SPLK-1001 Practice Test 19 — 15 Questions

Question 1

A Splunk admin notices that a dashboard panel using `timechart` is showing gaps (null values) for some time periods where no events exist. The admin wants to display a zero instead of null to make the chart continuous. Which command should be added before `timechart`?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

`fillnull`. `fillnull`, is correct because it explicitly replaces null values with a specified value (default 0) in the results of a transforming command. In Splunk, `fillnull` is used after commands like `timechart` to fill gaps where no events exist. The question asks which command should be added "before `timechart`", but in practice, `fillnull` is placed after `timechart`. However, among the given choices, only `fillnull` can achieve the desired outcome. Option A (`timechart useother=t`) is unrelated to null filling. Option B (`eventstats`) does not replace nulls. Option C (`makecontinuous`) creates time buckets for missing periods but does not fill the null values; it leaves them as null or adds null events. Therefore, `fillnull` is the correct command to use in conjunction with `timechart` to display zeros instead of nulls.

Answer

`timechart useother=t`

Answer

`eventstats`

Answer

`makecontinuous`

Question 2

A time-based lookup is configured with `max_offset_secs = 3600`. An event has a timestamp 100 seconds after the lookup time value. Will the lookup match?

Accepted Answer

Yes, because the offset is within the allowed range.. The time-based lookup is configured with `max_offset_secs = 3600`, which defines the maximum allowed offset (in seconds) between the event timestamp and the lookup time. Since the event timestamp is 100 seconds after the lookup time, the offset is 100 seconds, which is well within the 3600-second window. No `min_offset_secs` is required for this match to succeed, as the default minimum offset is 0 (meaning the event timestamp can be equal to or later than the lookup time).

Answer

Yes, but only if min_offset_secs is also set.

Answer

No, because the event timestamp is later than the lookup time.

Answer

No, because the event timestamp must be before the lookup time.

Question 3

Which THREE of the following are true about automatic field extraction in Splunk?

Accepted Answer

It can extract fields from structured data like JSON and XML.. Splunk's automatic field extraction (also known as 'auto kv' or 'key-value extraction') can parse structured data formats such as JSON and XML. When Splunk indexes data, it automatically identifies key-value pairs in these formats and extracts them as searchable fields without requiring manual configuration.

Answer

Custom field extractions are not allowed if auto extraction is enabled.

Answer

Auto extraction cannot be disabled for specific sourcetypes.

Question 4

A user creates a CSV lookup file 'users.csv' with columns 'userid' and 'full_name'. A lookup definition is set up. The search `index=auth | lookup users.csv userid AS user OUTPUT full_name` returns no results for 'full_name' even though there are matching userids. What is the most likely cause?

Accepted Answer

The lookup name 'users.csv' should be the lookup definition name, not the filename.. The `lookup` command in Splunk requires the lookup definition name, not the filename, when referencing a lookup table. Even though the CSV file is named 'users.csv', the lookup definition created in Settings > Lookups defines the logical name used in searches. Using the filename directly causes Splunk to fail to resolve the lookup, resulting in no 'full_name' values being returned.

Answer

The search returns no events for the userid field.

Answer

The lookup command should be placed before the index search.

Answer

The 'AS user' should be 'AS userid'.

Question 5

Which THREE of the following are features available in the Splunk Settings menu?

Accepted Answer

Indexes. The Splunk Settings menu provides administrative controls for configuring core system components. Indexes (B) are correct because this menu allows you to create, edit, and manage index definitions, including setting retention policies and storage locations. Data inputs (C) is correct as the menu provides access to configure all input types (e.g., monitor, script, syslog, HTTP Event Collector). Roles (E) is correct because the Settings menu includes the Access Controls section where you can define role-based permissions and capabilities.

Answer

Data summary

Answer

Search history

Question 6

An administrator notices that a user's search is timing out after 60 seconds. The search needs up to 5 minutes to complete. What should the administrator do?

Accepted Answer

Increase the 'Search Timeout' setting in system settings.. The 'Search Timeout' setting under Settings > System settings controls the maximum time a search job can run before being terminated. By default it is 60 seconds; increasing it to 5 minutes allows the search to complete. Option B is incorrect because 'Search Results Retention' in account preferences controls how long completed results are saved, not the timeout for running searches.

Answer

Reduce the time range of the search to run faster.

Answer

Adjust the 'Search Results Retention' in the user's account preferences.

Answer

Change the search to a real-time search to avoid timeout.

Question 7

A large enterprise is using Splunk Enterprise to monitor web server logs from 200 servers. The logs are forwarded via a heavy forwarder cluster. Recently, a user has reported that when they log into Splunk Web and navigate to the Search & Reporting app, the search bar is empty, and they cannot see any data. The user has confirmed that other users can see data and run searches. The user is part of the 'power' role. The queries for the web server logs use the index 'web_logs'. The user can see the index in the Data Summary. The user has cleared the browser cache and tried a different browser, but the issue persists. What is the most likely cause of this issue?

Accepted Answer

The user's search time range is set to a timeframe before any data was indexed.. The user can see the index in Data Summary, indicating that the index exists and the user has read access. Other users can search, so the role is not restricted. The empty search bar and lack of results suggest that the default search time range (possibly 'All time' or a specific range) is set to a timeframe before any data was indexed. Changing the time range to a more recent period would likely show data. Option A is incorrect because the index appears in Data Summary, meaning the user has read permission. Option B is incorrect because other users can search, and browser/connectivity issues would affect all users. Option C is incorrect because other users with the same role can search.

Answer

The user's account lacks read permission on the index 'web_logs'.

Answer

The browser is blocking Splunk Web from communicating with the search heads.

Answer

The 'power' role is restricted from running searches on the 'web_logs' index.

Question 8

A user wants to see the values of all fields in an event, including fields that are not automatically extracted. Which search command should be used?

Accepted Answer

`| table *`. The `| table *` command displays all fields in each event, including those not automatically extracted, by listing every field in a tabular format. This is because the asterisk wildcard in `table` includes all fields present in the search results, regardless of whether they are extracted by default or through custom parsing. In contrast, `| fields *` only retains fields that are already known to the search index, not necessarily showing all raw event data.

Answer

`| rex`

Answer

`| fields *`

Answer

`| spath`

Question 9

A company uses Splunk to monitor its e-commerce platform. They have a lookup file (user_geo.csv) that maps user_id to city, state, and country. The search `index=ecommerce sourcetype=access_combined | lookup user_geo user_id OUTPUT city, state, country | stats count by country` is used to analyze user locations. Recently, the lookup stopped returning results for many events. The lookup file is updated daily via a script that pulls from an external API. The Splunk administrator checks the lookup definition and finds that the lookup is configured to automatically reload every 24 hours. The last successful load was 23 hours ago. The events still contain the 'user_id' field. Which course of action should the administrator take first?

Accepted Answer

Manually reload the lookup using the `| inputlookup user_geo.csv | outputlookup user_geo.csv` technique or the UI reload button.. The correct first action is to manually reload the lookup (Option C). Although the lookup is set to auto-reload every 24 hours, the last successful load was 23 hours ago and the lookup file is updated daily. The timing gap means the lookup might still contain old data until the next scheduled reload. Manually reloading forces the lookup to load the latest file immediately. Option A is unnecessary because the search already uses `user_id` and results were working before; the `user_id` field is present. Option B (increasing reload frequency) would only help if the issue were timing, but the immediate fix is to manually reload. Option D (using `inputlookup`) would load the lookup as events, not enrich the search, so it would not solve the enrichment problem.

Answer

Verify that the events contain the `user_id` field by running `index=ecommerce sourcetype=access_combined | head 10`.

Answer

Increase the auto-reload interval to 12 hours to ensure more frequent updates.

Answer

Modify the search to use `| inputlookup user_geo.csv` instead of the lookup command.

Question 10

When creating a dashboard panel that displays a line chart of CPU usage over time, which visualization option should be used to show multiple series (each CPU core) with different colors?

Accepted Answer

Overlay. The 'Overlay' visualization option in Splunk allows you to display multiple data series (e.g., each CPU core) as separate lines on the same chart, each with a distinct color. This is essential for comparing CPU usage across cores over time without merging or stacking the values, which would obscure individual core behavior.

Answer

Line mode

Answer

Stacking

Answer

Markers

Question 11

An IT administrator has a dashboard with multiple panels that all use the same base search but with different post-processing filters. The dashboard is slow to load. Which optimization technique is most effective?

Accepted Answer

Implement a base search and use post-process searches. Using a base search with post-processing filters allows the dashboard to run the expensive base search once and then apply lightweight filter transformations on each panel. This avoids redundant data retrieval and processing, significantly reducing load time compared to running separate searches per panel.

Answer

Remove data model acceleration from the underlying data

Answer

Enable report acceleration on each panel

Answer

Duplicate the base search in each panel

Question 12

Which TWO of the following are knowledge objects in Splunk?

Accepted Answer

Field extraction. Field extraction (A) is a knowledge object because it defines how to extract structured fields from raw event data, enabling search-time field recognition. Alerts (B) are knowledge objects that define scheduled searches with conditions to trigger notifications or actions, storing configuration in Splunk's knowledge object layer.

Answer

Dashboard

Answer

Source type

Answer

Index

Question 13

A search returns many duplicate events due to data source redundancy. Which command can remove duplicate events based on a specific field?

Accepted Answer

dedup event_id. The `dedup` command removes duplicate events based on the values of one or more specified fields. In this case, `dedup event_id` will keep only the first occurrence of each unique `event_id` value, discarding subsequent duplicates. This is the correct command for removing duplicate events based on a specific field.

Answer

uniq event_id

Answer

fields event_id

Answer

sort event_id

Question 14

Which TWO are best practices for designing data models in Splunk?

Accepted Answer

Define constraints that are as specific as possible to reduce unwanted events.. Defining constraints as specifically as possible in a Splunk data model reduces the inclusion of unwanted events, ensuring that only relevant data is processed and improving query performance. This practice aligns with Splunk's recommendation to use precise constraints to filter out noise and maintain data integrity within the data model.

Answer

Use the same field names across different datasets in the same data model.

Answer

Use a flat hierarchy with many fields to avoid complex constraints.

Answer

Avoid using field aliases because they confuse the data model.

Question 15

Which TWO of the following are valid ways to navigate from a search result to a dashboard?

Accepted Answer

Click 'Open in Dashboard' from the search actions menu (ellipsis).. Clicking 'Open in Dashboard' from the search actions menu (ellipsis) directly converts the current search results into a dashboard panel, allowing you to immediately add the visualization to a new or existing dashboard. This is a built-in Splunk navigation feature that streamlines the workflow from ad-hoc search to persistent dashboard content.

Answer

Drag a field from the Fields sidebar to the dashboard canvas.

Answer

Click the 'Dashboard' button on the search bar.

Answer

Right-click on the timeline and select 'Open in Dashboard'.