SPLK-1003 Advanced Visualization and Lookups Practice Test 7 — 15 Questions

Question 1

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. Option E is correct because without useother=t, the timechart drops all hosts beyond the top 5. Option A is misleading because the total count is not shown. Options B, C, and D are incorrect descriptions of the command behavior.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 2

A security analyst wants to create a visualization that shows the count of failed login attempts per user over the last 7 days. Which visualization type is most appropriate?

Accepted Answer

Line chart with time on x-axis and count on y-axis. A line chart is best for showing trends over time. A pie chart shows proportions at a single point, a bar chart can show comparisons but not trends, and a scatter chart is for correlations.

Answer

Pie chart showing proportion of attempts per user

Answer

Scatter chart showing correlation between user and time

Answer

Bar chart with users on x-axis and count on y-axis

Question 3

An IT administrator notices that a lookup table used to enrich firewall logs is not updating correctly. The lookup file is stored in $SPLUNK_HOME/etc/apps/search/lookups/. What is the most likely cause if the lookup is defined as a 'file-based lookup' with automatic lookup?

Accepted Answer

The lookup filename contains a space character. Splunk does not support spaces in lookup filenames. A space in the filename causes the lookup to fail. Option B is correct.

Answer

The lookup file is too large (over 100 MB)

Answer

The lookup is not referenced in any search

Answer

The lookup file permissions are set to read-only

Question 4

A team is designing a dashboard to monitor real-time server CPU utilization. They want to update every 10 seconds and use a gauge visualization. What is the best search mode to use for real-time performance?

Accepted Answer

Fast mode. Fast mode reduces computational overhead by limiting field extraction, which is ideal for real-time dashboards. Smart mode may do more work, Verbose mode returns all fields, and Real-time is not a search mode.

Answer

Smart mode

Answer

Real-time mode

Answer

Verbose mode

Question 5

A user wants to join data from two datasets in a search. Which command is used to combine results based on a common field, but only returns matching results?

Accepted Answer

join. The join command performs an inner join by default, returning only matches. Append adds rows without matching, union is not a Splunk command, and lookup enriches data.

Answer

append

Answer

union

Answer

lookup

Question 6

A Splunk administrator is troubleshooting a slow dashboard that uses a timechart with a large dataset. Which of the following is a best practice to improve performance?

Accepted Answer

Use data model acceleration. Data model acceleration pre-computes data for faster searches. Increasing bucket count, using eval, or increasing concurrent searches do not directly improve performance and may worsen it.

Answer

Increase the number of concurrent searches

Answer

Use the eval command to add fields

Answer

Increase the search bucket count

Question 7

An analyst needs to create a visualization that shows the relationship between source IP and destination port in network traffic. Which visualization type is most appropriate?

Accepted Answer

Sankey diagram. A Sankey diagram is designed to show flow relationships between sources and destinations. Choropleth maps are geographic, single values show one number, and column charts are for comparisons.

Answer

Choropleth map

Answer

Single value

Answer

Column chart

Question 8

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

Accepted Answer

Define the lookup in transforms.conf and props.conf. For an automatic lookup that updates when the file changes, you must define the lookup in both transforms.conf and props.conf. Simply defining in transforms.conf or uploading the file is insufficient without props.conf to enable the automatic lookup.

Answer

Use the lookup command in searches

Answer

Upload the CSV to the lookups folder only

Answer

Only define in transforms.conf

Question 9

A user wants to create a trellis chart with multiple panels, each showing data for a different department. What attribute should be used to split the visualization?

Accepted Answer

Split by. In trellis charts, the 'Split by' attribute divides the visualization into multiple panels based on a field value. Overlay, color, and drilldown are not used for splitting.

Answer

Overlay

Answer

Drilldown

Answer

Color

Question 10

A dashboard uses a drop-down input to select a server. The drop-down is populated by a search that returns server names. Which setting ensures that the drop-down updates automatically when the underlying data changes?

Accepted Answer

Change the 'refresh' setting on the input. The 'refresh' setting on the input causes the search that populates the drop-down to re-run at intervals, keeping the list current. Token filters, delay, or 'search on change' do not provide automatic periodic updates.

Answer

Set the 'delay' option

Answer

Use a token filter

Answer

Enable 'search on change'

Question 11

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Accepted Answer

Use the timechart command with a split-by field. To create a stacked bar chart over time, you need to use timechart with a split-by field to get time series and then set the stack mode to stacked in visualization options. Chart command does not inherently produce time series, and eval is not needed. Line chart is not stacked bar.

Answer

Use the eval command to create a new field

Answer

Use the chart command with a split-by field

Answer

Select the 'line' chart type

Question 12

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Lookups can be automatic via props.conf, can be based on CSV or KV Store, and are used to add fields from an external source. They are not limited to exact match (range lookups exist) and do not require data to be indexed in Splunk.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 13

An administrator is designing a dashboard with multiple panels that share a common time picker. Which THREE dashboard features can be used to synchronize time across panels?

Accepted Answer

Use the $time_token$ variable in panel searches. Using a single time input with a token, referencing the token in panel searches, and using earliest/latest fields with the token are standard methods. Setting each panel independently does not synchronize, and 'link time' is not a standard feature.

Answer

Use the 'link time' option in dashboard editor

Answer

Set each panel's time range independently

Question 14

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

Accepted Answer

The match_type should be 'match_type = cidr' without brackets. In Splunk's transforms.conf, match_type is a setting, not a separate stanza. The bracket indicates a new stanza, which is incorrect. The correct syntax is 'match_type = cidr' under the [geo_ip] stanza.

Answer

The max_matches setting should be 0

Answer

The filename should include the full path

Answer

The stanza name should be 'geo_ip' without brackets

Question 15

Refer to the exhibit. A user runs this search expecting to see the top 5 departments by count, but the results show all departments. What is the error?

Accepted Answer

The top command already calculates a count, so stats is unnecessary and can cause conflict. The top command already calculates a count and sorts, so using stats before top is redundant and can cause unexpected results. The correct approach is to use 'top limit=5 department' directly on the inputlookup without stats.

Answer

The limit parameter in top should be written before the field name

Answer

The sort command should be placed before stats

Answer

The inputlookup should be used with a subsearch

SPLK-1003 Advanced Visualization and Lookups Practice Test 7 — 15 Questions

Exhibit

SPLK-1003 Advanced Visualization and Lookups Practice Test 7 — 15 Questions

Exhibit