SPLK-1002 Advanced Visualization and Lookups Practice Test 8 — 15 Questions

Question 1

An analyst is creating a dashboard that uses a lookup to translate status codes into descriptive text. The lookup file is updated weekly by a script. The analyst wants to ensure that the dashboard always uses the latest version of the lookup file without manual intervention. What should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the lookup as a file-based lookup and configure the script to write the updated CSV file to the Splunk lookups directory weekly.. File-based lookups are automatically reloaded when the underlying CSV file changes. By having the weekly script write the updated CSV directly to the Splunk lookups directory, the dashboard will always use the latest data without manual intervention. This is the most efficient method for periodically updated static data. The other options either do not update the data, add unnecessary complexity, or require real-time invocation.

Answer

Define the lookup as an external lookup and have the script provide the data via stdout when the lookup is invoked.

Answer

Define the lookup as a KV Store lookup and use the script to update the KV Store collection weekly via the REST API.

Answer

Define the lookup as a file-based lookup and schedule a search to run `| inputlookup status_codes | outputlookup status_codes` weekly.

Question 2

A Splunk Power User is configuring a lookup to enrich events with user department information from an HR database. The HR database is accessible via a REST API that returns JSON. The lookup must be updated in real-time as the HR database changes. Which two actions should the user take to meet these requirements? (Choose two.)

Accepted Answer

Configure the script to output the JSON data in a format that Splunk can parse, such as CSV or JSON lines.. To achieve real-time enrichment from a REST API, an external lookup is required. The script defined in the external lookup must query the API and return the data in a format Splunk can parse, such as CSV or JSON. This ensures that every time the lookup is invoked in a search, the latest data is fetched. The other options involve batch updates or incorrect lookup types, which would not satisfy the real-time requirement.

Answer

Use the `outputlookup` command in a scheduled search to write the API results to a KV Store collection.

Answer

Define the lookup as a `geo` lookup and map the department field to a geographic location.

Answer

Create a lookup definition with type `file` and schedule a search to update the CSV file every minute.

Question 3

A dashboard shows a single-value visualization of total sales. The underlying search uses `| stats sum(sales)`. The dashboard refreshes every 5 minutes, but the value only updates when the page is manually reloaded. Which setting is MOST likely missing?

Accepted Answer

The search is not scheduled or set to 'Auto' for the panel.. The single-value visualization's search must be scheduled or set to 'Auto' to automatically re-execute on dashboard refresh. Without this setting, the search runs once when the dashboard loads and caches the result, so even with a 5-minute auto-refresh interval, the displayed value remains stale until the page is manually reloaded.

Answer

The 'Token delay' is too high.

Answer

The time range picker is set to 'All time'.

Answer

The dashboard's 'Auto-refresh' interval is not set.

Question 4

A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?

Accepted Answer

The chart's 'Time range override' is set to 24 hours.. The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.

Answer

The 'Max rows' is set to 24.

Answer

The 'Span' is set to 1 hour.

Answer

The data source only retains 24 hours.

Question 5

An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?

Accepted Answer

The lookup definition is not configured as a CIDR type. The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet. Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.

Answer

The IP addresses in the events are in lowercase

Answer

The lookup file is not in CSV format

Answer

The lookup file is compressed and not being read correctly

Question 6

Which TWO of the following are valid methods to create a lookup table in Splunk?

Accepted Answer

Upload a CSV file through the Splunk Web interface. Splunk Web provides a direct interface to upload a CSV file and define it as a lookup table, automatically creating the lookup definition and file. Option D is correct because the `outputlookup` command in a search writes search results to a CSV file in the lookups directory, effectively creating a lookup table from dynamic data.

Answer

Use the eval command to create a lookup definition

Answer

Use the stats command to aggregate data into a lookup

Answer

Use the inputlookup command in a search

Question 7

A security analyst wants to visualize the count of login failures by source IP over the last 24 hours, but only for IPs with more than 10 failures. Which visualization type and SPL command combination is most appropriate?

Accepted Answer

Column chart with | stats count by src_ip | where count > 10. It uses `stats count by src_ip` to aggregate login failures per source IP, then `where count > 10` to filter only IPs exceeding 10 failures, and a column chart is ideal for comparing discrete counts across categories (IP addresses). This combination directly answers the requirement: visualize count of failures by IP, with a threshold filter applied after aggregation.

Answer

Line chart with | top limit=10 showcount=1 by src_ip

Answer

Scatter plot with | stats dc(src_ip) by failure

Answer

Pie chart with | chart count over src_ip | where count > 10

Question 8

A team uses a lookup table to map employee IDs to department names. The lookup is defined in transforms.conf with max_matches=1. Some events have multiple employee IDs in the emp_id field (comma-separated). The analyst wants to see the department for each ID. Which approach should be used?

Accepted Answer

Use | eval emp_ids=split(emp_id, ",") | mvexpand emp_ids | lookup employee_lookup emp_id OUTPUT department. It first splits the comma-separated emp_id field into a multivalue field using split(), then expands each value into its own event with mvexpand, and finally performs the lookup with max_matches=1 to retrieve the department for each individual ID. This ensures that the lookup processes each ID separately, even though the original field contained multiple values.

Answer

Use | makemv delim="," emp_id | lookup employee_lookup emp_id OUTPUT department

Answer

Use | eval department=match(emp_id, "(?i)" . lookup_table)

Answer

Use | inputlookup employee_lookup where emp_id IN (emp_id_field)

Question 9

Which TWO statements about lookups in Splunk are correct? (Choose two.)

Accepted Answer

The lookup command can be used to add fields from a lookup table to search results. The `lookup` command in Splunk is specifically designed to enrich search results by adding fields from a lookup table (such as CSV, KV Store, or external lookups) based on matching field values. This is a fundamental use case for lookups in Splunk, allowing you to augment raw event data with additional context from a static or dynamic source.

Answer

External lookups can only be used with CSV files

Answer

CSV lookups can be updated in real-time by adding rows to the CSV file

Answer

Automatic lookups are configured in macros.conf

Question 10

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 11

A Splunk admin is tasked with creating a dashboard that shows the average response time per server over the last hour, updated every 60 seconds. The data comes from a sourcetype 'app_log' with fields: server, response_time. The admin wants to use a single search with a timechart and set the dashboard's time range picker to 'Last 60 minutes'. However, the chart shows only one data point (the average for the entire hour) instead of per-minute intervals. What is the most likely cause and solution?

Accepted Answer

The timechart command does not have a span specified; add | timechart span=1m avg(response_time) by server. The `timechart` command without an explicit `span` defaults to a single bucket for the entire search time range when the range is fixed (e.g., 'Last 60 minutes'). By adding `span=1m`, you force the command to create 1-minute buckets, producing a data point per minute. This is the most direct fix for the described behavior.

Answer

The dashboard uses a summary index; switch to a base search

Answer

The search is not set to real-time; change to a real-time search

Answer

The dashboard time range picker is set to 'All time'; change to 'Last 60 minutes'

Question 12

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 13

A company has a lookup table that contains product prices that change over time. The lookup has a 'valid_from' and 'valid_to' field. Which lookup type should be defined in transforms.conf to automatically match events to the correct price based on the event timestamp?

Accepted Answer

Time-based lookup. A time-based lookup in transforms.conf uses the 'time_field', 'time_format', and 'max_offset_secs' settings to match an event's timestamp against the valid_from and valid_to fields in the lookup table, returning the row whose time range contains the event time. This is exactly the mechanism needed for a price table that changes over time, because a standard CSV lookup would only match on key fields and ignore the temporal validity window.

Answer

CSV lookup

Answer

KV Store lookup

Answer

External lookup

Question 14

A dashboard developer wants to display the count of errors over the last 24 hours with a line chart. Which search command should be the final command before the visualization?

Accepted Answer

timechart. The `timechart` command is designed to create time-series data, aggregating results into time buckets and producing a table suitable for a line chart. It automatically generates a `_time` field and is the standard command for displaying metrics over time, such as error counts over the last 24 hours. Therefore, `timechart` should be the final command before the visualization.

Answer

chart

Answer

trendline

Answer

stats

Question 15

A SOC manager wants to plot locations of security incidents on a map using latitude and longitude fields. Which visualization type should be used in a Splunk dashboard?

Accepted Answer

Cluster map. A cluster map is the correct choice because it is specifically designed to plot individual geographic coordinates (latitude/longitude) as points on a map, and it automatically groups nearby points into clusters to improve readability when many incidents are present. In Splunk, the cluster map visualization uses the `geostats` command or directly ingests lat/lng fields to render markers, making it ideal for showing security incident locations without requiring predefined region boundaries.

Answer

Choropleth map

Answer

Pie chart

Answer

Scatter chart