SPLK-1002 Advanced Visualization and Lookups Practice Test 9 — 15 Questions

Question 1

A team wants to create a custom visualization that requires JavaScript and CSS modifications. Which Splunk feature should be used?

Accepted Answer

Custom visualization framework. The Custom Visualization Framework (option D) is the correct choice because it is the only Splunk feature that allows developers to create entirely new visualizations using JavaScript and CSS. This framework provides the necessary APIs and hooks to register custom visualization types that can then be used in dashboards, whereas the other options either restrict customization or do not support custom JavaScript/CSS modifications.

Answer

Splunk Web Framework

Answer

Simple XML dashboard

Answer

Dashboard studio

Question 2

Which three considerations are important when creating a visualization for a dashboard that will be displayed on a large monitor? (Choose 3)

Accepted Answer

Ensure the chart type is appropriate for the data. Option B is correct because on a large monitor the audience must grasp the message quickly, so choosing a chart type that matches the data (e.g., bar for categorical comparison, line for trends over time) ensures the visualization communicates accurately rather than misleading or confusing viewers. Option C is correct because high contrast colors improve legibility and accessibility from a distance, which is critical when a dashboard is displayed on a large screen viewed by many people at varying distances. Option D is correct because large-monitor dashboards typically serve as high-level overviews, so drill-down actions let viewers start with summary KPIs and then navigate to detailed views on demand without cluttering the main display. Option A is not appropriate because small font sizes reduce readability at a distance, defeating the purpose of a large-monitor display. Option E is not appropriate because minimizing data points is not a general requirement; the goal is to show the right amount of relevant data, and reducing points arbitrarily can hide important trends or patterns.

Answer

Use small font sizes to fit more information

Answer

Minimize the number of data points

Question 3

What action can the administrator take to resolve this warning?

Accepted Answer

Increase the max_mem_usage_mb setting in limits.conf. The warning is triggered when a lookup exceeds the default memory limit for lookup tables in Splunk. The setting max_mem_usage_mb in limits.conf controls the maximum memory (in MB) that a lookup can consume; increasing it allows larger lookups to be processed without hitting the limit. This directly resolves the warning by raising the threshold, provided the system has sufficient memory. Other options either do not address the memory limit or are workarounds that may not be feasible.

Answer

Split the lookup into multiple smaller files

Answer

Convert the lookup to a KV Store lookup

Answer

Increase max_match in the lookup definition

Answer

Use the lookup command with local=t

Question 4

A Splunk administrator wants to create a static lookup table from a search result. Which approach is recommended?

Accepted Answer

Use the `outputlookup` command to save the search result as a CSV file.. The `outputlookup` command is specifically designed to write the results of a Splunk search to a lookup file, typically in CSV format, which can then be used as a static lookup table. It creates or overwrites the lookup file in the Splunk lookups directory (e.g., `$SPLUNK_HOME/etc/apps/<app>/lookups/`). This is the recommended and most efficient way to generate a static lookup from search results, as it directly materializes the data without manual intervention.

Answer

Use `inputlookup` to write to a CSV file.

Answer

Use the `lookup` command to create the file.

Answer

Manually copy the results into a spreadsheet and upload as CSV.

Question 5

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

Accepted Answer

It defines the time interval for each data point (1 hour).. The span argument in the timechart command defines the time interval for each data point on the chart. In the search `... | timechart span=1h count by status`, span=1h means each data point represents a 1-hour bucket, and the count is aggregated over that hour for each status value. This controls the granularity of the time series.

Answer

It limits the number of status values displayed.

Answer

It groups events into 1-minute intervals.

Answer

It sets the time range of the chart.

Question 6

Which of the following is a recommended practice when creating a lookup table file?

Accepted Answer

Include a header row with field names that contain no spaces.. When creating a lookup table file (typically a CSV), Splunk requires that the first row contain the field names. These field names must not contain spaces because spaces would be interpreted as delimiters or cause parsing errors. Using a header row with no spaces ensures that the lookup fields can be correctly referenced in Splunk searches and configurations, such as in the lookup command or automatic lookups. This practice is explicitly recommended in Splunk documentation to avoid field name ambiguity and ensure compatibility.

Answer

Place the file in the global lookups directory.

Answer

Use mixed case field names.

Answer

Use tab-separated values.

Question 7

A team uses a lookup to enrich web logs with customer region. The lookup is file-based and updated daily. Some events are not being enriched even though the lookup file has matching keys. What could be the issue?

Accepted Answer

The lookup file has leading or trailing spaces in key fields.. File-based lookups in Splunk match on exact string equality between the lookup key field and the event field. If the CSV contains values like 'North America ' (with a trailing space) or ' North America', the match against the event value 'North America' silently fails, so those events are not enriched. This is the classic cause of partial enrichment when the lookup file visibly contains the key.

Answer

The lookup file exceeds the maximum size.

Answer

The lookup file is not sorted.

Answer

The lookup definition uses the wrong timestamp format.

Question 8

An analyst wants to create a visualization showing the average response time by hour over the past day, with each server in a separate line. Which command should they use?

Accepted Answer

`... | timechart span=1h avg(response_time) by server`. The timechart command with span=1h and a by clause on server creates a time-series chart with one line per server, showing the average response time per hour. This directly meets the requirement of average response time by hour with each server as a separate line.

Answer

`... | timechart avg(response_time) by server`

Answer

`... | chart avg(response_time) by hour, server`

Answer

`... | stats avg(response_time) by hour, server`

Question 9

What is the purpose of an automatic lookup?

Accepted Answer

To automatically apply a lookup to events based on a source type or index at search time.. An automatic lookup in Splunk applies a lookup table to events at search time based on the event's source type, source, or host, without requiring the user to type the lookup command. It enriches incoming events transparently by matching fields like src_ip to a CSV of asset owners. This is exactly what option D describes.

Answer

To automatically validate lookup field names.

Answer

To automatically update a lookup file when the CSV changes.

Answer

To automatically create a lookup table from search results.

Question 10

An analyst uses the following search: `index=web status=500 | timechart count by method`. What does the timechart command do?

Accepted Answer

Splits the count by the 'method' field into separate series.. The timechart command in Splunk creates a time-series chart by aggregating data over time intervals. When you use 'timechart count by method', it splits the count into separate series for each value of the 'method' field, plotting them over time. This allows you to see trends for each HTTP method.

Answer

Calculates the total count per day for each method.

Answer

Bins events into 1-hour intervals by default.

Answer

Shows only the top 10 methods.

Question 11

Which THREE of the following are features of the `timechart` command?

Accepted Answer

It automatically creates a time-based chart with a default span.. Option A is correct because `timechart` automatically generates a time-series chart and, when no `span` is given, applies a default span (typically auto-selected based on the search time range, e.g., 1 minute for short ranges). Option B is correct because `timechart` supports the `by` clause (e.g., `... | timechart count by host`) to split results into multiple series, one per distinct value of the split-by field. Option C is correct because `timechart` requires an aggregation function such as `count`, `sum`, `avg`, `max`, or `min` to compute the values plotted over each time bucket. Option D is not a feature of `timechart`; writing results to a lookup file is done with the `outputlookup` command. Option E is incorrect because `span` is optional — `timechart` works without it by choosing a default span automatically.

Answer

It can output results to a lookup file.

Answer

It requires the `span` option to be specified.

Question 12

Where must the file 'departments.csv' be placed for this lookup definition to work?

Accepted Answer

In the lookups directory of the same app where the transforms.conf is defined.. For a lookup definition to work, the CSV file must be placed in the lookups directory of the same app where the transforms.conf is defined. Splunk looks for lookup files relative to the app's directory structure, so the file must reside in $SPLUNK_HOME/etc/apps/<app_name>/lookups/. This ensures the lookup is properly scoped and accessible to the app's configuration.

Answer

In any directory under $SPLUNK_HOME.

Answer

In the $SPLUNK_HOME/etc/apps/search/lookups directory.

Answer

In the $SPLUNK_HOME/etc/system/lookups directory.

Question 13

What type of visualization is produced by the pie command?

Accepted Answer

A pie chart.. The pie command in Splunk transforms search results into a format suitable for a pie chart visualization. It calculates the sum of a specified field for each distinct value of another field and outputs the data in a structure that the pie chart renderer expects. By default, it produces a pie chart when the results are visualized.

Answer

A bar chart.

Answer

A scatter chart.

Answer

A line chart.

Question 14

A company needs to enrich events with lookup data that changes over time, such as daily exchange rates. Which lookup method is most appropriate?

Accepted Answer

Use a time-based lookup with a time_field parameter. A time-based lookup with a time_field parameter allows the lookup to return different values based on the event timestamp. Option A is incorrect because a KV Store lookup is not time-aware by default and would require additional logic. Option B is incorrect because a file lookup without time context cannot handle time-varying data. Option D is incorrect because index-time lookups are static and require reindexing to reflect changes.

Answer

Use a KV Store lookup with a time-range filter in the search

Answer

Use a file lookup without time context

Answer

Use an index-time lookup

Question 15

A security analyst wants to visualize the count of login failures per hour, grouped by source IP. Which SPL command should they use?

Accepted Answer

timechart count by src_ip. The timechart command is purpose-built for time-series visualizations, automatically bucketing events by time and producing a table where each row is a time interval and each column is a distinct value of the split-by field. Using 'timechart count by src_ip' yields a per-hour count of login failures for each source IP, which can be rendered directly as a line or column chart. It also handles time span selection and binning automatically, unlike stats or chart.

Answer

stats count by _time, src_ip

Answer

chart count by src_ip over _time

Answer

eventstats count by src_ip