SPLK-1002 Advanced Visualization and Lookups Practice Test 7 — 15 Questions

Question 1

A Splunk administrator needs to create a lookup that supports automatic time-based expiration of entries. The lookup will be used to map user accounts to temporary access levels that expire after a set time. Which two configurations are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a time_field in the lookup definition to specify the field that contains the expiration timestamp.. Time-based expiration in lookups is achieved by using a KV Store lookup and defining a time_field that contains the expiration timestamp. Splunk then filters lookup results based on the event time, automatically excluding entries whose time_field is outside the valid range. This enables temporary access levels to expire without manual intervention.

Answer

Enable the lookup to run as a real-time search.

Answer

Use a CSV file and set the lookup to update automatically via a scheduled search.

Answer

Set the match_type to CIDR.

Question 2

A Splunk administrator is configuring a lookup to enrich events with data from an external CSV file. The CSV file is updated daily by an automated process. The administrator wants to ensure that the lookup always uses the most current data without manual intervention. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Define the lookup as a file-based lookup and specify the CSV file path in the lookup definition.. To use an external CSV file as a lookup that automatically reflects updates, the file must be placed in a directory Splunk recognizes for lookups, and a file-based lookup definition must point to it. Because lookups are read at search time, any updates to the file are immediately available without additional configuration. Scheduled reloads or scripted updates are not required.

Answer

Use the 'inputlookup' command in a scheduled search to periodically refresh the lookup data.

Answer

Set the lookup definition to automatically reload the CSV file on a scheduled basis using a saved search.

Answer

Configure the lookup definition to use the 'max_matches' setting to ensure all rows are read.

Question 3

A Splunk administrator needs to create a lookup that supports automatic time-based expiration of entries. The lookup will be used to map user accounts to temporary access levels that expire after a set time. Which two configurations are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a lookup definition with the name `threat_intel` and set the lookup file to `threat_intel.csv`, then use `lookup threat_intel ip AS src_ip` in searches.. Creating a lookup definition and then using the `lookup` command with field aliasing (`ip AS src_ip`) is the correct method to enrich events. This allows Splunk to match the event field `src_ip` to the lookup column `ip` and add the corresponding fields from the CSV. The other options either use invalid syntax or inefficient methods that do not meet the requirement of an automatic lookup definition.

Answer

Use the `inputlookup` command to load the CSV and then join it with the main search using the `join` command on the `ip` field.

Answer

Create a lookup definition with the name `threat_intel` and set the lookup file to `threat_intel.csv`, then use `lookup threat_intel src_ip` in searches.

Answer

Use the `lookup` command with the `match` option: `lookup threat_intel ip match src_ip`.

Question 4

A Splunk power user is building a dashboard that displays a table of failed login attempts. The table should show the username, source IP, and the number of attempts. The user wants to add a column that shows the geographic region for each source IP, using a lookup file `geo.csv` that maps IP ranges to regions. The lookup is already defined as `geo_lookup` with CIDR matching. Which search should the user run to produce the table?

Accepted Answer

index=security action=failure | stats count by user, src_ip | lookup geo_lookup src_ip | table user, src_ip, count, region. The correct search uses `stats` to aggregate failed logins, then `lookup` to enrich with the region from geo_lookup. The lookup is defined with CIDR matching, so it correctly maps src_ip to region. The other options either use incorrect field names, unnecessary clauses, or could cause issues with field overwrites.

Answer

index=security action=failure | stats count by user, src_ip | lookup geo_lookup IP AS src_ip | table user, src_ip, count, region

Answer

index=security action=failure | stats count by user, src_ip | lookup geo_lookup src_ip OUTPUT region | table user, src_ip, count, region

Answer

index=security action=failure | stats count by user, src_ip | lookup geo_lookup src_ip OUTPUTNEW region | table user, src_ip, count, region

Question 5

A retail analytics team wants a dashboard panel that shows the top five product categories by revenue for each store region, with region used to split the visualization into separate small panels. They are configuring a chart that supports trellis layout. Which two attributes must they set on the visualization to achieve one small panel per region? (Choose two.)

Accepted Answer

Enable trellis layout on the visualization and choose the split-by field.. Trellis splitting requires the layout to be enabled and a split-by field to be chosen. Enabling trellis layout tells the visualization to render multiple small panels, and selecting region as the split-by field creates one panel for each region value. Axis assignment, filtering, and time overrides do not produce the per-region panel grid the team wants.

Answer

Set the chart's y-axis to region so each region gets its own axis.

Answer

Add a where clause that filters the search to a single region.

Answer

Configure a panel-level time range override for each region.

Question 6

An analyst runs a search that uses a lookup to add a field called department to events based on a user ID. The lookup table is large and the search is slow. The analyst wants to improve performance by ensuring the lookup is only performed when necessary. Which of the following should be used in the search to achieve this?

Accepted Answer

Use the lookup command with the if function to conditionally apply the lookup. To optimize lookup performance, you should filter events before the lookup command so that the lookup only processes the reduced set. While the lookup command does not have a conditional argument, you can use the if function in combination with a subsearch to conditionally perform the lookup. This reduces the number of lookups performed, improving search speed.

Answer

Use the lookup command with the local=true argument

Answer

Use the lookup command with the match_type=CIDR argument

Answer

Use the lookup command as a subsearch with the return command

Question 7

A network engineer is building a dashboard that shows the top 10 source IPs by event count. The panel should display the IP address, the count, and a percentage of total events. The engineer uses a stats command to calculate counts, then wants to add a calculated field for the percentage. Which Splunk dashboard feature should be used to add the percentage column without modifying the base search?

Accepted Answer

Configure a calculated field in the dashboard panel's visualization settings. Splunk dashboards allow calculated fields to be added in the visualization settings, such as table column formatting. This creates a new field based on existing fields without changing the underlying search. Using eval in the search or a post-process search would modify or add searches, while a lookup would be static and not reflect current results.

Answer

Use a post-process search to calculate the percentage

Answer

Add a calculated field in the dashboard panel's search using eval

Answer

Create a new lookup table with the percentage values

Question 8

A Splunk administrator needs to create a lookup that supports automatic time-based expiration of entries. The lookup will be used to map user accounts to temporary access levels that expire after a set time. Which two configurations are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a lookup definition in `transforms.conf` within the `search` app, place the CSV file in the `lookups` directory, and set permissions to read-only for all users.. To make the lookup available in the `search` app and protect it, the administrator should define the lookup in `transforms.conf` within the `search` app, store the CSV in the app's `lookups` directory, and set permissions to read-only for all users. This ensures availability, automatic updates from the external process, and prevents accidental changes.

Answer

Create a lookup definition in `transforms.conf` within a dedicated app and set the app's permissions to read-only for all users.

Answer

Create a lookup definition in `transforms.conf` within the `search` app and use the `outputlookup` command to update the CSV file nightly.

Answer

Create a lookup definition in `transforms.conf` within the `search` app and set permissions to global.

Question 9

A Splunk user wants to create a lookup that maps employee IDs to employee names and departments. The data is currently in a CSV file with columns: employee_id, name, department. The user needs to use this lookup in a search to display the department for each employee ID found in the events. Which lookup definition configuration is required?

Accepted Answer

Define the lookup in transforms.conf with `filename = employee.csv` and `match_type = EXACT`.. For a CSV lookup mapping employee IDs to names and departments, an EXACT match type is required. This ensures that each employee ID is matched precisely. CIDR and WILDCARD are inappropriate for this data. While omitting match_type defaults to EXACT, explicitly setting it is recommended and is the correct configuration.

Answer

Define the lookup in transforms.conf with `filename = employee.csv` and `match_type = WILDCARD`.

Answer

Define the lookup in transforms.conf with `filename = employee.csv` and `match_type = CIDR`.

Answer

Define the lookup in transforms.conf with `filename = employee.csv` and no match_type specified.

Question 10

A Splunk user is creating a dashboard that includes a choropleth map to visualize the number of attacks by country. The search returns a field named `country` with two-letter country codes and a field named `count`. Which visualization setting must be configured to ensure the map displays correctly?

Accepted Answer

Configure the map to use the `country` field as the feature ID and ensure the field contains ISO 3166-1 alpha-2 codes.. Choropleth maps in Splunk require a field containing ISO 3166-1 alpha-2 country codes, typically named `country`. The map visualization automatically uses the built-in `geo` lookup to map these codes to country boundaries. Configuring the map to use the `country` field as the feature ID ensures the correct shading based on the `count` field.

Answer

Set the map's `country` field to use the `geo_country` lookup.

Answer

Set the map's `country` field to use the `geo_attr_countries` lookup.

Answer

Add a `geostats` command to the search to calculate the map coordinates.

Question 11

A Splunk user needs to create a dashboard that displays a map of the United States with markers sized by the number of events from each state. The events contain a field `state` with two-letter abbreviations. Which of the following is required to create this visualization?

Accepted Answer

Use the `geostats` command with the `state` field and select the Choropleth map visualization.. The `geostats` command is specifically designed to aggregate geographic data and prepare it for map visualizations like Choropleth. It can take a field like `state` and compute statistics (e.g., count) per region, which the Choropleth map then displays with color intensity. Other commands either do not handle geographic aggregation or are intended for different purposes.

Answer

Use the `iplocation` command to convert the `state` field to latitude and longitude, then select the Scatter map visualization.

Answer

Use the `stats count by state` command and select the Choropleth map visualization.

Answer

Use the `geom` command with the `state` field and select the Choropleth map visualization.

Question 12

A compliance team needs a report that shows, for each of the last 12 weeks, the number of privileged logins, with each week as its own column and the login source as the row label. The data arrives in a single index and each event carries a source_system field. Which approach produces that layout?

Accepted Answer

| timechart span=1w count BY source_system. To lay weeks across the chart as columns while each login source becomes a row, the search must aggregate with a time-based span and split the series by the categorical field. The timechart command with a weekly span and a BY clause on source_system does exactly that in one step, generating one column per week and one series per source system.

Answer

| timechart span=1w count BY source_system useother=f

Answer

| chart count OVER source_system BY date_week

Answer

| stats count BY source_system, date_week

Question 13

A Splunk user wants to create a lookup that can be shared across multiple apps. The lookup file is named `products.csv` and is currently stored in the `search` app. Which of the following is the best practice to share this lookup with other apps?

Accepted Answer

Move the CSV file to the `lookups` directory of the `search` app and create a lookup definition with global permissions.. To share a lookup across multiple apps, the CSV file should reside in a central location, typically the `lookups` directory of the `search` app, and the lookup definition should have global permissions. This allows all apps to reference the lookup without duplicating the file. Copying files or setting per-app permissions is inefficient and harder to maintain.

Answer

Create a lookup definition in the `search` app and set its permissions to app-level for each specific app.

Answer

Copy the CSV file to the `lookups` directory of each app that needs it and create local lookup definitions.

Answer

Store the CSV file in a custom app and create a lookup definition with global permissions, then reference it from other apps.

Question 14

A Splunk administrator needs to ensure that a lookup file named `assets.csv` is automatically updated from an external REST API every hour. The lookup is used in several dashboards. Which configuration should the administrator use?

Accepted Answer

Create a lookup definition with the `external` type and specify the REST API endpoint in the `external_cmd` setting.. External lookups are designed to integrate with external systems via scripts or commands. By defining a lookup with type `external` and specifying the command in `external_cmd`, Splunk can execute the command to fetch data from the REST API. This allows dynamic updates when the lookup is invoked. To automate hourly updates, a scheduled search can run a command that triggers the external lookup and writes the results to a file or KV Store if needed, but the core mechanism is the external lookup definition.

Answer

Create a lookup definition with the `geo` type and point it to the REST API endpoint.

Answer

Create a lookup definition with the `kvstore` type and set up a saved search to populate the KV Store collection hourly.

Answer

Create a lookup definition with the `file` type and configure a scripted input to overwrite the CSV file hourly.

Question 15

A Splunk power user has a lookup file `employees.csv` containing fields `employee_id`, `name`, and `department`. They want to create a search that returns the total count of events per department from the `web_logs` index, but only for departments that exist in the lookup file. The lookup should be used to filter the events based on the `department` field in the logs. Which search efficiently achieves this?

Accepted Answer

index=web_logs | lookup employees.csv department OUTPUT department | where isnotnull(department) | stats count by department. The lookup command is designed to enrich events by matching fields. By using OUTPUT department and then filtering with isnotnull, the search retains only events that have a matching department in the lookup. This is efficient because the lookup is applied during the search pipeline, and filtering occurs before aggregation, reducing the data processed by stats.

Answer

index=web_logs [ | inputlookup employees.csv | fields department ] | stats count by department

Answer

index=web_logs | join department [ | inputlookup employees.csv ] | stats count by department

Answer

index=web_logs | stats count by department | search [ | inputlookup employees.csv | fields department ]