SPLK-1001 Practice Test 15 — 15 Questions

Question 1

A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?

Accepted Answer

| eval duration_sec = duration / 1000. The `eval` command in Splunk is specifically designed to create new fields by evaluating expressions, including arithmetic operations. Using `| eval duration_sec = duration / 1000` creates a new field `duration_sec` that contains the value of `duration` divided by 1000, converting milliseconds to seconds.

Answer

| rename duration as duration_sec

Answer

| convert duration_sec = duration/1000

Answer

| fields duration_sec = duration/1000

Question 2

A lookup definition in transforms.conf includes the following settings: `filename = employees.csv`, `max_matches = 0`, `case_sensitive_match = false`. Which three statements about this lookup are true? (Choose three.)

Accepted Answer

The lookup matching is case-insensitive.. The `case_sensitive_match = false` setting in transforms.conf explicitly makes the lookup matching case-insensitive. This means that when the lookup is performed, the comparison between the event field value and the lookup key ignores differences in uppercase and lowercase characters.

Answer

The lookup will fail if there are duplicate keys.

Answer

The lookup will only return the first match for each event.

Question 3

An IT operations team has a dashboard with multiple panels showing server metrics. Each panel uses a separate search that runs every time the dashboard is loaded, causing slow performance. What is the best practice to improve dashboard load time?

Accepted Answer

Use a base search and post-process searches for dependent panels.. Using a base search with post-process searches allows multiple dashboard panels to share a single, initial data retrieval. Instead of each panel running its own independent search against the index, they all reference the results of the base search, which runs once. This drastically reduces the number of indexer queries and speeds up dashboard load time, especially when panels share a common data source or filtering criteria.

Answer

Reduce the time range picker to the last 24 hours.

Answer

Combine all searches into one large search and use eval to separate results.

Answer

Add more panels to distribute the data load.

Question 4

Which TWO of the following methods allow a user to switch between apps in Splunk Web?

Accepted Answer

Change the app name in the URL to the desired app.. Option A is correct because Splunk Web encodes the current app in the URL path (e.g., /en-US/app/<app_name>/...), so manually editing the app name segment in the address bar navigates the user directly to that app. Option C is correct because the app dropdown (App menu) in the top menu bar lists the apps the user can access and selecting one switches the current context to that app. Option B is wrong because the search bar accepts SPL search queries, not app-switching commands. Option D is wrong because 'All apps' is a listing/filter view of available apps rather than a direct switch method itself. Option E is wrong because the timeline is a search visualization control and has no app-switching function.

Answer

Type the app name in the search bar before the query.

Answer

Select 'All apps' from the app dropdown.

Answer

Click on the timeline and select an app.

Question 5

A user needs to create a report showing the average response time per endpoint for the last hour. Which command would produce this result?

Accepted Answer

stats avg(response_time) by endpoint. The `stats` command with `avg(response_time) by endpoint` calculates the average response time for each unique endpoint, which directly meets the requirement of showing average response time per endpoint for the last hour. The `stats` command is the standard way to compute aggregate statistics like average over grouped fields in Splunk.

Answer

chart avg(response_time) over endpoint

Answer

eval avg(response_time)

Answer

top endpoint

Question 6

Which TWO of the following are best practices when creating a data model in Splunk? (Choose two.)

Accepted Answer

Test the data model on a sample of data before deploying widely.. Option A is correct because testing a data model against a representative sample of data before deploying it widely verifies that the root event, fields, and constraints actually match the incoming events and avoids breaking dashboards or accelerated searches in production. Option D is correct because using descriptive names for root events and fields makes the data model self-documenting, easier for other users to understand in Pivot and the Data Model Editor, and less error-prone when referenced in searches. Option B is not a best practice because adding many calculated fields increases the size and complexity of the data model, can slow acceleration, and should be limited to fields that are genuinely needed. Option C is not a best practice because data models are often designed to support Pivot users and acceleration independently of a specific written search, so requiring a prior search is unnecessarily restrictive. Option E is not a best practice because excessive constraints can filter out valid events and make the data model too narrow, so constraints should be kept to the minimum needed to define the dataset.

Answer

Add many calculated fields to reduce the need for extra searches.

Answer

Only create data models after a search is written to confirm the need.

Answer

Include as many constraints as possible to filter events.

Question 7

Which TWO options are valid when adding a panel to a dashboard from an existing report? (Choose two.)

Accepted Answer

The panel can be added as a table, chart, or single value based on the report's results.. Option A is correct because when you add a panel to a dashboard from an existing report, the report's results can be visualized as a table, chart, or single value, allowing you to choose the most appropriate visualization for the dashboard. Option D is correct because the panel initially uses the report's search string as its search query, but this search can be edited after the panel is added to the dashboard, giving flexibility to customize the data shown. Option B is incorrect because panels can be added to dashboards across different apps, not only the app where the report was created. Option C is incorrect because the report is not merely added as a link; its search and results are used to create a panel. Option E is incorrect because a report's scheduled run time is not inherited by the dashboard; scheduling is separate from dashboard panel configuration.

Answer

The panel can only be added to the same app where the report was created.

Answer

The report is added as a link to the dashboard.

Answer

The report's scheduled run time is inherited by the dashboard.

Question 8

A user runs a search that returns many results. Which action in the Timeline histogram allows the user to narrow the result set to a specific time range?

Accepted Answer

Click and drag across the timeline. In Splunk's Timeline histogram, clicking and dragging across a time range selects that specific time range and filters the search results to only events within that range. This is the standard way to narrow results to a specific time period using the timeline.

Answer

Double-click on the timeline bar

Answer

Right-click and choose 'Filter by time'

Answer

Click the 'Zoom to selection' button

Question 9

Which TWO of the following are valid ways to share a Splunk dashboard?

Accepted Answer

Share via URL. Option B (Share via URL) is correct because Splunk dashboards can be shared by copying the dashboard's URL and granting the recipient appropriate role-based access, allowing them to open the live dashboard directly in their browser. Option D (Embed as iframe) is correct because Splunk supports embedding dashboards into external web pages via an iframe, typically enabled through the "Embed" permission and the dashboard's embed token or URL. Option A (Send via email) is not a native dashboard-sharing method in Splunk; email delivery applies to scheduled reports or alerts, not to sharing an interactive dashboard. Option C (Export as PDF) produces a static snapshot of the dashboard rather than sharing the dashboard itself, so it is not a valid sharing method. Option E (Clone dashboard) merely creates a copy of the dashboard for the current user and does not share it with anyone else.

Answer

Send via email

Answer

Export as PDF

Answer

Clone dashboard

Question 10

A team uses a lookup to map IP addresses to geographic locations. The lookup is large and updated weekly. Which lookup type is best suited?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is best suited for this use case because it is static, large, and updated on a schedule. CSV lookups are loaded into memory and can handle large datasets efficiently, and they are easily replaced or updated weekly by overwriting the file. This approach avoids the overhead of a KV store or external service for a dataset that does not require real-time updates or complex queries.

Answer

External lookup

Answer

Scripted lookup

Answer

KV store lookup

Question 11

A dashboard has multiple panels that use the same base search. The admin wants to avoid running the same search multiple times. Which feature should be used?

Accepted Answer

Post-process search. Post-process searches allow a dashboard panel to run a secondary search against the results of a base search, rather than re-running the original search against the index. This avoids redundant data retrieval and processing, as the base search runs once and its results are stored in a results server, which subsequent post-process searches query using the `| search` command or similar filtering.

Answer

Report acceleration

Answer

Data model

Answer

Summary indexing

Question 12

A Splunk administrator notices that a data model acceleration summary is consuming excessive disk space on the indexers. The data model is used for a dashboard that refreshes every 30 minutes. What is the best course of action to reduce disk usage while maintaining dashboard performance?

Accepted Answer

Decrease the acceleration time range in the data model definition.. Decreasing the acceleration time range in the data model definition directly reduces the amount of data the summary covers, which lowers disk usage on the indexers. Since the dashboard refreshes every 30 minutes, a shorter acceleration range (e.g., last 7 days instead of 30) still keeps the most recent data pre-computed for fast queries, maintaining performance for the refresh interval.

Answer

Disable data model acceleration and rely on raw data searches.

Answer

Decrease the backfill time for the data model.

Answer

Increase the acceleration time range to speed up summary generation.

Question 13

A company has 50 Splunk users in the default 'user' role. The Splunk administrator wants to allow a subset of 5 users to create custom alerts and reports, but not modify data inputs or indexes. The administrator creates a new role called 'analyst' and assigns the 'can_create_alerts' and 'can_create_reports' capabilities. However, when these 5 users log in, they cannot create alerts or reports and receive an error that they 'do not have permission to create alerts'. The administrator verifies that the role has both capabilities. Which of the following is the most likely cause and solution?

Accepted Answer

The 'analyst' role may not be correctly assigned to the 5 users. Verify that the users are members of the 'analyst' role and that no conflicting restrictions are blocking the capabilities.. If the 'analyst' role has the correct capabilities but users still get permission errors, the most likely cause is that the role is not actually assigned to those users, or another role/restriction is overriding it. Splunk merges capabilities across roles, so a missing assignment or a conflicting role (e.g., a restricted role) would block alert creation. Verifying role membership and checking for conflicting restrictions is the correct diagnostic step.

Answer

The 'analyst' role lacks the 'edit_search' capability. Add it to the role.

Answer

The administrator must grant the 'can_create_alerts' capability to the 'user' role.

Answer

The administrator must configure an alert action (e.g., email) before alerts can be created.

Question 14

A report uses `| timechart count by action`. The user wants to show only the top 3 actions and combine all others into a single 'Other' column. Which argument should be added?

Accepted Answer

`limit=3 useother=t`. The `timechart` command in Splunk uses the `limit` argument to control the number of distinct series (columns) displayed. Adding `limit=3` restricts the output to the top 3 values by count, and `useother=t` automatically groups all remaining values into a single 'Other' column. Without `useother=t`, the extra values are simply dropped, not aggregated.

Answer

`limit=3`

Answer

`useother=t`

Answer

`other=t`

Question 15

An analyst wants to use a lookup to enrich events only if a condition is met, e.g., only for events where `status=error`. Which search pattern is most efficient?

Accepted Answer

`index=main | where status="error" | lookup error_codes.csv code description`. It filters events with `where status="error"` before the `lookup` command, reducing the dataset that the lookup must process. This minimizes resource usage and improves search performance, as the lookup only runs against the relevant subset of events. In Splunk, placing filters early in the pipeline is a best practice for efficiency.

Answer

`index=main | lookup error_codes.csv code description | where status="error"`

Answer

`index=main | lookup error_codes.csv code description if(status="error")`

Answer

`index=main | inputlookup error_codes.csv | where status="error"`