SPLK-1001 Practice Test 14 — 15 Questions

Question 1

A search includes a lookup that returns multiple matches for a single event. The analyst wants to keep only the first match. Which lookup command option should they use?

Accepted Answer

max_matches=1. Max_matches=1. This option limits the number of lookup matches per event to one, keeping only the first match. Option A (update=t) is used for outputlookup to update existing entries, not for limiting matches. Option B (local=t) refers to local time-based lookups, which is not relevant here. Option D (append=t) appends fields from a lookup but does not limit the number of matches.

Answer

update=t

Answer

local=t

Answer

append=t

Question 2

Which TWO of the following are valid ways to add a visualization to a dashboard in Splunk?

Accepted Answer

Create a new panel in the dashboard editor and select a visualization type.. The dashboard editor in Splunk provides a dedicated workflow to add a new panel and then select a visualization type (e.g., chart, table, map) from the 'Visualization' tab. This is the standard method for building a panel from scratch within a dashboard, allowing you to define the search and choose the appropriate visualization for your data.

Answer

Use the 'Edit' button on an existing panel to change it to a new visualization.

Answer

Export a report as a PDF and upload it as an image panel.

Answer

Set up an alert and configure it to add a panel to the dashboard.

Question 3

A dashboard includes a table panel that shows recent errors. The analyst wants users to click on an error message and be taken to a search showing all events containing that error message within the same time range. Which configuration should be applied to the table panel?

Accepted Answer

Set 'Drilldown' to 'Link to search' and configure the target search with a token for the error message.. Setting 'Drilldown' to 'Link to search' allows you to configure a target search URL that includes a token for the clicked error message. When a user clicks a cell in the table, the token (e.g., `$click.value$`) is replaced with the actual value from that cell, and Splunk opens a new search using the same time range as the original dashboard, fulfilling the requirement exactly.

Answer

Add a token on the table panel and set the drilldown to 'Token' with value '$row.error_message$'.

Answer

Set 'Drilldown' to 'Custom' and use JavaScript to open a new window.

Answer

Set 'Drilldown' to 'Search', and in the search string include 'error_message="$click.value$"'

Question 4

Which three of the following are best practices for creating efficient dashboards? (Choose three.)

Accepted Answer

Use summary indexing to pre-aggregate data. Summary indexing pre-aggregates data at search time and stores the results in a summary index, which can then be searched much faster than the raw data. This drastically reduces the amount of data that must be scanned when rendering dashboard panels, especially for large datasets or long time ranges, improving dashboard load performance.

Answer

Use real-time searches to ensure data is current

Answer

Use the | map command to iterate over large result sets

Question 5

A Splunk user wants to see the list of fields that are defined in a lookup table named 'assets' without running a search. Which command should they use?

Accepted Answer

| inputlookup assets. The `| inputlookup assets` command displays the contents of the lookup table named 'assets', including its fields, without needing to run a search. Option B (`| lookup assets`) is used to enrich search results with lookup data, not to view the table. Option C (`| stats values(*) as * by *`) computes statistics and does not show lookup fields. Option D (`| fields assets`) is invalid because `fields` is used to select or remove fields from search results, not to view lookup tables.

Answer

| lookup assets

Answer

| stats values(*) as * by *

Answer

| fields assets

Question 6

A developer wants to display server CPU usage that updates every second on a dashboard. Which panel configuration is appropriate?

Accepted Answer

Add a chart panel with time range set to 'Real-time' and refresh set to 'Real-time'. A chart panel with time range set to 'Real-time' and refresh set to 'Real-time' provides a continuously updating line chart of CPU usage over time, updating every second. Option B (statistics table) is less visual for time-series data. Option C has a fixed time range of -1 minute, so it does not show real-time updates. Option D (single value panel) shows only a single number, not a time series.

Answer

Add a statistics table with real-time search

Answer

Add a chart panel with refresh set to 1 second and time range -1m

Answer

Add a single value panel with refresh set to 1s

Question 7

A dashboard includes a form input that allows users to select a user. After selecting a user, a panel should show that user's activity. Which dashboard feature is required?

Accepted Answer

Tokens. Tokens store the selected value and pass it to search queries, enabling dynamic panel updates.

Answer

Post-process searches

Answer

Drilldown

Answer

Link to report

Question 8

An analyst has multiple Splunk apps installed and wants to ensure a search runs against data from a specific app's index. Which action should they take?

Accepted Answer

Select the specific app from the app dropdown in the menu bar.. The correct action is to select the specific app from the app dropdown in the menu bar. This sets the app context, restricting the search to data and knowledge objects from that app. Option A is incorrect because typing the app name in the search bar does not set the app context. Option C is incorrect because the time range picker controls the time filter, not the app context. Option D is incorrect because selecting 'All apps' would include data from all apps, not restrict to a specific app.

Answer

Type the app name in the search bar before the search string.

Answer

Adjust the time range picker to focus on the app's data time.

Answer

Select 'All apps' in the app dropdown to include all data.

Question 9

Refer to the exhibit. What does this configuration do?

Accepted Answer

It sets the host field based on IP using a transform. This props.conf stanza applies a transform named 'set_host_from_ip' to all events of sourcetype 'my_sourcetype'. Transforms typically modify field values; this one sets the host field based on the source IP.

Answer

It creates a new sourcetype

Answer

It clears the host field

Answer

It enables SSL for the sourcetype

Question 10

Which TWO of the following are valid ways to access the Search & Reporting app in Splunk Web? (Choose two.)

Accepted Answer

Click the 'Search & Reporting' link on the Splunk Home page.. The Splunk Home page provides direct links to installed apps, including 'Search & Reporting', which is the primary interface for running searches and creating reports. Clicking this link navigates to the Search app's main page, allowing users to immediately access the search bar and timeline.

Answer

Navigate to Settings > Search.

Answer

Type 'search' in the browser address bar.

Answer

Open the Search Assistant from the Help menu.

Question 11

A report is scheduled to run every 5 minutes. After running, it sends an email if the count of errors exceeds 10. Which report action should be configured?

Accepted Answer

Scheduled report with email action and condition. The requirement is for a scheduled report that runs every 5 minutes and conditionally sends an email only when the count of errors exceeds 10. In Splunk, a scheduled report with an email action and a condition allows you to define a search that runs on a schedule, evaluate a numeric condition (e.g., count > 10), and trigger an email only when that condition is met. This is the exact mechanism for conditional email delivery based on report results.

Answer

Dashboard panel

Answer

Alert

Answer

Real-time search

Question 12

An administrator needs to extract a field from log data where the value appears between two square brackets, for example [error_code: 404]. Which search command should they use to create a custom field extraction without modifying the original data?

Accepted Answer

rex. The `rex` command is used to extract fields using regular expressions without modifying the raw event data. In this scenario, `rex` can parse the pattern `$$error_code: (?<field>\d+)$$` to capture the value between square brackets into a new field, leaving the original log intact.

Answer

eval

Answer

fields

Answer

extract

Question 13

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

Accepted Answer

eval. The `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Answer

fields

Answer

convert

Answer

rex

Question 14

A large organization's security team has a dashboard that displays the top 10 source IPs by number of failed login attempts. The dashboard uses a search: index=security sourcetype=login action=failure | top limit=10 src_ip. Lately, the dashboard shows incorrect data (e.g., IPs that are not actually top). However, when the same search is run in the Search app, it shows correct results. The dashboard is scheduled to refresh every 10 minutes. What is the most likely cause?

Accepted Answer

The dashboard uses a summary index with stale data. The dashboard is likely configured to use a summary index that is populated by a scheduled search. If the summary index is not updated frequently enough or contains stale data, the dashboard will display incorrect results even though the live search in the Search app returns accurate data. The 10-minute refresh interval does not repopulate the summary index; it only re-queries the already stale summary data.

Answer

The dashboard's time range is different from the manual search

Answer

The dashboard is using a real-time search that causes data inconsistency

Answer

The user has incorrect field permissions

Question 15

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

Accepted Answer

Rewrite the search as `index=main error | stats count by host`.. The original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Answer

Use the `transaction` command to group related events before counting.

Answer

Replace `stats count by host` with `top limit=5 host` to limit output.

Answer

Add a `summarize` command before `stats` to pre-aggregate data.