SPLK-1003 Advanced Visualization and Lookups Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. Option D is correct because the error 'Could not find lookup table' indicates the lookup definition (transforms.conf stanza) is missing or incorrect. Option A is incorrect because if the file were missing but definition existed, the error would mention 'file not found'. Option B is incorrect because permissions errors produce a different message. Option C is incorrect because the error is about the table, not the field.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 2

A company needs to enrich search results with additional fields from a CSV file. Which method should they use to define the lookup table so that it is available in all searches?

Accepted Answer

Define the lookup in transforms.conf with a filename and field mapping.. Option D is correct because the lookup table file and format must be defined in transforms.conf to be available for use with the lookup command or automatic lookups. Option A is incorrect; inputlookup reads a lookup but does not define it. Option B is incorrect; the lookup command uses an existing definition. Option C is incorrect; props.conf is for automatic lookups, not for defining the lookup table itself. Option E is incorrect; the eval lookup function also requires a definition.

Answer

Define the lookup in props.conf with an automatic lookup stanza.

Answer

Use the inputlookup command in a search.

Answer

Use the lookup command with the file path.

Answer

Use the eval command with the lookup function directly in search.

Question 3

An analyst creates a timechart to display the average CPU usage over time for multiple hosts. The chart shows a single line representing the overall average instead of separate lines per host. What is the most likely cause?

Accepted Answer

The search uses 'timechart span=1h avg(cpu)' without splitting.. Option C is correct because the timechart command without a 'by' clause produces a single series showing the overall average. Options A, B, and D would produce different issues but not the described symptom.

Answer

The search uses 'timechart avg(cpu) by host' but the host field is null.

Answer

The visualization type is set to 'Column' instead of 'Line'.

Answer

The search uses 'timechart avg(cpu) over date' without a by clause.

Question 4

A lookup table file contains 10GB of data. When performing a lookup using the lookup command, search performance is extremely slow. Which approach will most effectively improve performance without losing functionality?

Accepted Answer

Convert the lookup to a KV store lookup.. Option A is correct because converting to a KV store lookup uses a more efficient storage and retrieval mechanism, ideal for large lookup tables. Options B, C, D, and E are less effective or reduce functionality.

Answer

Split the lookup into multiple smaller files and use a chain of lookups.

Answer

Use the inputlookup command to load the entire table into memory.

Answer

Set the max_memtable_bytes in limits.conf to increase memory.

Answer

Create a time-based lookup with limited time range.

Question 5

A search produces a table with many rows. Which visualization type is best suited to show the distribution of a single field's values?

Accepted Answer

Pie chart. Option C is correct because a pie chart effectively shows proportional distribution of categorical data. Options A, B, and D are more suited for trends or relationships.

Answer

Area chart

Answer

Scatter chart

Answer

Line chart

Question 6

A lookup configured with WILDCARD match_type for pattern '10.*.25' is not matching some events. Which of the following event values would NOT be matched by this lookup?

Accepted Answer

10.1.25.1. Option E is correct because the pattern '10.*.25' matches any string that starts with '10.' and ends with '.25'. Option E ends with '.1', so it does not match. Options A, B, C, and D all match because they start with '10.' and end with '.25' (D has additional segments but the wildcard matches them).

Answer

10.1.2.25

Answer

10.1.25

Answer

10.2.25

Answer

10.10.25

Question 7

An admin wants to create a dashboard that shows the count of errors by sourcetype over the last 7 days, with the ability to click on a sourcetype to drill down to a detailed search. Which visualization and configuration supports this?

Accepted Answer

Use a bar chart and set the 'drilldown' option to 'search' in the dashboard XML.. Option B is correct because a bar chart is suitable for comparing counts across sourcetypes and allows drilldown via dashboard XML. Option A also supports drilldown but pie charts are less effective for many categories. Options C and D are not optimal or incorrectly describe drilldown configuration.

Answer

Use a line chart and set the 'drilldown' to 'search' in the search command.

Answer

Use a pie chart and set the 'drilldown' option to 'search' in the dashboard XML.

Answer

Use a table and set the 'link' in search string.

Question 8

An analyst notices that a timechart command with 'by host' shows only 10 hosts even though there are 50 distinct hosts. What could be the reason?

Accepted Answer

The 'limit' parameter is set to 10 by default.. Option A is correct because the default limit for timechart is 10, which restricts the number of series displayed. Options B, C, and D are not default behaviors or are unrelated.

Answer

The visualization is set to 'Pie' which only shows top 10.

Answer

The search is using 'join' to combine data.

Answer

The 'useother' parameter is set to false.

Question 9

An analyst observes that a lookup command with a large lookup file is causing the search to timeout. The lookup is used to extract additional fields based on a field value. What is the most effective immediate solution?

Accepted Answer

Reduce the lookup file size by removing unused columns or rows.. Option C is correct because reducing the lookup file size (by removing unused columns or rows) directly reduces the amount of data processed, improving performance. Options A, B, D are less effective or exacerbate the issue.

Answer

Change the match_type to WILDCARD to be more flexible.

Answer

Use the inputlookup command to load the entire table.

Answer

Increase the search timeout in limits.conf.

Question 10

An admin creates a dashboard with a timechart panel that drills down to a search for that time range. The drilldown search works but does not include the time range. What is the likely cause?

Accepted Answer

The drilldown is set to 'search' without including tokens for time.. Option B is correct because the drilldown search configuration must include tokens to pass the time range; if set to a static search, time range is not inherited. Options A, C, D are possible but less common or specific.

Answer

The timechart uses a fixed time range in the search string.

Answer

The dashboard's time input is disabled.

Answer

The drilldown is configured to use 'range' token but the panel's time range is not passed.

Question 11

Which TWO configurations are required to create a geospatial visualization of server locations?

Accepted Answer

A mappings.json file in the app directory.. Options A and D are correct. A lookup table with latitude and longitude fields provides the location data, and a mappings.json file defines the geographic shapes for the visualization. Options B, C, and E are not strictly required; they are optional or used for other purposes.

Answer

A sourcetype that includes country codes.

Answer

An index that contains geographic data.

Answer

The use of the geostats command.

Question 12

Which TWO components must be configured to enable an automatic lookup that populates fields at index time?

Accepted Answer

transforms.conf to define the lookup table and the field mapping.. Options A and B are correct. transforms.conf defines the lookup table and field mapping, and props.conf specifies which sourcetype should use the lookup automatically. Options C, D, and E are not required configuration files for the automatic lookup to work.

Answer

The lookup table file must be placed in the lookup directory of the app.

Answer

indexes.conf to enable lookup acceleration.

Answer

The lookup must be defined via the Lookups menu in Splunk Web only.

Question 13

Which THREE of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Use the REST API to upload a CSV file.. Options A, B, and E are correct. You can upload a CSV via the Settings menu, use the outputlookup command to create a lookup from search results, or use the REST API. Options C and D are incorrect because props.conf does not create lookups, and inputlookup reads but does not create.

Answer

Define a lookup in props.conf with a filename.

Answer

Use the 'inputlookup' command to create a new file.

Question 14

An analyst runs this search and gets no results. The lookup file server_list.csv exists and contains data. What is the most likely issue?

Accepted Answer

The field names in the CSV do not match the search fields.. Option C is correct because the field names in the CSV must match the search fields (status, hostname, ip_address). If the CSV uses different field names, no results will be returned. Options A, B, and D are less likely or incorrect.

Answer

The lookup file is not in the correct lookup directory.

Answer

The search should include an index specification.

Answer

The search should use 'lookup' instead of 'inputlookup'.

Question 15

An admin configured an automatic lookup but events for mysourcetype are not being enriched. What is the most likely problem?

Accepted Answer

The match_type should be 'EXACT' instead of 'WILDCARD'.. Option B is correct because the WILDCARD match_type requires the event value to contain wildcard characters or be matched glob-style; typical exact matches require EXACT match_type. Option C is possible but the syntax can omit INPUT if the field names match. Options A and D are less likely.

Answer

The lookup file is too large and memory limit is exceeded.

Answer

The LOOKUP stanza in props.conf is missing the input field specification.

Answer

The lookup is defined in transforms.conf but not referenced in any search.

SPLK-1003 Advanced Visualization and Lookups Practice Test 6 — 15 Questions

Exhibit

SPLK-1003 Advanced Visualization and Lookups Practice Test 6 — 15 Questions

Exhibit