SPLK-1001 Practice Exam 2 — 20 Questions

Question 1

A team uses a lookup to map IP addresses to geographic locations. The lookup is large and updated weekly. Which lookup type is best suited?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is best suited for this use case because it is static, large, and updated on a schedule. CSV lookups are loaded into memory and can handle large datasets efficiently, and they are easily replaced or updated weekly by overwriting the file. This approach avoids the overhead of a KV store or external service for a dataset that does not require real-time updates or complex queries.

Answer

External lookup

Answer

Scripted lookup

Answer

KV store lookup

Question 2

Which of the following is a default field that is automatically extracted by Splunk?

Accepted Answer

`host`. The `host` field is a default field that Splunk automatically extracts from every event, typically derived from the hostname of the machine that generated the data. It is one of the three default fields (along with `source` and `sourcetype`) that Splunk uses to categorize and search events, and it is always available without any custom field extraction or configuration.

Answer

`department`

Answer

`error_code`

Answer

`user_id`

Question 3

Which TWO of the following commands can be used to create a new field from existing fields?

Accepted Answer

rex. The `rex` command is correct because it uses regular expressions to extract new fields from existing field values. For example, `rex field=message "(?<newField>pattern)"` creates a new field named `newField` by matching a portion of the `message` field. This allows you to derive structured data from unstructured or semi-structured fields.

Answer

table

Answer

convert

Answer

fields

Question 4

Which of the following is the default time range in a new Splunk search?

Accepted Answer

All time. When you open a new search in Splunk, the default time range is set to 'All time' (no time filter), meaning the search will scan all indexed data unless you explicitly specify a time range. This is because Splunk defaults to showing all available events to avoid inadvertently excluding data, and it is the user's responsibility to narrow the search scope.

Answer

Last 24 hours

Answer

Last 7 days

Answer

Real-time

Question 5

A security team uses a KV Store lookup to track threat intelligence indicators (IPs, domains) with a field 'indicator' and a field 'threat_type'. They regularly update the KV Store with new indicators. The team notices that searches using the lookup are very slow when the KV Store contains over 100,000 entries. They want to improve lookup performance without losing the ability to update frequently. Which approach should they take?

Accepted Answer

Add an index on the 'indicator' field in the KV Store collection to speed up lookup queries. Adding an index on the 'indicator' field in the KV Store collection allows Splunk to perform faster lookups by using a B-tree or similar index structure, reducing the need for a full collection scan. This directly addresses the performance degradation seen with over 100,000 entries while still supporting frequent updates, as indexes are maintained dynamically.

Answer

Split the KV Store into multiple smaller KV Stores based on threat_type

Answer

Convert the KV Store to a CSV file and use the lookup command

Answer

Increase the memory allocation for the Splunk search head

Question 6

A user wants to see the list of all fields that are extracted from a specific sourcetype. Which command should they use?

Accepted Answer

| fieldsummary. The `fieldsummary` command provides a summary of all fields extracted from the events in the search results, including their count, distinct count, and percentage of events containing each field. When applied to a specific sourcetype, it lists every field that has been extracted from that sourcetype, making it the correct tool for this task.

Answer

| rex field=_raw ...

Answer

| fields *

Answer

| eval fields=...

Question 7

A small business uses Splunk to monitor their web server. They have a dashboard that shows daily page views. After a system update, the dashboard loads very slowly, often timing out. The dashboard uses a search that takes only 2 seconds when run manually. The dashboard has a time range picker set to 'Today'. The update changed some default settings. What is the most likely cause?

Accepted Answer

The time range picker default was reset to 'All Time'. The dashboard was configured with a time range picker set to 'Today', but the system update reset the default to 'All Time'. This causes the search to scan all indexed data, dramatically increasing the data volume and search time, leading to timeouts. A manual search taking 2 seconds on a small time range becomes extremely slow when applied to the entire dataset, which is why the dashboard fails while the manual search still works.

Answer

The index was renamed

Answer

The dashboard now uses real-time search

Answer

The search command changed to 'timechart'

Question 8

Refer to the exhibit. The user wants to display the count over time for each source. However, the chart shows only one line labeled 'MyCount'. What is the problem?

Accepted Answer

The `rename` command after `timechart` renames incorrectly; `timechart count by source` creates multiple fields, and `rename count as "MyCount"` does not rename them.. `timechart count by source` generates separate fields for each source value (e.g., `count: source1`, `count: source2`), not a single field named `count`. The subsequent `rename count as "MyCount"` fails to match any existing field, so the chart displays only one line labeled `MyCount` (which is actually a null or default aggregation). To rename all source-specific count fields, you must use a wildcard or rename each field individually.

Answer

The index name is misspelled.

Answer

The `timechart` command should not have `by source`.

Answer

The chart type is line chart by default.

Question 9

Refer to the exhibit. The search returns no results from the lookup. What is the most likely issue?

Accepted Answer

The lookup command references 'error_id' but the alias changed the field to 'error_code'. The search uses `lookup error_codes.csv error_id` but the FIELDALIAS in props.conf has renamed the field `error_id` to `error_code`. Since the lookup command references the original field name `error_id`, which no longer exists in the events after alias processing, the lookup cannot match any values and returns no results.

Answer

The FIELDALIAS syntax is incorrect

Answer

The lookup table is not defined in transforms.conf

Answer

The lookup file 'error_codes.csv' does not exist

Question 10

Which command is used to import an external CSV file into a Splunk lookup table for the first time?

Accepted Answer

`| outputlookup`. The `| outputlookup` command is used to create or overwrite a lookup table file in Splunk from search results. When importing an external CSV file into a Splunk lookup table for the first time, you would first ingest the CSV data (e.g., via `| inputcsv` or by uploading the file), then use `| outputlookup` to write that data into a lookup definition that Splunk can reference.

Answer

`| lookup`

Answer

`| inputlookup`

Answer

`| fields`

Question 11

Which THREE of the following are capabilities of the rex command?

Accepted Answer

Extract fields using regex named groups.. The `rex` command can extract fields using regex named groups, where the group name becomes the field name and the matched value becomes the field value. This is a core capability of `rex` for field extraction in Splunk.

Answer

Perform case-insensitive extraction by default.

Answer

Set a default value for a field.

Question 12

A large enterprise uses Splunk to monitor 500+ servers. A search returns results slowly due to high data volume. Which best practice can improve performance when using the top command?

Accepted Answer

Add a limit to top, e.g., top limit=20. Adding a limit to the top command (e.g., top limit=20) restricts the number of results returned, reducing the computational load and memory usage. In high-volume environments, this directly improves search performance by limiting the aggregation work Splunk must perform across all 500+ servers.

Answer

Use the fields command to remove unnecessary fields

Answer

Use rare instead of top to reduce output

Answer

Apply the sort command before top

Question 13

A security analyst runs a search that returns many fields, most of which are not needed. Which command should be used to remove all fields except 'src_ip', 'dest_ip', and 'action'?

Accepted Answer

| fields + src_ip, dest_ip, action. The `fields` command with the `+` prefix explicitly keeps only the listed fields and removes all others from the search results. This is the correct way to retain only `src_ip`, `dest_ip`, and `action` while discarding the rest.

Answer

| rename src_ip as src, dest_ip as dest, action as act

Answer

| fields - src_ip, dest_ip, action

Answer

| table src_ip, dest_ip, action

Question 14

Refer to the exhibit. A user runs the search shown. The search returns results, but the user wants to use a data model to make future searches faster and more consistent. Which data model should the user select and what is the correct acceleration setting?

Accepted Answer

Use the CIM Web data model and accelerate the 'Web' dataset.. The search shown uses fields like `status`, `action`, `uri`, and `method`, which are standard fields in the CIM Web data model. Accelerating the 'Web' dataset pre-computes the relevant field extractions and aggregations, making future searches faster and more consistent without requiring the user to manually define field extractions or transformations.

Answer

Use the CIM Web data model and select 'Accelerate All Datasets' from the settings.

Answer

Create a new data model called 'Access' and enable acceleration on root events.

Answer

Use the built-in 'Searches' data model to pre-compute the count and status fields.

Question 15

Which TWO actions increase the performance of a dashboard in Splunk? (Choose two.)

Accepted Answer

Use scheduled reports as base searches. Scheduled reports as base searches pre-compute and cache results, reducing the real-time query load on the indexers when the dashboard loads. This shifts expensive computation to off-peak times, improving dashboard rendering speed.

Answer

Add a large number of drilldowns

Answer

Use real-time searches

Answer

Add multiple time range pickers to the dashboard

Question 16

An administrator notices that a data model is not appearing in the Pivot interface. What is a possible reason?

Accepted Answer

The data model is not shared with the user's role.. The Pivot interface only displays data models that have been explicitly shared with the user's role via permissions. If the data model is not shared, it will not appear in the Pivot editor, regardless of its internal validity or acceleration status. This is a core access control mechanism in Splunk.

Answer

The data model acceleration is disabled.

Answer

The data model contains errors in field definitions.

Answer

The data model has no root datasets.

Question 17

A user has a search that produces a chart of error counts by host. They want to add a calculated field 'error_rate' as errors per million events. Which approach is correct?

Accepted Answer

Use eventstats to get total counts, then eval to compute rate, then chart. It uses `eventstats` to compute the total count of events per host across the entire result set, then `eval` to calculate the error rate as (error_count / total_count) * 1,000,000, and finally `chart` to display the results. This two-step approach ensures the total count is available for each row before the rate calculation, which is necessary because `chart` alone cannot reference a field computed in the same command.

Answer

Use chart eval(error_count/total_count) by host

Answer

Use stats to compute error_rate directly: stats avg(error_rate) by host

Answer

Use the lookup command to apply a calculated field

Question 18

Which THREE of the following are best practices when designing data models in Splunk?

Accepted Answer

Enable acceleration only on data models that are used frequently.. Enabling acceleration on all data models consumes significant disk space and processing overhead. Acceleration should be reserved for data models that are queried frequently to optimize resource usage and query performance. Splunk's acceleration feature pre-computes summaries for the root events and child objects, which is only beneficial when the data model is regularly accessed.

Answer

Design the data model based on the most common reports to ensure quick results.

Answer

Include every possible field in the data model to avoid future modifications.

Question 19

A security analyst runs a search for failed logins and wants to display the source IP address, username, and count of failures. However, the field 'src_ip' is not showing in the field picker. Which of the following is the most likely reason?

Accepted Answer

The field is not extracted by default from the data source.. In Splunk, fields like 'src_ip' are not automatically extracted from raw event data unless the data source has a predefined source type that includes field extraction rules (e.g., via a technology add-on or custom regex). If the field does not appear in the field picker, it typically means the search has not extracted it from the raw events, so the analyst must use commands like `rex` or `extract` to parse it.

Answer

The field has no values in the results.

Answer

The user does not have permission to view the field.

Answer

The field name contains a typo.

Question 20

Match each index type to its purpose.

Accepted Answer

Main index: Stores all indexed events by default.. The main index stores all default events. Summary indexes accelerate searching by storing pre-computed results. Metrics indexes handle numeric time-series data, and internal indexes contain Splunk operational logs. Common confusions involve mixing up the main and summary indexes.

Answer

Main index: Stores pre-computed results.

Answer

Summary index: Stores all indexed events by default.