SPLK-1001 Practice Test 2 — 10 Questions

Question 1

A Splunk admin wants to enrich web server logs with geographic location data based on IP addresses. Which approach should they use?

Accepted Answer

Configure a lookup definition and use lookup command. Splunk's lookup command, combined with a lookup definition that references a geographic IP-to-location database (such as MaxMind GeoLite2), allows the admin to enrich web server logs with fields like city, country, and coordinates based on the client IP address. This is the standard, efficient approach for IP geolocation enrichment in Splunk, as it leverages pre-built external data without requiring custom parsing or calculations.

Answer

Use rex to extract location from the IP

Answer

Use an eval command to calculate coordinates

Answer

Use fields command to add location

Question 2

A dashboard includes a single value visualization showing the total number of login failures. The number seems too high. Which common mistake could cause inflated counts?

Accepted Answer

Using `count` instead of `sum` when each event holds multiple failures. When a single event contains multiple login failures (e.g., a log line like 'Failed logins: 5'), using `count` merely counts the number of events, not the total failures. The `sum` command is required to aggregate the numeric field representing failures across events, giving the true total. This is a classic pitfall in Splunk where `count` (event count) is confused with `sum` (field value summation).

Answer

Using `dedup` before counting

Answer

Splitting by user without combining

Answer

Setting a too narrow time range

Question 3

A user wants to see the top 5 most common values of the 'action' field in the web access logs. Which command should be used?

Accepted Answer

top. The `top` command is designed to find the most frequent values of a field. By default, it returns the top 10 results, but you can specify `limit=5` to get the top 5 most common values of the 'action' field in web access logs.

Answer

rare

Answer

fields

Answer

sort

Question 4

Which of the following are true statements about using fields and lookups in Splunk? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `| inputlookup` command is used to load the entire contents of a lookup file into search results, allowing you to inspect or aggregate on the lookup data directly.. The first option is correct because lookup tables in Splunk allow you to add fields to events by matching a field in the event with a field in the lookup file, enriching the data. The second option is correct because the `| lookup` command supports both CSV files and KV store collections, enabling flexible data enrichment. The fourth option is correct because geospatial lookups require latitude and longitude coordinates and are used with the `| geom` command for map visualizations. The fifth option is correct because `| inputlookup` loads the entire lookup file into search results, allowing direct inspection or aggregation of lookup data.

Answer

Field aliases defined in props.conf can rename a field in search results without altering the raw data, but they are not applied retroactively to events indexed in the past.

Answer

Extracted fields using the `| rex` command are automatically added to the field sidebar and can be used in searches without any additional configuration.

Question 5

A user creates a dashboard with multiple panels. Some panels share the same search. To improve performance, what should the user do?

Accepted Answer

Define a base search and use post-process for each panel. Defining a base search and using post-process searches allows the dashboard to run the common search once and then apply different post-processing transformations on the same result set. This reduces the overall search load on the indexers and search head, improving performance by avoiding redundant data retrieval and aggregation for each panel.

Answer

Use post-process searches without a base search

Answer

Create separate searches for each panel with same query

Answer

Increase the time range to include more data

Question 6

A Splunk administrator notices that a new user cannot see any data in the Search & Reporting app, even though the user has the 'user' role. What is the most likely cause?

Accepted Answer

The user has not been granted access to any indexes.. The 'user' role in Splunk includes the 'search' capability by default, which allows users to run searches. However, even with the search capability, a user cannot see any data unless they have explicit read access to one or more indexes. Index-level access is controlled via roles, and the default 'user' role does not grant access to any indexes; it only provides the ability to search indexes that the user has been granted access to. Therefore, the most likely cause is that the new user has not been assigned to a role that includes index access.

Answer

The user does not have the 'search' capability.

Answer

The user is limited to viewing only saved searches.

Answer

The user is not using the correct time range.

Question 7

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Accepted Answer

Concatenating two strings: eval fullname = firstname + " " + lastname. The 'eval' command can concatenate strings using the plus (+) operator, as shown in the example 'eval fullname = firstname + " " + lastname'. This creates a new field 'fullname' by combining the values of 'firstname', a space, and 'lastname'.

Answer

Grouping events by a field: eval by host

Answer

Sorting events by a field: eval sort by _time

Question 8

Which three of the following statements about lookup tables and their usage in Splunk are correct? (Choose three.)

Accepted Answer

A lookup table can be defined as a CSV file stored in the lookups directory of an app. The first three statements are correct. Lookup tables can be defined as CSV files stored in the lookups directory of an app, which is a standard method for creating static lookups. The `| inputlookup` command retrieves and returns the contents of a lookup table as search results, allowing you to inspect or use the data. Lookups can be configured to automatically enrich events during search time using the `lookup` command, which matches fields in events against the lookup table to add additional fields.

Answer

Lookup table files must always have a .csv extension and cannot be in other formats like .kvstore

Answer

The `| outputlookup` command is used to append data to an existing lookup file without any limitations

Answer

Lookups can only match on a single field; using multiple fields requires creating separate lookups

Question 9

Which TWO of the following are valid ways to share a Splunk dashboard?

Accepted Answer

Share via URL. Splunk dashboards can be shared via a direct URL, which allows other users with appropriate permissions to access the dashboard in their own Splunk instance. This method leverages Splunk's role-based access control to ensure only authorized users can view the shared content.

Answer

Send via email

Answer

Export as PDF

Answer

Clone dashboard

Question 10

Which of the following are components of the Splunk interface that can be used to refine and focus search results? (Choose all that apply. There are four correct answers.)

Accepted Answer

Time Range Picker. The Time Range Picker, Search bar, Fields sidebar, and Search History are all interface components in Splunk that directly allow users to refine and focus search results. The Time Range Picker restricts results to a specific time window, the Search bar is where queries are entered and modified, the Fields sidebar enables selection and filtering of specific fields, and Search History allows reusing or refining past searches. These four tools are integral to iterative search refinement in Splunk's Search & Reporting app.

Answer

Data Summary tab

Answer

Job Inspector