SPLK-1002 Practice Test 11 — 15 Questions

Question 1

A Splunk administrator notices that a lookup definition named 'assets' is not returning any results in searches even though the CSV file exists and has data. The lookup definition uses the filename 'assets.csv' and the matching field 'ip' matches the event field 'dest_ip'. The search query 'index=main | lookup assets ip AS dest_ip OUTPUT asset_name' returns no asset_name values. What is the most likely cause?

Accepted Answer

The user may not have permissions to access the lookup definition; check the knowledge object permissions. Option C is correct because the lookup definition exists and the CSV file has data, but the search returns no results, indicating a permissions issue. In Splunk, knowledge objects like lookups have permissions that restrict which roles can use them; if the user's role lacks read access to the 'assets' lookup definition, the lookup command will silently return no results. The syntax and command structure are otherwise correct, so the most likely cause is that the lookup definition's permissions are not set to allow the user's role.

Answer

The lookup command syntax is incorrect; it should be 'lookup assets dest_ip AS ip'

Answer

The lookup command is missing the 'name' field; it should be 'lookup assets name AS ip'

Answer

The command should use 'inputlookup' instead of 'lookup' to load the CSV data

Question 2

When using an automatic lookup in props.conf, which setting controls the order in which multiple automatic lookups apply to the same sourcetype?

Accepted Answer

The numeric suffix after LOOKUP- in props.conf. In Splunk, when multiple automatic lookups are defined for the same sourcetype in props.conf, the order of execution is determined by the numeric suffix appended to the LOOKUP- stanza (e.g., LOOKUP-1, LOOKUP-2). Splunk processes these lookups in ascending numeric order, ensuring a predictable sequence. This allows administrators to chain lookups where the output of one lookup can feed into the next.

Answer

The order in which they are listed in transforms.conf

Answer

The `batch_index_query` setting

Answer

The `priority` field in the lookup definition

Question 3

Which TWO of the following are best practices for managing lookup files in Splunk?

Accepted Answer

Store the lookup file in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory.. Options A and B are correct. Using headers is best practice. Placing in the lookups directory is required. Option C is wrong because CRLF line endings cause issues. Option D is wrong because $SPLUNK_HOME/etc is not accessible by search peers if distributed. Option E is wrong because app-specific is preferred.

Answer

Place lookup files in $SPLUNK_HOME/var/run to avoid permission issues.

Answer

Use global lookups to share across all apps.

Answer

Use Windows-style CRLF line endings for cross-platform compatibility.

Question 4

A security analyst needs to enrich firewall logs with user identity information stored in a CSV file. The CSV file contains fields: user_id, username, department, location. The firewall logs contain a field 'src_user_id'. Which Splunk feature should be used to add the username and department fields to the firewall events based on matching src_user_id to user_id?

Accepted Answer

Define a lookup table from the CSV file and use the input lookup command or automatic lookup to add username and department. Option B is correct because a lookup table defined from the CSV file allows Splunk to map the 'src_user_id' field in firewall events to the 'user_id' field in the CSV, then add the 'username' and 'department' fields from the lookup. This is the standard method for enriching events with external data using the 'inputlookup' command or an automatic lookup configuration.

Answer

Create a field alias that maps src_user_id to username and department

Answer

Use the eval command with an if statement to populate username and department from src_user_id

Answer

Create a calculated field that computes username and department based on src_user_id

Question 5

A Splunk user wants to see the list of fields that are defined in a lookup table named 'assets' without running a search. Which command should they use?

Accepted Answer

| inputlookup assets. Option C is correct. The 'inputlookup' command can be used to preview the lookup table contents and fields. Option A (lookup) enriches events. Option B (fields) shows event fields. Option D (stats) computes statistics.

Answer

| lookup assets

Answer

| stats values(*) as * by *

Answer

| fields assets

Question 6

Which TWO options are correct about post-process searches in dashboards?

Accepted Answer

They can reduce search load by reusing base search results. Options A and D are correct. Post-process searches reuse base search results, reducing load, and they can only be used within the same dashboard. Option B is false because not all commands are supported; Option C is false because not all fields are inherited; Option E is false because they cannot override the base search time range.

Answer

They support all SPL commands that base searches support

Answer

They can override the time range of the base search

Answer

They automatically inherit all fields from the base search

Question 7

A developer wants to display server CPU usage that updates every second on a dashboard. Which panel configuration is appropriate?

Accepted Answer

Add a chart panel with time range set to 'Real-time' and refresh set to 'Real-time'. Option D is correct: a chart panel with time range set to 'Real-time' and refresh set to 'Real-time' provides a continuously updating visualization. Option A (single value) can be real-time but is not the standard for time-series; Option B uses a statistics table which is less visual; Option C has a refresh interval but not real-time.

Answer

Add a statistics table with real-time search

Answer

Add a chart panel with refresh set to 1 second and time range -1m

Answer

Add a single value panel with refresh set to 1s

Question 8

A user created a report that runs every hour. They notice the report's results include data from the previous hour only, but they want data from the last 24 hours. What should they change in the search?

Accepted Answer

Change the time range to Last 24 hours. Option C is correct because the report's search is currently using a relative time range (e.g., Last hour) that limits results to the previous hour. Changing the time range to 'Last 24 hours' expands the search window to include all events from the past 24 hours, ensuring the report returns the desired data. The scheduling frequency controls when the search runs, not the span of data it retrieves.

Answer

Increase the report scheduling frequency

Answer

Add | timechart span=1h

Answer

Use | stats count by date_hour

Question 9

A dashboard designer adds a radio button input to filter by department. When a user selects a department, the panel does not update. What is the most likely cause?

Accepted Answer

The search string does not include a token referencing the input. Option C is correct because the search must include a token reference like $department$ to use the input value. Option A is wrong because the radio button may or may not require changes to XML; the core issue is token usage. Option B is wrong because token name mismatch is a possible issue, but a missing token reference is more fundamental. Option D is wrong because the input label has no effect on search.

Answer

The radio button input is not configured with a default value

Answer

The token name in the search does not match the input's token name

Answer

The input's label field is empty

Question 10

A dashboard designer wants to create a drilldown from one chart to another dashboard. Which TWO actions must be configured? (Select two.)

Accepted Answer

Set the target dashboard's token to accept the drilldown value. Options A and B are correct. The chart must have drilldown set to 'link to dashboard' (A), and the target dashboard must accept a token from the drilldown (B). Option C is not required for drilldown. Option D is incorrect because drilldown is a chart property, not a search command. Option E is incorrect because 'link to search' is a different drilldown type that opens a search.

Answer

Add a search command to the chart

Answer

Set the source chart's drilldown to 'link to search'

Answer

Enable dashboard permissions

Question 11

A dashboard includes a form input that allows users to select a user. After selecting a user, a panel should show that user's activity. Which dashboard feature is required?

Accepted Answer

Tokens. Tokens store the selected value and pass it to search queries, enabling dynamic panel updates.

Answer

Post-process searches

Answer

Drilldown

Answer

Link to report

Question 12

An analyst needs to create a dashboard that displays real-time data (streaming) for operational monitoring. Which panel type supports real-time data?

Accepted Answer

A panel with a search that uses the 'Real-time' time range option.. Option D is correct because the 'Real-time' time range option in Splunk allows a dashboard panel to continuously stream and update data as it is indexed, providing live operational monitoring. This is the only panel type that supports true real-time data, as it sets the search to run continuously with a rolling window (e.g., last 60 seconds) rather than relying on a fixed or scheduled time range.

Answer

A panel based on a scheduled alert.

Answer

A panel based on a saved search with a fixed time range.

Answer

A panel based on a saved report with a scheduled time range.

Question 13

Refer to the exhibit. The dashboard panel is not displaying data when the input changes. What is the most likely cause?

Accepted Answer

The token name in the search is "$token$" but the input token is "source".. Option A is correct because the token in the search is `$token$` but the input defines the token as `source`. Token names must match.

Option B is incorrect because `searchWhenChanged="true"` triggers a search when the input changes, which is correct.
Option C is incorrect because a chart type is not required; it defaults to a column chart.
Option D is incorrect because `timechart` uses `_time` by default, so a time field is not missing.

Answer

The input uses `searchWhenChanged="true"` which prevents dashboard loading.

Answer

The search uses `timechart` which requires a time field.

Answer

The chart type is not specified.

Question 14

A dashboard includes a table panel that shows recent errors. The analyst wants users to click on an error message and be taken to a search showing all events containing that error message within the same time range. Which configuration should be applied to the table panel?

Accepted Answer

Set 'Drilldown' to 'Link to search' and configure the target search with a token for the error message.. Option B is correct because 'Drilldown' with 'Link to search' allows passing the clicked field value as a token to a new search. Option A is wrong because 'Drilldown' to 'Search' with the field value creates a static search. Option C is wrong because 'Token' alone does not define a drilldown action. Option D is wrong because 'Drilldown' to 'Custom' requires JavaScript.

Answer

Add a token on the table panel and set the drilldown to 'Token' with value '$row.error_message$'.

Answer

Set 'Drilldown' to 'Custom' and use JavaScript to open a new window.

Answer

Set 'Drilldown' to 'Search', and in the search string include 'error_message="$click.value$"'

Question 15

Which visualization type is best suited to show the proportion of errors by category (e.g., HTTP 404, 500, 403) as parts of a whole?

Accepted Answer

Pie chart. A pie chart is the correct choice because it is specifically designed to display the proportional distribution of categorical data as parts of a whole. In Splunk, the `pie` visualization type visually represents the relative size of each error category (e.g., HTTP 404, 500, 403) as slices of a circle, making it immediately clear which category accounts for the largest share of errors.

Answer

Single value

Answer

Column chart

Answer

Scatter plot