Splunk Core Certified User SPLK-1002 practice test

During a data model acceleration build, the following error appears in splunkd.log: 'Data model acceleration: not enough memory to complete summary build.' Which best practice should the administrator implement to prevent this error?

Trap 1: Remove unnecessary fields from the data model to reduce complexity.

Removing fields may help but memory error is about process allocation, not field count.

Trap 2: Reduce the summary range to less than 7 days.

Reducing range may reduce memory needs but is not a direct fix for memory allocation.

Trap 3: Use tstats instead of data model acceleration for queries.

tstats relies on acceleration; it does not address the build memory error.

A
Remove unnecessary fields from the data model to reduce complexity.
Why wrong: Removing fields may help but memory error is about process allocation, not field count.
B
Increase the memory allocation for the data model acceleration process.
The error indicates insufficient memory; increasing allocation resolves it.
C
Reduce the summary range to less than 7 days.
Why wrong: Reducing range may reduce memory needs but is not a direct fix for memory allocation.
D
Use tstats instead of data model acceleration for queries.
Why wrong: tstats relies on acceleration; it does not address the build memory error.

Question 2mediummulti select

Which TWO are best practices for creating data models in Splunk? (Choose two.)

Trap 1: Base data models on indexed fields rather than search-time…

Data models work with search-time fields; indexed fields are not directly referenced.

Trap 2: Create many-to-many relationships between root events and child…

Many-to-many relationships are complex and can degrade performance.

Trap 3: Include all available fields to ensure maximum flexibility.

Including all fields increases complexity and reduces acceleration performance.

A
Use data model acceleration to improve query performance on large datasets.
Acceleration pre-computes summaries for faster searches.
B
Base data models on indexed fields rather than search-time extracted fields.
Why wrong: Data models work with search-time fields; indexed fields are not directly referenced.
C
Design data models based on the specific use cases and queries they will support.
Focused data models improve performance and maintainability.
D
Create many-to-many relationships between root events and child datasets.
Why wrong: Many-to-many relationships are complex and can degrade performance.
E
Include all available fields to ensure maximum flexibility.
Why wrong: Including all fields increases complexity and reduces acceleration performance.

Question 3easymultiple choice

A user reports that a data model acceleration is consuming excessive disk space on the indexer. The data model has a summary range of 90 days. Which action is best to reduce disk space usage while maintaining acceptable query performance?

Trap 1: Increase the acceleration frequency to rebuild summaries more often.

More frequent rebuilds may increase disk I/O but not reduce space.

Trap 2: Disable acceleration for the data model.

Disabling acceleration removes all summaries, impacting query performance.

Trap 3: Delete old indexed data that is not frequently queried.

Deleting indexed data is drastic and may violate retention policies.

A
Increase the acceleration frequency to rebuild summaries more often.
Why wrong: More frequent rebuilds may increase disk I/O but not reduce space.
B
Reduce the summary range to 30 days.
A shorter summary range reduces the amount of summary data, saving disk space.
C
Disable acceleration for the data model.
Why wrong: Disabling acceleration removes all summaries, impacting query performance.
D
Delete old indexed data that is not frequently queried.
Why wrong: Deleting indexed data is drastic and may violate retention policies.

Question 4mediummultiple choice

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

Trap 1: Data Summary

Data Summary lists sourcetypes and indexes, not search results.

Trap 2: Dashboard panel

Dashboards display saved searches, not ad-hoc queries.

Trap 3: Alert action

Alerts send notifications based on saved searches, not immediate investigation.

A
Data Summary
Why wrong: Data Summary lists sourcetypes and indexes, not search results.
B
Dashboard panel
Why wrong: Dashboards display saved searches, not ad-hoc queries.
C
Alert action
Why wrong: Alerts send notifications based on saved searches, not immediate investigation.
D
Search bar in the Search & Reporting app
The search bar allows running a query across all data.

Question 5hardmultiple choice

A search includes the command '| stats dc(user) by host'. What does this command return?

Trap 1: The number of unique hosts per user

Grouped by host, not user.

Trap 2: The count of events per host

dc(user) is distinct count, not event count.

Trap 3: The sum of user values per host

Sum is not applicable to strings.

A
The number of unique hosts per user
Why wrong: Grouped by host, not user.
B
The count of events per host
Why wrong: dc(user) is distinct count, not event count.
C
The sum of user values per host
Why wrong: Sum is not applicable to strings.
D
The number of distinct users per host
dc(user) counts distinct users.

Read the full NAT/PAT explanation →

Question 6hardmultiple choice

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined | stats count by clientip, sessionid, productid | sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Trap 1: Use 'eventstats count by clientip, sessionid' and then filter where…

eventstats does not reduce events, still processes all.

Trap 2: Use the 'transaction' command to group events by clientip and…

Transaction is more resource-intensive than stats.

Trap 3: Add a 'where' command after stats to filter out internal IPs and…

Internal IPs are not filtered early, still processes all data.

A
Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.
Why wrong: eventstats does not reduce events, still processes all.
B
Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.
Why wrong: Transaction is more resource-intensive than stats.
C
Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.
Why wrong: Internal IPs are not filtered early, still processes all data.
D
Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.
Filters early, uses efficient stats, then filters and sorts on reduced data.