SPLK-1002 Practice Test 10 — 10 Questions

Question 1

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

Accepted Answer

Add an index to the lookup file by converting to KV Store. Option B is correct because creating an index on the lookup fields (like using a KV Store or using a time-based lookup with indexed fields) can speed up matching. Alternatively, filtering the lookup before joining reduces rows processed. Option A is wrong because maxmatches is only useful if there are multiple matches. Option C is wrong because changing to external lookup adds overhead. Option D is wrong because increasing timeout doesn't improve performance.

Answer

Switch to an external lookup that queries a database

Answer

Increase the lookup timeout value

Answer

Increase the max_matches setting for the lookup

Question 2

A user wants to see the values of all fields in an event, including fields that are not automatically extracted. Which search command should be used?

Accepted Answer

`| table *`. The `| table *` command displays all fields in each event, including those not automatically extracted, by listing every field in a tabular format. This is because the asterisk wildcard in `table` includes all fields present in the search results, regardless of whether they are extracted by default or through custom parsing. In contrast, `| fields *` only retains fields that are already known to the search index, not necessarily showing all raw event data.

Answer

`| rex`

Answer

`| fields *`

Answer

`| spath`

Question 3

An analyst wants to compute the average response time for each server from web server logs. The field `response_time` is a string like '120ms'. What is the correct way to convert and compute?

Accepted Answer

eval response_num=replace(response_time, "ms", "") | eval response_num=response_num*1 | stats avg(response_num) by server. Option B is correct because it uses eval to convert the string to a number by removing 'ms' and multiplying by 1 (or using tonumber). Option A is wrong because it adds literal 'ms' to numeric values. Option C is wrong because replace doesn't convert to numeric. Option D is wrong because it adds the unit back.

Answer

eval response_time=response_time + "0" | stats avg(response_time) by server

Answer

eval response_num=replace(response_time, "ms", "") | stats avg(response_num) by server

Answer

eval avg_response=avg(response_time)

Question 4

A team uses a lookup to map IP addresses to geographic locations. The lookup is large and updated weekly. Which lookup type is best suited?

Accepted Answer

File-based CSV lookup. Option A is correct because file-based CSV lookups are ideal for static, regularly updated data. Option B is wrong because KV store is for real-time updates and dynamic data. Option C is wrong because external lookups require external scripts. Option D is wrong because scripted lookups are for custom logic, not necessary here.

Answer

External lookup

Answer

Scripted lookup

Answer

KV store lookup

Question 5

A search includes a lookup that returns multiple matches for a single event. The analyst wants to keep only the first match. Which lookup command option should they use?

Accepted Answer

max_matches=1. Option B is correct because the max_matches option controls how many results to keep; setting it to 1 keeps the first match. Option A is wrong because local is for time-based lookup. Option C is wrong because append is for adding fields from external. Option D is wrong because update is for outputlookup.

Answer

update=t

Answer

local=t

Answer

append=t

Question 6

Refer to the exhibit. A user runs a search with `| lookup excel_lookup product_id OUTPUT sales_rep`. For a product_id that exists in the CSV but with a different case (e.g., "ABC123" vs "abc123"), what will be the value of the `sales_rep` field after the lookup?

Accepted Answer

"N/A" because the case does not match and default_match is set.. Option B is correct because case_sensitive_match=true means the cases must match exactly. Since there is no exact match, the lookup will use the default_match value, which is "N/A". Option A is wrong because case differs. Option C wrong because empty string is not used. Option D wrong because no error occurs.

Answer

The correct sales_rep from the lookup.

Answer

An error because case mismatch.

Answer

An empty string because no match.

Question 7

A search uses a lookup to enrich results with a field 'status'. After the lookup, some events have empty status values. The lookup file contains a mapping for all possible status codes. What is a likely reason for empty values?

Accepted Answer

The lookup field name in the event does not match the lookup key.. Option D is correct because the lookup command matches a field in the event (the lookup key) against a field in the lookup file. If the field name in the event does not exactly match the lookup key field name in the lookup file, no match occurs, and the output field (e.g., 'status') remains empty. This is a common misconfiguration when the lookup key field is misspelled or has a different case.

Answer

The events are not indexed.

Answer

The lookup command uses output_fields incorrectly.

Answer

The lookup file has duplicate keys.

Question 8

Refer to the exhibit. The lookup `usertable` has fields: user, role, department. The search returns an error: "Error in 'where' command: Field 'role' is not defined." What is the most likely cause?

Accepted Answer

The lookup file does not have a column named 'role'.. Option C is correct because the error indicates 'role' field is missing. Most likely the lookup file does not have a column named 'role'. Option A is wrong because 'role' is not a reserved word. Option B is wrong because misspelling would cause file not found. Option D is wrong because inputlookup does output fields.

Answer

The `inputlookup` command does not output fields that can be used with `where`.

Answer

The field 'role' is not a valid field in the lookup because it is a reserved word.

Answer

The lookup name 'usertable' is misspelled.

Question 9

Which command is used to export the current search results to a CSV file that can be used as a lookup table?

Accepted Answer

outputlookup. The `outputlookup` command is used to export the current search results to a CSV file that can be used as a lookup table. It writes the results to a lookup definition in Splunk, making the data available for subsequent searches via `inputlookup` or automatic lookup configurations.

Answer

outputcsv

Answer

inputlookup

Answer

lookup

Question 10

A user wants to create a lookup table to enrich events with customer information. Which file format is NOT supported for a classic CSV-based lookup?

Accepted Answer

XLSX. Classic CSV-based lookups in Splunk only support delimited text files such as CSV (comma-separated) and TSV (tab-separated). XLSX is a binary Excel format that is not supported for classic CSV-based lookups; it requires a different lookup type (e.g., a KV store lookup or a scripted lookup) or must be converted to CSV first.

Answer

TSV

Answer

CSV

Answer

JSON