SPLK-1001 Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. An admin sees that the Web_Traffic data model is accelerated but shows 'Summaries require rebuild'. What does this status indicate?

Accepted Answer

The data model definition has been modified and acceleration needs to be rebuilt.. When a data model is accelerated and shows 'Summaries require rebuild', it indicates that the data model definition has been modified (e.g., fields, constraints, or root events changed) since the last summary build. Splunk detects this change and marks the acceleration summaries as stale, requiring a rebuild to ensure query results reflect the updated definition. This is a built-in mechanism to maintain data integrity between the model and its accelerated summaries.

Answer

The disk space for acceleration is full.

Answer

The summary range is too short and needs to be extended.

Answer

The acceleration summaries are up to date and optimal.

Question 2

A security analyst wants to create a report that shows the count of failed login attempts per user over the last 24 hours, but only for users with more than 5 failures. Which Splunk command sequence should be used?

Accepted Answer

index=main action=failure | stats count by user | where count > 5. It first filters events to only failed login attempts using `index=main action=failure`, then uses `stats count by user` to count failures per user, and finally applies `where count > 5` to keep only users with more than 5 failures. This sequence ensures the count is calculated only on the relevant subset of events and the filter is applied after aggregation.

Answer

index=main action=failure | top limit=5 user

Answer

index=main | stats count by user | where count > 5

Answer

index=main action=failure | stats count by user | search count > 5

Question 3

Which visualization type is best suited to show the proportion of errors by category (e.g., HTTP 404, 500, 403) as parts of a whole?

Accepted Answer

Pie chart. A pie chart is the correct choice because it is specifically designed to display the proportional distribution of categorical data as parts of a whole. In Splunk, the `pie` visualization type visually represents the relative size of each error category (e.g., HTTP 404, 500, 403) as slices of a circle, making it immediately clear which category accounts for the largest share of errors.

Answer

Single value

Answer

Column chart

Answer

Scatter plot

Question 4

A team needs to be notified immediately when a specific error pattern appears in logs. The search for the pattern is already written. Which feature of Splunk should they use to set up automated notifications?

Accepted Answer

Create an alert based on the search.. Splunk alerts are specifically designed to trigger automated actions—such as email notifications, webhook calls, or script execution—when a scheduled search returns results that meet defined conditions. Since the team needs immediate notification upon the appearance of a specific error pattern, an alert based on the existing search provides the necessary real-time or scheduled monitoring with automated response.

Answer

Save the search as a report and schedule it.

Answer

Add the search to a dashboard panel.

Answer

Save the search as a saved search only.

Question 5

From the Splunk Home page, which of the following can be accessed directly?

Accepted Answer

All of the above. The Splunk Home page provides direct access to the Search & Reporting app (via the app tile), Settings (via the gear icon in the top navigation bar), and Dashboards (via the Dashboards tile or the dashboards link). Therefore, all three options (B, C, D) are individually accessible, making option A 'All of the above' the correct answer.

Answer

Settings

Answer

Search app

Answer

Dashboards

Question 6

A user wants to search only data from the 'security' index. Which search syntax should they use?

Accepted Answer

index=security. In Splunk, the `index` field specifies which index to search, and data is organized into indexes. To restrict a search to data from a specific index, you use `index=<index_name>`. Here, `index=security` tells Splunk to only search events stored in the 'security' index, which is the precise syntax required.

Answer

source=security

Answer

sourcetype=security

Answer

host=security

Question 7

A security analyst needs to identify the top 5 source IP addresses generating the most web traffic. Which command should be used?

Accepted Answer

| top limit=5 src_ip. The `top` command is specifically designed to return the most common values of a field, and `limit=5` restricts the output to the top 5 source IP addresses by count. This command automatically sorts the results in descending order, making it the most efficient and direct way to identify the top 5 source IPs generating web traffic.

Answer

| stats count by src_ip | sort - count

Answer

| sort - count | head 5

Answer

| table src_ip | head 5

Question 8

A user creates a dashboard with multiple panels. Some panels share the same search. To improve performance, what should the user do?

Accepted Answer

Define a base search and use post-process for each panel. Defining a base search and using post-process searches allows the dashboard to run the common search once and then apply different post-processing transformations on the same result set. This reduces the overall search load on the indexers and search head, improving performance by avoiding redundant data retrieval and aggregation for each panel.

Answer

Use post-process searches without a base search

Answer

Create separate searches for each panel with same query

Answer

Increase the time range to include more data

Question 9

Refer to the exhibit. The lookup file app_versions.csv contains fields 'app' and 'version'. The version values are strings like '1.5', '2.0', '2.1'. What is the issue with this search?

Accepted Answer

Version comparison will not be numeric, giving incorrect results. The issue is that the `where` clause performs lexicographic (string) comparison on the `version` field because the values in the lookup file are stored as strings (e.g., '1.5', '2.0', '2.1'). Since string comparison evaluates character by character, a version like '2.0' would be considered greater than '10.0' because '2' > '1' as a character, leading to incorrect filtering results. To compare versions numerically, you must convert the field to a numeric type using functions like `tonumber()` or parse the version string into comparable components.

Answer

where cannot be used with string comparisons

Answer

inputlookup is not a valid command

Answer

table should be replaced with fields

Question 10

A search includes a lookup that returns multiple values per event. The admin wants to see each matched value as a separate event. Which command should be used after the lookup?

Accepted Answer

mvexpand. The `mvexpand` command is correct because it takes a multivalue field (such as one created by a lookup returning multiple matches) and expands it into separate events, one for each value. This allows the admin to see each matched value as an individual event, which is exactly the requirement.

Answer

untable

Answer

stats

Answer

makemv

Question 11

A user notices that a calculated field defined in props.conf is not appearing in search results. Which of the following is the most likely cause?

Accepted Answer

The source fields used in the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time based on existing extracted source fields. If the source fields referenced in the calculation are not extracted (e.g., due to missing or incorrect field extraction configurations), the calculated field will not appear in search results. Option B correctly identifies this dependency.

Answer

The calculated field requires index-time field extraction.

Answer

The calculated field is defined in a field alias configuration.

Answer

The indexer is not configured to apply calculated fields.

Question 12

A support technician is troubleshooting a user who cannot see the 'Field sidebar' and 'Timeline' in the Search & Reporting app. The user says that when they run a search, they only see the results in a table format, but no side panels or timeline below the search bar. The technician checks the user's settings and finds that the user's default app is set to 'Search & Reporting'. The technician then looks at the user's browser and notices that the user has a very small browser window. What is the most likely cause of the missing panels?

Accepted Answer

The browser window is too small, causing panels to be hidden by the responsive interface.. Splunk Web has a responsive interface that hides the field sidebar and timeline when the browser window is too small. The technician noticed the user’s browser window was very small, which causes these panels to be hidden to fit the viewport. Option A is incorrect because the default app is set correctly to 'Search & Reporting'. Option B is incorrect because there is no specific user preference to disable the timeline; the timeline is controlled by the responsive layout. Option D is incorrect because user roles do not affect the visibility of these UI elements; they are available to all roles.

Answer

The user's default app is set incorrectly.

Answer

The user has disabled the timeline in their preferences.

Answer

The user's role does not have permission to view the timeline.

Question 13

Which TWO commands can be used to filter events based on a field value? (Choose two.)

Accepted Answer

search. The search command (B) filters events by matching keywords and field-value expressions against the raw event data, so a clause like `search status=404` returns only events whose status field equals 404. The where command (D) filters events by evaluating a Boolean expression against extracted fields, so `where status=404` keeps only events where that field comparison is true. The eval command (A) is used to calculate or assign new field values, not to filter events. The stats command (C) aggregates events into summary results rather than filtering individual events by a field value. The table command (E) only formats and displays selected fields in a tabular output and does not filter events.

Answer

eval

Answer

stats

Answer

table

Question 14

A Splunk administrator is configuring a lookup to enrich firewall logs with a static CSV file containing allowed IP ranges. Which TWO statements about lookup configuration are correct?

Accepted Answer

The lookup definition must include the fields to match on from the event data.. Option B is correct because a lookup definition (transforms.conf stanza) must specify the match fields — the event fields used to join against the lookup table's columns — so Splunk knows which values to compare when enriching firewall logs. Option C is correct because static CSV lookups can be uploaded directly via Settings > Lookups > Lookup table files, which stores the file in the app's lookups directory and makes it available for a lookup definition. Option A is wrong because KV Store lookups are for dynamic, mutable data, not static CSV tables, which use file-based (CSV) lookups. Option D is wrong because lookup definitions live in transforms.conf, not macros.conf (macros.conf holds search macros). Option E is wrong because the CSV is typically placed in the app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/<app>/lookups) or uploaded via the UI, not required to be at an absolute path on the search head.

Answer

A KV Store lookup is required for static tables.

Answer

The lookup is defined in macros.conf.

Answer

The CSV file must be placed in an absolute path on the search head.

Question 15

Which TWO are benefits of using data model acceleration? (Choose two.)

Accepted Answer

Reduced time to run complex aggregations and statistical searches.. Data model acceleration precomputes and stores the results of a data model's underlying search into a high-performance columnar format (tsidx files in the acceleration summary), so options A and B are correct: A is right because complex aggregations and statistical searches (e.g., stats, eventstats, tstats-style queries) no longer have to scan and compute over raw events at search time, dramatically cutting their runtime, and B is right because queries against the accelerated data model read the prebuilt summaries instead of the full raw dataset, yielding much faster search performance on large datasets. The unmarked options do not belong: C is wrong because acceleration consumes additional disk space for the summary/tsidx files rather than compressing indexed data to save space, D is wrong because acceleration supplements rather than replaces data indexing (raw data must still be indexed for the model to be built and for non-accelerated searches), and E is wrong because acceleration does not automatically optimize or simplify data model relationships—relationship design remains a manual modeling task.

Answer

Reduced disk space usage by compressing indexed data.

Answer

Eliminates the need for data indexing by using summary data.

Answer

Simplified data model design by automatically optimizing relationships.