SPLK-1002 Advanced Visualization and Lookups Practice Test 7 — 15 Questions

Question 1

An analyst runs this search and gets no results. The lookup file server_list.csv exists and contains data. What is the most likely issue?

Accepted Answer

The field names in the CSV do not match the search fields.. The search likely uses fields (e.g., status, hostname, ip_address) that do not match the column headers in server_list.csv. The inputlookup command returns results only if field names align; a mismatch leads to no output. Other options are less likely: the file exists so it is in the correct directory (A); index specification is irrelevant for lookups (C); inputlookup is appropriate for inline lookups (D).

Answer

The lookup file is not in the correct lookup directory.

Answer

The search should include an index specification.

Answer

The search should use 'lookup' instead of 'inputlookup'.

Question 2

An admin configured an automatic lookup but events for mysourcetype are not being enriched. What is the most likely problem?

Accepted Answer

The match_type should be 'EXACT' instead of 'WILDCARD'.. The WILDCARD match_type requires the event value to contain wildcard characters or be matched glob-style; typical exact matches require EXACT match_type. Option C is possible but the syntax can omit INPUT if the field names match. Options A and D are less likely.

Answer

The lookup file is too large and memory limit is exceeded.

Answer

The LOOKUP stanza in props.conf is missing the input field specification.

Answer

The lookup is defined in transforms.conf but not referenced in any search.

Question 3

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 4

An IT administrator notices that a lookup table used to enrich firewall logs is not updating correctly. The lookup file is stored in $SPLUNK_HOME/etc/apps/search/lookups/. What is the most likely cause if the lookup is defined as a 'file-based lookup' with automatic lookup?

Accepted Answer

The lookup filename contains a space character. Splunk does not support spaces in lookup filenames. A space in the filename causes the lookup to fail. Option C is correct.

Answer

The lookup file is too large (over 100 MB)

Answer

The lookup is not referenced in any search

Answer

The lookup file permissions are set to read-only

Question 5

A team is designing a dashboard to monitor real-time server CPU utilization. They want to update every 10 seconds and use a gauge visualization. What is the best search mode to use for real-time performance?

Accepted Answer

Fast mode. Fast mode reduces computational overhead by limiting field extraction, which is ideal for real-time dashboards. Smart mode may do more work, Verbose mode returns all fields, and Real-time is not a search mode.

Answer

Smart mode

Answer

Real-time mode

Answer

Verbose mode

Question 6

A user wants to join data from two datasets in a search. Which command is used to combine results based on a common field, but only returns matching results?

Accepted Answer

join. The join command performs an inner join by default, returning only matches. Append adds rows without matching, union is not a Splunk command, and lookup enriches data.

Answer

append

Answer

union

Answer

lookup

Question 7

A Splunk administrator is troubleshooting a slow dashboard that uses a timechart with a large dataset. Which of the following is a best practice to improve performance?

Accepted Answer

Use data model acceleration. Data model acceleration pre-computes data for faster searches. Increasing bucket count, using eval, or increasing concurrent searches do not directly improve performance and may worsen it.

Answer

Increase the number of concurrent searches

Answer

Use the eval command to add fields

Answer

Increase the search bucket count

Question 8

An analyst needs to create a visualization that shows the relationship between source IP and destination port in network traffic. Which visualization type is most appropriate?

Accepted Answer

Sankey diagram. A Sankey diagram is designed to show flow relationships between sources and destinations. Choropleth maps are geographic, single values show one number, and column charts are for comparisons.

Answer

Choropleth map

Answer

Single value

Answer

Column chart

Question 9

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

Accepted Answer

Define the lookup in transforms.conf and props.conf. To create a dynamic lookup that automatically updates from a CSV file, you must define the lookup in both transforms.conf and props.conf. The transforms.conf defines the lookup table and its source file, while props.conf enables automatic lookup and associates it with the appropriate sourcetype. Simply uploading the CSV or defining only in transforms.conf is insufficient; using the lookup command in searches is not required for the automatic update mechanism.

Answer

Use the lookup command in searches

Answer

Upload the CSV to the lookups folder only

Answer

Only define in transforms.conf

Question 10

A user wants to create a trellis chart with multiple panels, each showing data for a different department. What attribute should be used to split the visualization?

Accepted Answer

Split by. In trellis charts, the 'Split by' attribute divides the visualization into multiple panels based on a field value. Overlay, color, and drilldown are not used for splitting.

Answer

Overlay

Answer

Drilldown

Answer

Color

Question 11

A dashboard uses a drop-down input to select a server. The drop-down is populated by a search that returns server names. Which setting ensures that the drop-down updates automatically when the underlying data changes?

Accepted Answer

Change the 'refresh' setting on the input. The 'refresh' setting on the input causes the search that populates the drop-down to re-run at intervals, keeping the list current. Token filters, delay, or 'search on change' do not provide automatic periodic updates.

Answer

Set the 'delay' option

Answer

Use a token filter

Answer

Enable 'search on change'

Question 12

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Accepted Answer

Use the timechart command with a split-by field. To create a stacked bar chart over time, you need to use timechart with a split-by field to get time series and then set the stack mode to stacked in visualization options. Chart command does not inherently produce time series, and eval is not needed. Line chart is not stacked bar.

Answer

Use the eval command to create a new field

Answer

Use the chart command with a split-by field

Answer

Select the 'line' chart type

Question 13

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Lookups can be automatic via props.conf, can be based on CSV or KV Store, and are used to add fields from an external source. They are not limited to exact match (range lookups exist) and do not require data to be indexed in Splunk.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 14

An administrator is designing a dashboard with multiple panels that share a common time picker. Which THREE dashboard features can be used to synchronize time across panels?

Accepted Answer

Use the $time_token$ variable in panel searches. Using a single time input with a token, referencing the token in panel searches, and using earliest/latest fields with the token are standard methods. Setting each panel independently does not synchronize, and 'link time' is not a standard feature.

Answer

Use the 'link time' option in dashboard editor

Answer

Set each panel's time range independently

Question 15

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

Accepted Answer

The match_type should be 'match_type = cidr' without brackets. In Splunk's transforms.conf, the 'match_type' is a setting within a stanza, not a stanza name itself. The bracket syntax [match_type = cidr] incorrectly defines a new stanza. The correct syntax is to place 'match_type = cidr' as a line under the [geo_ip] stanza.

Answer

The max_matches setting should be 0

Answer

The filename should include the full path

Answer

The stanza name should be 'geo_ip' without brackets