SPLK-1001 Practice Test 1 — 10 Questions

Question 1

Drag and drop the steps to create a new Splunk index into the correct order.

Accepted Answer

Access the Indexes settings page, then enter the index name and other parameters, then click Save to create the index.. Creating a new index in Splunk involves accessing the Indexes settings page, specifying index parameters, and saving the configuration.

Answer

Enter index parameters first, then access the Indexes settings page, then click Save.

Answer

Access the Indexes settings page, then click Save, then enter index parameters.

Answer

Click Save first, then access the Indexes settings page, then enter index parameters.

Question 2

You are a Splunk analyst for a financial services firm. You need to create a weekly report for management showing the total transaction value and number of transactions per day, broken down by transaction type (credit, debit, transfer). The data is in index=transactions with fields: trans_date, trans_type, amount. The report should be sent via email every Monday morning at 8 AM. You have created a report with the search: `index=transactions | timechart sum(amount) by trans_type`. However, the timechart shows only one series because the trans_type field has multiple values. You need to fix the search so that it correctly separates by trans_type. Additionally, you need to schedule the report. What should you do?

Accepted Answer

Use `| eval trans_type=split(trans_type, ",") | mvexpand trans_type | timechart sum(amount) by trans_type`.. The trans_type field contains multiple values in a single field (e.g., 'credit,debit,transfer'), so you must first split the values using `split()` and then expand them with `mvexpand` before using `timechart` to correctly separate the series. This ensures each transaction type is treated as an individual event for the aggregation.

Answer

Add `| stats sum(amount) by _time, trans_type` before timechart.

Answer

Use `| chart sum(amount) by trans_type` instead of timechart.

Answer

Use `| makemv trans_type | timechart sum(amount) by trans_type`.

Question 3

A Splunk administrator receives a complaint that a saved search is slow. The search uses a lookup to enrich events with a CSV file that has 500,000 rows. Which optimization is most effective?

Accepted Answer

Filter events early using eval or where before applying the lookup.. Filtering events early with `eval` or `where` reduces the volume of data that must be processed by the lookup command. Since lookups perform a row-by-row match against a 500,000-row CSV, minimizing the number of events before the lookup drastically cuts I/O and CPU overhead, making the search faster.

Answer

Sort events by the lookup key field before the lookup command.

Answer

Convert the CSV lookup to a KV store lookup for faster access.

Answer

Increase the search time range to process more events at once.

Question 4

Which THREE of the following statements about data model acceleration are true?

Accepted Answer

Accelerated data models consume disk space.. Accelerated data models store pre-computed summary tables on disk, which consume disk space. These summaries are built by the acceleration process and persist until the summary range expires or the data model is re-accelerated.

Answer

Accelerated data models cannot be used with the '| tstats' command.

Answer

The acceleration process can be scheduled to run at specific times.

Question 5

You are a Splunk administrator at a large e-commerce company. The operations team has created a real-time dashboard to monitor website performance. The dashboard includes multiple panels: a line chart showing page load times over the last 60 minutes, a single value showing the number of active users, and a table listing the top 10 slowest pages. The dashboard refreshes every 30 seconds. Recently, users have reported that the dashboard is very slow to load and sometimes times out. The underlying searches are not accelerated. The dashboard uses a shared time range picker set to 'Last 60 minutes'. The index for web logs receives about 2 GB of data per hour. The team wants to improve performance without losing real-time capability. Which approach best addresses the problem?

Accepted Answer

Reduce the time range to 'Last 15 minutes' and keep the 30-second refresh.. Reducing the time range to 'Last 15 minutes' significantly decreases the volume of data each search must scan, which directly reduces search execution time and dashboard load time. Since the dashboard refreshes every 30 seconds, a shorter time range still provides near-real-time visibility while preventing timeouts. The underlying searches are not accelerated, so limiting the data scanned is the most effective immediate performance improvement.

Answer

Increase the refresh interval to 5 minutes to reduce search frequency.

Answer

Implement summary indexing for the searches and run them every 5 minutes.

Answer

Remove the single value panel to reduce the number of searches.

Question 6

Refer to the exhibit. An admin sees that the Web_Traffic data model is accelerated but shows 'Summaries require rebuild'. What does this status indicate?

Accepted Answer

The data model definition has been modified and acceleration needs to be rebuilt.. When a data model is accelerated and shows 'Summaries require rebuild', it indicates that the data model definition has been modified (e.g., fields, constraints, or root events changed) since the last summary build. Splunk detects this change and marks the acceleration summaries as stale, requiring a rebuild to ensure query results reflect the updated definition. This is a built-in mechanism to maintain data integrity between the model and its accelerated summaries.

Answer

The disk space for acceleration is full.

Answer

The summary range is too short and needs to be extended.

Answer

The acceleration summaries are up to date and optimal.

Question 7

A team creates a dashboard that uses a drop-down input to select a server. The dashboard slows down significantly when the input changes. What is the most likely cause?

Accepted Answer

The input's search is not using a summary index or accelerated data. A drop-down input that triggers a search each time the user selects a new value can cause significant performance degradation if the underlying search is not optimized. Using a summary index or accelerated data allows the dashboard to retrieve pre-computed results instead of running a full raw data search on every selection, reducing load on the search head and indexers.

Answer

The input is based on a report that runs every hour

Answer

The token name is too long

Answer

The input's results are cached too aggressively

Question 8

Refer to the exhibit. A security analyst runs a search to identify HTTP 500 errors over time. Which time period shows the highest count of 500 errors?

Accepted Answer

04:00:00 - 05:00:00. The exhibit shows the highest count of HTTP 500 errors occurring between 04:00:00 and 05:00:00, with a count of 89. This is determined by comparing the values for each hourly bucket: A: 23, B: 45, C: 67, D: 89. The highest value is 89, corresponding to the 04:00-05:00 time period.

Answer

00:00:00 - 01:00:00

Answer

01:00:00 - 02:00:00

Answer

03:00:00 - 04:00:00

Question 9

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. It filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 10

An analyst wants to compute the average response time for each server from web server logs. The field `response_time` is a string like '120ms'. What is the correct way to convert and compute?

Accepted Answer

eval response_num=replace(response_time, "ms", "") | eval response_num=response_num*1 | stats avg(response_num) by server. It first uses `replace` to strip the 'ms' suffix from the string field `response_time`, then multiplies the resulting string by 1 (`response_num*1`) to coerce it into a numeric type. Only after conversion can `stats avg(response_num) by server` compute a meaningful average. Without the numeric coercion, Splunk would treat the field as a string and either fail or produce incorrect results.

Answer

eval response_time=response_time + "0" | stats avg(response_time) by server

Answer

eval response_num=replace(response_time, "ms", "") | stats avg(response_num) by server

Answer

eval avg_response=avg(response_time)