer

The 'limit' parameter is set to 10 by default.. By default, the `timechart` command sets the `limit` parameter to 10, which limits the number of series (columns) displayed to the top 10 by count. Even though there are 50 distinct hosts, only the top 10 will appear. Option A is incorrect because the visualization type (Pie) does not change the number of series shown by `timechart`; the limit is set in the `timechart` command itself. Option B is incorrect because `join` is not related to limiting the number of hosts. Option C is incorrect because the `useother` parameter, when set to `false`, suppresses the 'OTHER' series but does not change how many top series are shown — that is still controlled by `limit` (default 10). The default for `useother` is `true`, so the absence of an 'OTHER' series alone might suggest a non‑default setting, but the underlying reason only 10 hosts appear is the `limit` value.

Answer

The visualization is set to 'Pie' which only shows top 10.

Answer

The search is using 'join' to combine data.

Answer

The 'useother' parameter is set to false.

Question 11

An analyst observes that a lookup command with a large lookup file is causing the search to timeout. The lookup is used to extract additional fields based on a field value. What is the most effective immediate solution?

Accepted Answer

Reduce the lookup file size by removing unused columns or rows.. Reducing the lookup file size (by removing unused columns or rows) directly reduces the amount of data processed, improving performance and preventing timeouts. Option A (WILDCARD match) can worsen performance due to pattern matching overhead. Option C (inputlookup) loads the entire table, which would be even slower and exacerbate the timeout. Option D (increasing search timeout) does not address the root cause of slow data processing.

Answer

Change the match_type to WILDCARD to be more flexible.

Answer

Use the inputlookup command to load the entire table.

Answer

Increase the search timeout in limits.conf.

Question 12

An admin creates a dashboard with a timechart panel that drills down to a search for that time range. The drilldown search works but does not include the time range. What is the likely cause?

Accepted Answer

The drilldown is set to 'search' without including tokens for time.. When a drilldown is configured as a simple search without tokens to pass the time range, the time range from the panel is not inherited. The drilldown performs a search using the default time range (e.g., All time) instead of the panel's time range. To include the time range, tokens like $earliest$ and $latest$ must be added to the drilldown search string. Options B, C, and D are incorrect: B would maintain the time if fixed, C affects the dashboard overall but not necessarily the panel's drilldown, and D would actually pass the time range correctly.

Answer

The timechart uses a fixed time range in the search string.

Answer

The dashboard's time input is disabled.

Answer

The drilldown is configured to use 'range' token but the panel's time range is not passed.

Question 13

Which TWO configurations are required to create a geospatial visualization of server locations?

Accepted Answer

A mappings.json file in the app directory.. The correct answers are C and D. A lookup table containing latitude and longitude fields provides the geographic coordinates for each server location. A mappings.json file in the app directory defines the geographic boundary or map layer to visualize those coordinates. Options A, B, and E are not strictly required: geospatial visualizations can use any sourcetype, data can come from any index, and the geostats command is optional.

Answer

A sourcetype that includes country codes.

Answer

An index that contains geographic data.

Answer

The use of the geostats command.

Question 14

Which TWO components must be configured to enable an automatic lookup that populates fields at index time?

Accepted Answer

transforms.conf to define the lookup table and the field mapping.. Options A and D are correct. transforms.conf defines the lookup table and field mapping, and props.conf specifies which sourcetype should use the lookup automatically at index time. Option B is incorrect because the lookup table file must be placed in the 'lookups' directory of the app, not 'lookup' (typo) and also the file placement is necessary but not sufficient for automatic lookup; configuration files are required. Option C is incorrect because indexes.conf is for index configuration, not lookups. Option E is incorrect because lookups can be defined via configuration files, not only via Splunk Web.

Answer

The lookup table file must be placed in the lookup directory of the app.

Answer

indexes.conf to enable lookup acceleration.

Answer

The lookup must be defined via the Lookups menu in Splunk Web only.

Question 15

Which THREE of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Use the REST API to upload a CSV file.. The correct methods to create a lookup table in Splunk are: uploading a CSV via the REST API (A), uploading a CSV via the Lookups menu in Settings (C), and using the 'outputlookup' command in a search to save results as a lookup (D). Option B is incorrect because defining a lookup in props.conf only references an existing file; it does not create the lookup. Option E is incorrect because 'inputlookup' reads from a lookup, not creates one.

Answer

Define a lookup in props.conf with a filename.

Answer

Use the 'inputlookup' command to create a new file.