SPLK-1001 Practice Test 13 — 15 Questions

Question 1

An administrator needs to extract a field from log data where the value appears between two square brackets, for example [error_code: 404]. Which search command should they use to create a custom field extraction without modifying the original data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

rex. The `rex` command is used to extract fields using regular expressions without modifying the raw event data. In this scenario, `rex` can parse the pattern `$$error_code: (?<field>\d+)$$` to capture the value between square brackets into a new field, leaving the original log intact.

Answer

eval

Answer

fields

Answer

extract

Question 2

A search uses the rex command to extract fields from a log line. The field extraction is working correctly, but some events are missing the extracted field. What is a possible reason?

Accepted Answer

The events that are missing the field do not contain the pattern.. The rex command extracts fields by matching a regex pattern against the raw event text. If an event does not contain the substring that matches the pattern, no field is extracted. This is the most direct and common reason for missing fields — the pattern simply isn't present in those events.

Answer

The rex command does not support named groups.

Answer

The regex pattern is too complex.

Answer

The rex command must be used with eval.

Question 3

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Accepted Answer

Use the `eval` command to set a field and then `where` before the transforming command.. Option A is correct because you can use `eval` to compute or set a field and then apply `where` to filter events based on that field before the transforming command runs, effectively reducing the event set. Option D is correct because placing a search term in the initial search string filters events at search time, before any transforming command processes them. Option E is correct because the `search` command can be used mid-pipeline to filter events with keywords or field-value expressions before a transforming command. Option B is not correct because `fields` only includes or excludes fields from results; it does not filter events. Option C is not correct because `where` after a transforming command filters the transformed results, not the events before transformation.

Answer

Use the `fields` command to remove unwanted fields.

Answer

Use the `where` command after the transforming command.

Question 4

A search uses a lookup to enrich results with a field 'status'. After the lookup, some events have empty status values. The lookup file contains a mapping for all possible status codes. What is a likely reason for empty values?

Accepted Answer

The lookup field name in the event does not match the lookup key.. The lookup command matches a field in the event (the lookup key) against a field in the lookup file. If the field name in the event does not exactly match the lookup key field name in the lookup file, no match occurs, and the output field (e.g., 'status') remains empty. This is a common misconfiguration when the lookup key field is misspelled or has a different case.

Answer

The events are not indexed.

Answer

The lookup command uses output_fields incorrectly.

Answer

The lookup file has duplicate keys.

Question 5

The exhibit shows a savedsearch.conf stanza. What is the effect of the setting `displayview = flashtimeline`?

Accepted Answer

It sets the default view to the timeline chart when the search is opened.. In Splunk's savedsearches.conf, the displayview attribute specifies the default view that opens when the saved search is run or viewed. Setting displayview = flashtimeline opens the search in the Flash Timeline (timeline) view, which is the classic event timeline visualization. It does not alter the time range or filter results — it only controls the default UI view.

Answer

It configures the time picker to show the last 30 days.

Answer

It limits the search results to only timeline events.

Answer

It adds a flash timeline overlay to the search results.

Question 6

You are a Splunk administrator for a large e-commerce company. The marketing team has a dashboard that displays daily sales metrics, including revenue, number of transactions, and average order value. The dashboard is built using a single search that runs a 'timechart' command across all events. Recently, the dashboard has been timing out and failing to load during peak hours (10 AM - 2 PM) when traffic is highest. The team needs the dashboard to be available with minimal latency. You have the following options:

A. Reduce the time range on the dashboard to the last hour instead of the default last 24 hours.
B. Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.
C. Increase the search time limit in the Splunk settings to allow the search to run longer.
D. Split the single search into multiple smaller searches, each for a different metric, and run them concurrently on separate panels.

Which option best addresses the performance issue while maintaining data accuracy?

Accepted Answer

Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.. Creating a summary index that pre-aggregates sales metrics every hour offloads heavy computation from real-time searches. The dashboard then queries this smaller, pre-computed dataset, drastically reducing search time and avoiding timeouts during peak hours, while maintaining data accuracy since the aggregation is done on the raw data. Other options are less effective: reducing time range (Option A) loses historical data; splitting into multiple searches (Option D) may increase I/O and CPU contention; increasing time limit (Option C) does not address the root cause of scanning large volumes of raw data.

Answer

Reduce the time range on the dashboard to the last hour instead of the default last 24 hours.

Answer

Increase the search time limit in the Splunk settings to allow the search to run longer.

Answer

Split the single search into multiple smaller searches, each for a different metric, and run them concurrently on separate panels.

Question 7

An analyst needs to produce a report that shows, for each sourcetype, the number of unique user accounts observed and the total number of events. Which search returns one row per sourcetype with both values?

Accepted Answer

index=main | stats dc(user) as unique_users count as total_events by sourcetype. The dc function computes the number of distinct values of a field, which is precisely how unique users should be counted, while count totals all matching events. Grouping both aggregations by sourcetype with stats produces one row per sourcetype containing the two requested metrics, and the as clauses provide clean column names.

Answer

index=main | stats values(user) as unique_users count as total_events by sourcetype

Answer

index=main | dedup user | stats count as unique_users by sourcetype

Answer

index=main | stats count(user) as unique_users count as total_events by sourcetype

Question 8

A new user wants to start a search in Splunk Web. Which is the first step they should take?

Accepted Answer

Click into the search bar and type a query.. The first step to start a search in Splunk Web is to click into the search bar and type a query. The Search & Reporting app provides a search bar at the top of the interface where users enter their search terms, which can be keywords, field-value pairs, or full SPL commands. This is the primary entry point for all ad-hoc searching in Splunk.

Answer

Click on 'Add Data' to ingest logs.

Answer

Click on 'Settings' in the top menu bar.

Answer

Open the 'Reports' listing and select a saved search.

Question 9

A search uses `eval memory_MB = memory_bytes / 1024 / 1024`. The field memory_bytes contains values like '2,048,000'. The eval results memory_MB is often null. What is the most likely cause?

Accepted Answer

The field is actually a string with commas.. The `memory_bytes` field contains values like '2,048,000', which include commas. In Splunk, fields with commas are treated as strings, not numeric values. When `eval` attempts arithmetic division on a string field, it returns null because the operation cannot be performed on non-numeric data. The commas must be removed (e.g., using `replace` or `tonumber`) before the field can be used in calculations.

Answer

The eval command has a syntax error.

Answer

The field needs to be converted first.

Answer

The division operator does not work on string fields.

Question 10

An administrator notices that an automatic lookup is not being applied to events from a certain sourcetype. The lookup file exists and the configuration in props.conf appears correct. What is a possible reason?

Accepted Answer

The lookup table is defined in transforms.conf incorrectly. The automatic lookup is defined in props.conf, but the actual lookup table configuration (including the lookup file name, field mappings, and match type) is specified in transforms.conf. If transforms.conf is missing, has a syntax error, or incorrectly defines the lookup (e.g., wrong filename, mismatched field names, or incorrect stanza name), the automatic lookup will fail silently, even if props.conf appears correct.

Answer

Splunk needs to be restarted after adding the automatic lookup

Answer

The lookup file is stored in the wrong directory but referenced correctly

Answer

The lookup field is case-sensitive and the data doesn't match

Question 11

Which of the following is required to use data model acceleration for a Pivot report?

Accepted Answer

Check the 'Accelerate' box on the data model and set a time range. To use data model acceleration for a Pivot report, you must check the 'Accelerate' box on the data model and set a time range. This enables the Splunk acceleration engine to pre-compute and store summarized data for the specified time range, which significantly improves Pivot report performance by avoiding repeated scans of raw data.

Answer

Create a data model with only root objects

Answer

Enable summary indexing

Answer

Use the `datamodel` command with `acceleration` parameter

Question 12

Which TWO factors should be considered when deciding to use the rare command instead of top?

Accepted Answer

The dataset has high cardinality in the field of interest. Option A is correct because the rare command is designed to surface values that appear least often, so a field with high cardinality (many distinct values, each occurring infrequently) is exactly where rare provides value that top cannot, since top only shows the most common values. Option D is correct because the fundamental purpose of rare is to identify infrequent or unusual values, making the analysis goal of finding rare events the decisive factor in choosing rare over top. Option B is incorrect because rare is not inherently faster than top; both are Splunk transforming commands whose performance depends on the search, index, and time range, and rare often requires additional processing to sort ascending. Option C is incorrect because top is not always preferred for security analysis; rare is frequently used in security contexts to detect anomalous or low-frequency events. Option E is incorrect because neither rare nor top sorts results alphabetically by default; top sorts by frequency descending and rare sorts by frequency ascending, so alphabetical ordering is not a selection criterion.

Answer

Rare is faster than top

Answer

Top is always preferred for security analysis

Answer

The user wants to view results sorted alphabetically

Question 13

Which THREE of the following are true about lookups in Splunk? (Choose three.)

Accepted Answer

A lookup can be defined using a CSV file. Option A is correct because Splunk supports file-based lookups, where a CSV file is uploaded or referenced and defined via a lookup definition (e.g., in transforms.conf with filename = mylookup.csv), making CSV one of the standard lookup table types. Option D is correct because the core purpose of a lookup is to enrich events by adding fields from an external source such as a CSV, KV Store collection, or external script, typically invoked with the lookup command or automatic lookups. Option E is correct because Splunk supports time-based lookups (temporal lookups), where a time field in the lookup table is matched against the event time to return the appropriate value for that time range. Option B is not correct because lookups are case-sensitive by default; case-insensitive matching must be explicitly enabled (e.g., case_sensitive_match = false in the lookup definition). Option C is not correct because a lookup can return multiple fields, not just a single field, as defined by the lookup table's columns.

Answer

Lookups are case-insensitive by default

Answer

Lookups can only return a single field

Question 14

Which TWO of the following are valid ways to extract fields in Splunk? (Choose two.)

Accepted Answer

Using the Extract New Fields dialog in the UI. Option B is correct because the Extract New Fields dialog in the Splunk UI lets you interactively highlight values in raw events and define a regex-based field extraction, which Splunk then saves as a field extraction (often to props.conf/transforms.conf) so the field is parsed from raw data. Option C is correct because the rex command performs inline regular-expression field extraction during a search, using named capture groups such as (?<fieldname>...) to create fields from raw event text. Option A is not a field-extraction method; lookups enrich or add fields by matching existing field values against an external table, they do not parse new fields out of raw data. Option D is incorrect because the fields command only includes or excludes fields that already exist in the results (fields +/-, fields -), it does not extract them. Option E is incorrect because there is no regex command in Splunk's search processing language; regex-based extraction is done with rex (or the regex eval function for matching/filtering, not field extraction).

Answer

Using a lookup to extract fields from raw data

Answer

Using the fields command

Answer

Using the regex command in a search

Question 15

A user notices that a search returns results only from the last 15 minutes, even though the time range picker is set to "All time". The search string is: error | timechart count. Which is the most likely cause?

Accepted Answer

The search includes an implicit time range like earliest=-15m@m in a saved search or settings.. The search includes an implicit time range, such as `earliest=-15m@m`, which overrides the global time range picker set to 'All time'. This can occur in saved search settings or search macros, forcing the search to only look at the last 15 minutes regardless of the picker selection. The `timechart` command does not impose a time window itself; it only aggregates results within the time range provided by the search.

Answer

The user selected All time but applied a subsearch.

Answer

The indexer is only returning recent data due to performance.

Answer

The timechart command defaults to a 15-minute window.