SPLK-1001 Practice Test 13 — 15 Questions

Question 1

Which TWO of the following are features available in the Splunk Web interface under the 'Settings' menu?

Accepted Answer

Knowledge. The 'Settings' menu in Splunk Web provides administrative and configuration options. 'Knowledge' (B) is correct because it contains links to manage knowledge objects like event types, tags, and lookups. 'Data Inputs' (C) is correct because it is the central location for configuring how data enters Splunk, including monitoring files, network ports, and scripted inputs.

Answer

Reports

Answer

Dashboards

Answer

Search Center

Question 2

A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?

Accepted Answer

index=web status=404 | top src_ip. It first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.

Answer

index=web status=404 | sort src_ip

Answer

index=web | top src_ip

Answer

index=web status=404 | rare src_ip

Question 3

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

Accepted Answer

| stats count by status | where count > 100. It uses `stats count by status` to count events per status code, creating a field named 'count', then filters with `where count > 100`. Option C is also correct, achieving the same result by renaming the count field to 'cnt' before filtering. Both follow the standard Splunk pipeline pattern of aggregating then filtering. Options B and D are incorrect: B uses an unnecessary `eval` and `sum(count)` which is inefficient; D places `where count > 100` before `stats`, so `count` does not exist yet, causing an error or no filtering.

Answer

| eval count=1 | stats sum(count) by status | where count > 100

Answer

| where count > 100 | stats count by status

Question 4

A company has 50 Splunk users in the default 'user' role. The Splunk administrator wants to allow a subset of 5 users to create custom alerts and reports, but not modify data inputs or indexes. The administrator creates a new role called 'analyst' and assigns the 'can_create_alerts' and 'can_create_reports' capabilities. However, when these 5 users log in, they cannot create alerts or reports and receive an error that they 'do not have permission to create alerts'. The administrator verifies that the role has both capabilities. Which of the following is the most likely cause and solution?

Accepted Answer

The 'analyst' role may not be correctly assigned to the 5 users. Verify that the users are members of the 'analyst' role and that no conflicting restrictions are blocking the capabilities.. In Splunk, user permissions are the union of capabilities from all assigned roles. The default 'user' role lacks alert/report creation capabilities, but the new 'analyst' role explicitly grants them. With both roles assigned, the users should effectively have the creation capabilities. Since they still receive a permission error, the most likely cause is that the 'analyst' role is not correctly assigned to those 5 users, or another restriction is overriding the capabilities. Verify role assignment and ensure no conflicting limitations exist. The other options are incorrect because: Option A is unnecessary (creating alerts/reports does not require 'edit_search'); Option B would grant creation to all 50 users, not just the subset; Option C is a post-creation configuration, not a prerequisite for creating alerts.

Answer

The 'analyst' role lacks the 'edit_search' capability. Add it to the role.

Answer

The administrator must grant the 'can_create_alerts' capability to the 'user' role.

Answer

The administrator must configure an alert action (e.g., email) before alerts can be created.

Question 5

A junior analyst creates a dashboard to monitor server CPU usage. The dashboard contains a single panel with a line chart showing CPU percentage over the last 24 hours. The analyst then adds a second panel that displays the same data but as a single value showing the average CPU. Both panels use the exact same search string. The dashboard loads slowly, and users complain of wait times. The analyst wants to improve performance without changing the displayed data. Which course of action is best?

Accepted Answer

Convert the dashboard to use a base search and post-process the panels. Using a base search with post-process searches allows both panels to share a single dataset, reducing redundant search execution. Instead of running the same heavy search twice, the base search runs once, and each panel applies lightweight post-processing (e.g., timechart vs. stats) on the cached results. This directly addresses the slow load time without altering the displayed data.

Answer

Keep both panels but add more resources to the Splunk server

Answer

Remove the single value panel and embed its value in the line chart title

Answer

Enable report acceleration on one of the panels

Question 6

A large enterprise Splunk environment has a heavy forwarder sending 2 TB of log data per day. An operator builds a dashboard that displays a real-time chart of events per second across all data sources, using the search 'index=* | stats count by sourcetype' with a real-time window of last 10 minutes. The dashboard is extremely slow, often timing out. The operator suspects the search is too broad. Which optimization strategy should be implemented first?

Accepted Answer

Implement a summary index that aggregates events per second by sourcetype every minute, and have the dashboard search the summary index. A summary index pre-aggregates the events-per-second data by sourcetype at a regular interval (e.g., every minute), drastically reducing the data volume the dashboard must scan. Instead of processing 2 TB of raw logs in real time, the dashboard queries a small, precomputed table, eliminating the performance bottleneck caused by the heavy forwarder's high ingestion rate.

Answer

Replace the real-time search with a base search that runs every 10 minutes

Answer

Change the real-time window to a 10-minute historical search and enable report acceleration

Answer

Create a data model for all sourcetypes and use acceleration on the data model

Question 7

A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?

Accepted Answer

Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches. Exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.

Answer

Create a search-time field extraction that parses the dest_ip to derive owner and department

Answer

Increase the number of indexers to parallelize the lookup operations

Answer

Use the 'lookup' command with a KV Store lookup that is populated from the database in real time

Question 8

You are a Splunk administrator at a financial services company. The company has a distributed Splunk environment with 10 indexers and 2 search heads. You have created a data model named 'transaction_analytics' to analyze financial transactions. The data model is accelerated with a summary range of 7 days. Recently, users have reported that dashboards using this data model are extremely slow, sometimes timing out. You check the acceleration status and see that the summary is 'Building' but never completes. The splunkd.log on the search head shows repeated messages: 'Data model acceleration: query timed out after 300 seconds.' The base search for the data model is: index=transactions sourcetype=fin_events | eval risk_score=if(amount>10000, 'high', 'low') | fields transaction_id, user, amount, risk_score, _time. The data model has one root event with two child datasets: one for high-risk transactions and one for low-risk transactions. The total data volume is about 500 GB per day. The indexer where the summary is built has 16 GB of RAM and the search head has 32 GB. What is the best course of action to resolve the acceleration build timeout?

Accepted Answer

Modify the base search to remove the eval statement and instead use a lookup or index-time field for risk_score.. The eval statement in the base search forces the acceleration to process every raw event during the summary build, which is computationally expensive and causes the 300-second timeout. By moving the risk_score calculation to index time (e.g., using a calculated field or lookup), the acceleration can use the pre-computed field directly from the indexed data, drastically reducing CPU load and allowing the summary to complete within the timeout window.

Answer

Reduce the summary range to 1 day to limit the amount of data processed.

Answer

Disable acceleration and rely on real-time searches for the dashboards.

Answer

Increase the acceleration.max_time to 600 seconds to allow more time for the build.

Question 9

An admin wants to add a new data input for a network device sending syslog. Under which Settings menu would the admin navigate?

Accepted Answer

Settings > Data Inputs. To add a new data input for a network device sending syslog, the admin must navigate to Settings > Data Inputs. This is the central location in Splunk Web where you configure how data enters the Splunk platform, including TCP/UDP ports for syslog, file monitoring, scripted inputs, and modular inputs. Syslog data is typically ingested via a UDP or TCP input on port 514, which is configured under Data Inputs.

Answer

Settings > Knowledge

Answer

Settings > Alerts

Answer

Settings > Reporting

Question 10

A Splunk administrator needs to create a field alias that renames the field 'src_ip' to 'source_ip' for events in the index 'network'. The administrator has created the field alias in the Field Aliases settings in the UI. However, when searching index=network, the new field 'source_ip' does not appear in the events. The search still shows 'src_ip'. What could be the reason?

Accepted Answer

The field alias is configured for a specific sourcetype that does not match the events in the index. Field aliases in Splunk are configured per sourcetype. If the alias is applied to a sourcetype that does not match the events in the 'network' index, the alias will not take effect, and the original field name 'src_ip' will continue to appear. The administrator must ensure the alias is assigned to the correct sourcetype(s) present in the index.

Answer

Field aliases only work with lookups, not with standard fields

Answer

The field 'src_ip' is not extracted automatically; an explicit field extraction is required first

Answer

The alias should be created using the 'rename' command in the search, not via the UI

Question 11

You are a Splunk administrator for a large e-commerce company. The security team frequently runs searches against the web access logs (sourcetype=access_combined) to investigate suspicious activity. These searches often take 5-10 minutes to complete, and the team is frustrated. You decide to implement a data model to accelerate these searches. After creating a data model based on the CIM Web model and enabling acceleration for the 'Web' dataset, you notice that the acceleration summary size grows to over 50 GB and the rebuild process takes more than an hour every night, causing some searches to time out during the rebuild window. What is the most effective way to address this issue?

Accepted Answer

Reduce the acceleration time range from 'All time' to 'Last 7 days' to limit the summary size and rebuild duration.. Reducing the acceleration time range from 'All time' to a shorter window like 'Last 7 days' directly limits the amount of data the acceleration summary must cover. This shrinks the summary size (under 50 GB) and shortens the nightly rebuild time, preventing search timeouts during the rebuild window while still accelerating the most relevant recent data for security investigations.

Answer

Increase the bucket size in the acceleration settings to reduce the number of buckets being rebuilt.

Answer

Create a custom data model that includes only the fields needed for security investigations and enable acceleration.

Answer

Disable acceleration and instead rely on the security team to use more focused time ranges.

Question 12

You are a Splunk administrator for a large e-commerce company. The operations team uses a dashboard to monitor server health, which includes a single-value panel showing the current number of active users, a bar chart of error counts by service, and a table of recent critical log entries. Recently, users have reported that the dashboard loads very slowly, sometimes taking over 30 seconds to display all panels. The dashboard uses base search and post-process searches to reduce duplication. The base search retrieves all logs from the last 24 hours, and each panel runs a post-process search to filter and aggregate data. The dashboard is scheduled to refresh every 60 seconds. There are approximately 10 million events per day. After investigating, you notice that the base search returns a large amount of data, and each post-process search still processes a significant subset. Which approach would most effectively improve dashboard performance without significantly altering the dashboard's functionality?

Accepted Answer

Create a summary index that pre-aggregates logs by hour and service, then modify the base search to use the summary index and adjust post-process searches accordingly.. Creating a summary index that pre-aggregates logs by hour and service drastically reduces the volume of data the base search must process. Instead of scanning 10 million raw events per 60-second refresh, the base search queries pre-computed hourly summaries, and each post-process search operates on a much smaller, aggregated dataset. This approach preserves all dashboard panels and their functionality while addressing the root cause of slow performance: excessive data volume in the base search.

Answer

Remove the table of critical log entries to reduce the number of post-process searches.

Answer

Change the base search to a real-time search so that the data is streamed continuously.

Answer

Increase the dashboard refresh interval to 300 seconds to reduce the frequency of searches.

Question 13

A Splunk admin wants to ensure that data models are built efficiently and do not consume excessive resources. Which of the following is a best practice when creating data models?

Accepted Answer

Define constraints carefully to include only relevant events for each object.. Defining constraints carefully to include only relevant events for each object reduces the amount of data processed during acceleration, which improves performance and reduces resource consumption. Option A is incorrect because adding tags to every field would increase index size and may not improve efficiency. Option C is incorrect because converting all fields to calculated fields can add overhead and is not necessary for efficiency. Option D is incorrect because using a single root event with no child objects would limit the data model's ability to represent relationships and may not be efficient for all use cases.

Answer

Add tags to every field in the data model for better discoverability.

Answer

Convert all fields to calculated fields to normalize the data model.

Answer

Use a single root event with no child objects to simplify the data model.

Question 14

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. A root event in a data model can be constrained using a constraint string, which is a search expression that filters the events included in that dataset. This allows you to define a subset of data for the root dataset without modifying the underlying indexed data.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 15

A new Splunk user wants to see all events from the last 30 minutes, but the search returns no results. The user knows data is being indexed. Which is the most likely cause?

Accepted Answer

The time range picker is set to 'All time' but the user expects 'Last 30 minutes'.. The most common reason a search returns no results when data is known to be indexed is an incorrect time range picker setting. If the picker is set to 'All time', it will only show events from the beginning of the index, but if the user expects events from the last 30 minutes, they must select 'Last 30 minutes' or a custom relative time. The time range picker overrides any time modifiers in the search string, so even a correct search string will fail if the picker is set to a non-overlapping range.

Answer

Data is not yet indexed.

Answer

The search is restricted to index=_internal.

Answer

The search string has a typo in the time modifier.