SPLK-1001 Practice Test 10 — 10 Questions

Question 1

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 2

Which THREE of the following are best practices when designing data models in Splunk?

Accepted Answer

Enable acceleration only on data models that are used frequently.. Option B is correct because data model acceleration consumes significant storage and search resources, so it should be enabled only on frequently used data models to balance performance against cost. Option D is correct because constraints on root events (such as a search filter or field constraint) restrict the dataset to only relevant events, which improves search efficiency and reduces the scope of the data model. Option E is correct because organizing different sourcetypes into separate child objects under a common root event allows each sourcetype to have its own fields and constraints while still sharing the root event's base dataset, which is a recommended hierarchical design. Option A is not a best practice because data models should be designed around the underlying data and business needs, not solely to optimize the most common reports. Option C is not a best practice because including every possible field bloats the data model, increases acceleration costs, and reduces maintainability; fields should be added as needed.

Answer

Design the data model based on the most common reports to ensure quick results.

Answer

Include every possible field in the data model to avoid future modifications.

Question 3

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Accepted Answer

Concatenating two strings: eval fullname = firstname + " " + lastname. Option B is correct because eval can compute a new field using string concatenation with the + operator, so eval fullname = firstname + " " + lastname joins the two string fields with a space. Option D is correct because eval supports arithmetic expressions, so eval ratio = count / total derives a new field by dividing two numeric values. Option E is correct because eval supports conditional functions such as if(), so eval status = if(error > 0, "Error", "OK") creates a field whose value depends on the error count. Option A is not a valid eval use because grouping is done with the by clause of transforming commands like stats or chart, not with eval. Option C is not a valid eval use because sorting is performed by the sort command, not by eval.

Answer

Grouping events by a field: eval by host

Answer

Sorting events by a field: eval sort by _time

Question 4

Which command is used to export the current search results to a CSV file that can be used as a lookup table?

Accepted Answer

outputlookup. The `outputlookup` command is used to export the current search results to a CSV file that can be used as a lookup table. It writes the results to a lookup definition in Splunk, making the data available for subsequent searches via `inputlookup` or automatic lookup configurations.

Answer

outputcsv

Answer

inputlookup

Answer

lookup

Question 5

A user wants to save a search for later use but not schedule it. Which action should the user take?

Accepted Answer

Click Save As > Search.. Clicking Save As > Search saves the search string and properties (time range, mode) as a reusable search without any scheduling or alerting. This allows the user to run the search manually later from the 'Searches & Reports' page without it executing on a schedule.

Answer

Click Save As > Report and schedule it.

Answer

Click Save As > Alert.

Answer

Click Save As > Dashboard Panel.

Question 6

A search returns no results. The user has verified that data is being indexed. What is the most likely cause?

Accepted Answer

The time range picker is set incorrectly. The most likely cause is that the time range picker is set incorrectly. Even if data is being indexed and the search terms are correct, Splunk restricts search results to the selected time range. If the time range does not cover the period when the data was indexed, the search will return no results. This is a common issue because the default time range is often set to "Last 24 hours" or "All time" depending on the user's last selection.

Answer

The search term is misspelled

Answer

The search is using incorrect index name

Answer

The user lacks search permissions

Question 7

Which THREE of the following are valid ways to narrow search results?

Accepted Answer

Using the time range picker. Option A (Using the time range picker) is correct because restricting the search to a specific time window (e.g., Last 15 minutes, Last 24 hours, or a custom range) limits which events are returned, effectively narrowing the result set. Option C (Applying a field filter) is correct because adding a field-value constraint such as status=404 or host=web01 restricts results to only events matching that field condition. Option E (Adding a search term) is correct because including an additional keyword or phrase in the search query requires events to match that term, reducing the number of returned results. Option B (Deleting events) is not a search-narrowing technique; it removes data from the index and does not refine a query. Option D (Changing the source type) alters how data is parsed or categorized rather than narrowing an existing search, so it is not a valid way to narrow results.

Answer

Deleting events

Answer

Changing the source type

Question 8

A security analyst uses Splunk to ingest firewall logs from multiple locations. The index is 'firewall' and the sourcetype is 'fw_log'. Each event contains fields: src_ip, dest_ip, action, bytes, and time. The analyst needs to find how many unique source IPs have been logged in the last hour to report potential scanning activity. The search should be efficient and accurate, returning only the total count of distinct source IPs. Which search accomplishes this?

Accepted Answer

index=firewall sourcetype=fw_log earliest=-1h | stats dc(src_ip) as UniqueIPs. It uses the `stats dc(src_ip)` command, which directly calculates the distinct count of source IPs in a single, efficient pass over the data. The `earliest=-1h` time filter restricts the search to the last hour, and the `as UniqueIPs` alias provides the exact output requested: a single number representing the total count of unique source IPs.

Answer

index=firewall sourcetype=fw_log earliest=-1h | dedup src_ip | stats count as UniqueIPs

Answer

index=firewall sourcetype=fw_log earliest=-1h | top src_ip | stats count as UniqueIPs

Answer

index=firewall sourcetype=fw_log | timechart dc(src_ip) span=1h

Question 9

A search using `| datamodel All_Web data=Web search` returns a large number of results quickly, but the analyst notices the results are inconsistent with a manual search over the same time range. What is the most likely issue?

Accepted Answer

The data model is accelerated and the summary is stale.. When a data model is accelerated, Splunk pre-computes and stores summary data in a TSIDX file. If the acceleration summary becomes stale (i.e., not refreshed within the acceleration time range), the search returns results from the cached summary rather than the raw events, leading to inconsistencies with a manual search over the same time range. This is a common issue when the acceleration summary has not been updated to reflect recent data.

Answer

The data model has a constraint that excludes certain events.

Answer

The data model uses a calculated field that is not properly defined.

Answer

The search head is not properly configured to query the indexers.

Question 10

Which THREE of the following are valid reasons to use data models instead of raw searches?

Accepted Answer

To improve query performance through acceleration.. Option B is correct because data models in platforms like Splunk can include acceleration (e.g., data model acceleration), which pre-computes and stores summarized results to dramatically speed up queries against large datasets. Option D is correct because data models provide a semantic layer that abstracts raw source fields and structures, letting end users work with normalized, business-friendly names rather than knowing the underlying schema. Option E is correct because data models map disparate source types into a common set of field names (e.g., a 'user' field across multiple sourcetypes), enabling consistent cross-source searching. Option A is not correct because real-time indexing is a function of indexers and ingestion pipelines, not data models, which operate on already-indexed data. Option C is not correct because field-level role-based access control is enforced through mechanisms like field filters and role permissions, not through data models themselves.

Answer

To provide real-time indexing of data.

Answer

To enforce role-based access control on specific fields.