SPLK-1001 Practice Test 17 — 15 Questions

Question 1

Which two of the following are actions that can be performed on a report after it is created? (Choose two.)

Accepted Answer

Embed it in a dashboard. Reports in Splunk can be embedded into dashboards as panels, allowing users to visualize report results directly within a dashboard context. This is done by adding a report panel to a dashboard XML or using the dashboard editor, which references the saved report's search ID (SID) to render the data.

Answer

Modify its search query

Answer

Delete it from the index

Answer

Convert it to an alert

Question 2

An administrator wants to list all data models in the current app and see their acceleration status. Which command should they use?

Accepted Answer

| datamodel list. The `| datamodel list` command is the correct choice because it lists all data models in the current app context and displays their acceleration status, including whether acceleration is enabled, the acceleration schedule, and the last build time. This command is specifically designed for inventory and status reporting of data models, not for searching or inspecting individual model details.

Answer

| datamodel info

Answer

| datamodel search

Answer

| datamodel show

Question 3

You are working as a Splunk consultant for a financial services firm. They have multiple data sources: application logs, database audit logs, and network firewall logs. The security team needs to correlate events across these sources to detect potential fraud. You decide to create a data model named 'Security_Events'. The data model will be used with tstats for real-time dashboards. The logs vary in volume: application logs are 200 GB/day, audit logs are 50 GB/day, and firewall logs are 100 GB/day. The firm wants to optimize performance and storage. The data model currently has one root event with no constraints and three child objects with constraints based on sourcetype. The admin is concerned about acceleration storage costs. Which of the following is the best approach to balance performance and storage?

Accepted Answer

Enable acceleration only on the child objects that are used in the most critical dashboards, and leave others unaccelerated.. Enabling acceleration only on the child objects used in the most critical dashboards balances performance and storage. The tstats command can leverage accelerated child objects for fast queries, while unaccelerated objects avoid unnecessary storage overhead. Given the high volume of logs (350 GB/day total), selective acceleration minimizes storage costs while still providing real-time performance for key fraud detection dashboards.

Answer

Disable acceleration on all objects and rely on the base search for queries.

Answer

Enable acceleration on the root event only and disable acceleration on child objects.

Answer

Remove the child objects and merge all constraints into the root event.

Question 4

A user notices that a data model designed for web server logs is not showing any events in the 'Web' object, even though the underlying logs are searched correctly with a normal search. The root events are pulling from the 'main' index, and the data model uses constraints. Which of the following is the most likely cause?

Accepted Answer

The constraint defined in the data model's root event is too restrictive and excludes all events.. The most likely cause is that the constraint defined in the data model's root event is too restrictive and excludes all events. Data model constraints act as a filter on the underlying index data; if the constraint condition (e.g., `sourcetype=access_combined`) does not match any events in the 'main' index, the root event will be empty, even though a normal search without the constraint returns results. This is a common misconfiguration when the constraint is too narrow or uses incorrect field values.

Answer

The time range picker is set to a period outside the acceleration summary's range.

Answer

The data model definition includes calculated fields that require specific field extractions.

Answer

The user does not have permissions to run the data model, so events are hidden.

Question 5

Which THREE of the following are valid ways to add a visualization to a dashboard?

Accepted Answer

Paste a search query in the dashboard editor.. Pasting a search query directly into the dashboard editor is a standard method for creating a new panel. When you paste a search in the editor, Splunk automatically generates a visualization based on the search results, allowing you to configure the chart type and formatting within the dashboard context.

Answer

Create a report and then drag it onto the dashboard.

Answer

Upload a CSV file and select visualization type.

Question 6

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

Accepted Answer

Add an index to the lookup file by converting to KV Store. To improve performance with a large CSV lookup (200,000 rows), converting it to a KV Store (Option C) is the best choice because KV Store lookups are indexed, making field matching much faster than searching the entire CSV file each time. Option A (external lookup) is wrong because querying a database adds network and database overhead, often slowing performance further. Option B (increasing timeout) does not speed up the lookup; it only prevents timeouts during long operations. Option D (increasing max_matches) controls how many matching results are returned, but does not affect the speed of the lookup operation itself.

Answer

Switch to an external lookup that queries a database

Answer

Increase the lookup timeout value

Answer

Increase the max_matches setting for the lookup

Question 7

You are a Splunk administrator at a mid-sized company that uses Splunk Enterprise to monitor application logs from a web server cluster. The cluster has five servers, each sending logs via a universal forwarder to a single indexer. The indexer has ample resources. Recently, users have complained that searches for the last 24 hours are slow, but searches for the last hour are fast. The data volume is about 50 GB per day. You suspect the issue is related to how data is stored or indexed. Which action should you take first to improve search performance for the 24-hour time range?

Accepted Answer

Exclude internal Splunk logs (splunkd.log) from being indexed by setting up appropriate input configurations on forwarders.. Internal Splunk logs (splunkd.log) can generate significant volume and are indexed by default, consuming resources and slowing searches over longer time ranges. Excluding them on the forwarders reduces the total indexed data, improving search performance for the 24-hour window without affecting application log searches.

Answer

Increase the number of parallel search processes in the indexes.conf settings.

Answer

Add a second indexer and distribute incoming data using load balancing.

Answer

Reduce the retention period for the index from 90 days to 30 days.

Question 8

Which TWO of the following are best practices for managing lookup files in Splunk?

Accepted Answer

Store the lookup file in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory.. The correct best practices are B and E. Place lookup files in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory (B) to ensure they are properly recognized by Splunk. Always include a header row in CSV lookups (E) to map fields correctly. Option A is wrong because $SPLUNK_HOME/var/run is for runtime data, not permanent lookups. Option C is wrong because global lookups are not a built-in concept; sharing across apps is done via app-level configurations. Option D is wrong because Windows-style CRLF line endings can cause parsing issues in Splunk; Unix-style LF is recommended.

Answer

Place lookup files in $SPLUNK_HOME/var/run to avoid permission issues.

Answer

Use global lookups to share across all apps.

Answer

Use Windows-style CRLF line endings for cross-platform compatibility.

Question 9

Refer to the exhibit. The dashboard panel shows a column chart of bytes by protocol for the last 24 hours. However, the chart shows only one column. What is the most likely cause?

Accepted Answer

The search returns only one result row. A column chart in Splunk displays one column per distinct value of the x-axis field. If the search returns only one result row (e.g., a single protocol value such as 'HTTP' with a total byte count), the chart will render a single column. This typically occurs when the search uses a stats or timechart command that groups by a field with only one unique value, or when a filter like `protocol=*` inadvertently matches only one protocol.

Answer

The chart type cannot display multiple columns

Answer

The protocol field is not extracted

Answer

The time range is not wide enough

Question 10

Refer to the exhibit. What is the purpose of the where clause in this search?

Accepted Answer

To show only rows for EventCode 4624 in the table. The `where` clause in SPL (Search Processing Language) filters results after the `chart` command has already aggregated and transformed the data into a table. In this search, the `where` clause is applied after `chart count by Action` to display only rows where `EventCode` equals 4624, effectively showing only those specific rows in the final table output.

Answer

To filter events before the chart command

Answer

To count only events with EventCode 4624

Answer

To remove rows where Action is not specified

Question 11

Refer to the exhibit. A security analyst runs this search to find top failed actions for admin accounts. The search returns no results, but there are failed actions for admin accounts in the data. What is the most likely cause?

Accepted Answer

The eval command uses match which is case-sensitive; the admin usernames may start with lowercase 'admin'.. The where clause filters results after stats, but if the account_type eval does not match any user starting with 'Admin' (case-sensitive), then account_type will be 'user' for all, and the where condition fails. The match function is case-sensitive; users may start with 'admin' lowercase.

Answer

The windows_security sourcetype does not contain a 'user' field.

Answer

The where clause should use 'search' instead.

Answer

The stats command should be before eval.

Question 12

A search using `| lookup user_lookup user_id OUTPUT department_name` returns incorrect department names for some users. The lookup file is correct. What could be the issue?

Accepted Answer

The field `user_id` in the events has trailing spaces.. Trailing spaces in the `user_id` field within the events will cause the lookup to fail to match the corresponding entry in the lookup file, even though the lookup file itself is correct. Splunk performs exact string matching for lookups by default, so any leading or trailing whitespace in the event data will prevent a match, leading to incorrect or missing output. Using the `trim` function or a `| rex` command to strip whitespace before the lookup resolves this issue.

Answer

The output field name is misspelled in the search.

Answer

The lookup file has duplicate entries for the same user_id.

Answer

The lookup definition uses case-insensitive matching.

Question 13

A dashboard includes a pie chart showing the distribution of error types. The data comes from a search that uses `top` command. The pie chart is showing a slice labeled 'Other' that is very large. What is the most likely cause?

Accepted Answer

The `top` command default limit is 10, grouping remaining into 'Other'.. The `top` command in Splunk by default returns the top 10 most common values and groups all remaining values into an 'Other' category. If the pie chart shows a very large 'Other' slice, it indicates that the default limit of 10 is too low for the dataset, causing many distinct error types to be lumped together. Option D correctly identifies this default behavior as the most likely cause.

Answer

The `top` command is using `limit=0` which shows all values.

Answer

The search uses `rare` instead of `top`.

Answer

The pie chart has a maximum number of slices set to 5.

Question 14

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Accepted Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.. Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Answer

Install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then verify that data is being forwarded to the indexer.

Answer

Configure outputs.conf to point to the indexer, then install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Question 15

Drag and drop the steps to configure Splunk to use LDAP authentication into the correct order.

Accepted Answer

Select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles, then test the LDAP configuration.. LDAP setup involves selecting the method, configuring server details, mapping groups, and testing.

Answer

Map LDAP groups to Splunk roles, then configure LDAP server settings, then select LDAP as authentication method, then test the LDAP configuration.

Answer

Test the LDAP configuration, then select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Answer

Select LDAP as authentication method, then test the LDAP configuration, then configure LDAP server settings, then map LDAP groups to Splunk roles.