SPLK-1001 Practice Exam 3 — 20 Questions

Question 1

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Accepted Answer

Save as alert. The 'Save As' menu in the Search app provides direct options to persist search results as an alert, a report, or a dashboard panel. 'Save as alert' (A) creates a scheduled search that triggers actions when conditions are met, which is a core feature for proactive monitoring.

Answer

Save as event type

Answer

Save as search macro

Question 2

A user wants to view the contents of a lookup table file named `users.csv` that is stored in Splunk. Which two commands can be used? (Choose two.)

Accepted Answer

`| inputlookup users.csv`. `| inputlookup users.csv` reads the contents of a static lookup table file named `users.csv` directly from Splunk's lookups directory. Option B is correct because `| inputlookup users` references the lookup by its defined name in transforms.conf, which maps to the file `users.csv`; this is the standard way to access a lookup that has been configured as a lookup definition.

Answer

`| fields users.csv`

Answer

`| outputlookup users.csv`

Answer

`| lookup users.csv`

Question 3

Drag and drop the steps to create a Splunk dashboard with a single panel into the correct order.

Accepted Answer

Execute search, then Save As > Dashboard Panel, then select or create dashboard, then configure panel settings.. The correct sequence for creating a Splunk dashboard with a single panel is to first execute a search, then save it as a dashboard panel (not as a report), select or create the dashboard, and finally configure the panel settings. This ensures the panel is directly linked to the search and properly placed in the dashboard.

Answer

Create dashboard first, then execute search, then add panel to dashboard, then configure panel settings.

Answer

Execute search, then Save As > Report, then add report to dashboard as panel, then configure panel settings.

Answer

Add panel to dashboard first, then execute search, then save results, then configure panel settings.

Question 4

A financial services company uses Splunk to monitor authentication logs from 500 remote servers. They created a data model named 'Authentication' with 15 fields including 'user', 'src_ip', 'dest_ip', 'action', and 'status'. They enabled acceleration with a summary range of 1 day and set the maximum search time range to 30 days. After one month of operation, searches against the data model that used to complete in seconds now time out after 60 seconds. The average daily log volume is 10 GB. The admin runs | datamodel Audit and discovers that the summary size is approximately 5 GB per day, which is similar to the raw data index size. The search head has 16 GB RAM and 4 CPU cores, and no other resource issues are observed. What is the most likely cause of the performance degradation?

Accepted Answer

Review the data model fields and remove high-cardinality fields from the acceleration or the data model itself.. When the summary size is nearly equal to the raw data volume, it indicates that acceleration is not effectively reducing the data. This typically occurs when the data model includes high-cardinality fields (e.g., 'user', 'src_ip', 'dest_ip') that create too many unique combinations, preventing meaningful summarization. As a result, the acceleration summary remains large, causing searches to time out due to I/O overhead. Option A is incorrect because increasing the summary range would further increase the summary size and worsen performance. Option B is incorrect because search-time vs. indexed extractions do not address the root cause of high cardinality. Option D is incorrect because the number of fields alone is not the issue; it is the high cardinality of specific fields that degrades acceleration efficiency.

Answer

Optimize the underlying searches by using indexed field extractions instead of search-time field extractions.

Answer

Increase the summary range from 1 day to 7 days to reduce the number of summaries.

Answer

Reduce the number of fields in the data model to fewer than 10 to improve acceleration efficiency.

Question 5

An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?

Accepted Answer

The KV Store lookup is cached and not refreshed between searches. The most likely cause is that the KV Store lookup is cached. By default, KV Store lookups are cached per search and only refreshed when the cache expires or at the start of a new search. If analysts run searches within the same cache duration, they may miss recent updates. Option A is not applicable because KV Store lookups are not time-based in the same way as time-based lookups. Option B is incorrect because IP addresses are not case-sensitive; lookup matching is case-insensitive by default. Option C is incorrect because the _raw field is unrelated to lookup functionality. Therefore, the correct answer is D.

Answer

The lookup is configured as time-based and is out of range

Answer

The IP addresses are case-sensitive and messy

Answer

The search does not include the _raw field

Question 6

Which of the following are true about creating and managing dashboards in Splunk? (Choose all that apply. There are four correct answers.)

Accepted Answer

A dashboard can include panels based on reports, inline searches, or both.. The four correct statements are: (1) A dashboard can include panels based on reports, inline searches, or both; (2) A dashboard panel can display data using visualizations such as charts, tables, and maps; (3) A dashboard can be created from scratch using the Dashboard Editor without any existing search; (4) When editing a dashboard, you can set permissions to control which users can view or edit it. These are all documented features of Splunk dashboards. The two incorrect statements are false: dashboards do NOT require a saved report (they can use inline searches), and there is no fixed limit of five panels per dashboard.

Answer

Dashboards can only contain up to five panels per dashboard.

Answer

All dashboards must be based on a saved report before they can be created.

Question 7

A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?

Accepted Answer

Use the `| datamodel <model> search` command to preview data and identify missing fields.. The `| datamodel` command allows you to view the underlying data of a data model, which helps identify fields that are not populating correctly. Option B is not the best first step because rebuilding acceleration may be time-consuming and not address the root cause. Option C is incorrect because increasing the acceleration time range does not affect field population; it only caches more data. Option D is incorrect because field extractions in transforms.conf are not directly related to data model field population; the issue is more likely with data model field definitions.

Answer

Rebuild the data model acceleration.

Answer

Increase the acceleration time range.

Answer

Check the field extractions in transforms.conf.

Question 8

When viewing search results, what is the difference between the 'Events' tab and the 'Statistics' tab?

Accepted Answer

Events tab displays raw event data; Statistics tab displays transformed output (statistical tables, charts).. The Events tab displays raw event data, while the Statistics tab displays transformed output such as statistical tables and charts. Option A is wrong because both tabs can filter by time and other fields, not just time. Option B is wrong because both tabs can show data per index or sourcetype; the difference is not about index vs. sourcetype. Option C is wrong because both tabs can show more than 100 events depending on the search and settings.

Answer

Events tab can only filter by time; Statistics can filter by any field.

Answer

Events tab shows data per index; Statistics shows data per sourcetype.

Answer

Events tab shows only the first 100 events, Statistics shows all.

Question 9

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup table in Splunk. The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Answer

The time range is set to a period with no data

Answer

The sort command requires a field name

Answer

The where clause is incorrectly formatted

Question 10

A dashboard designer wants to create a drilldown from one chart to another dashboard. Which TWO actions must be configured? (Select two.)

Accepted Answer

Set the target dashboard's token to accept the drilldown value. Options D and E are correct because for a drilldown from one chart to another dashboard, you must set the source chart's drilldown action to 'link to dashboard' (option E) and configure the target dashboard to accept a token from the drilldown (option D). Option A is incorrect because adding a search command is not required for drilldowns. Option B is incorrect because 'link to search' opens a search, not a dashboard. Option C is not necessary; while dashboard permissions control access, they are not part of the drilldown configuration.

Answer

Add a search command to the chart

Answer

Set the source chart's drilldown to 'link to search'

Answer

Enable dashboard permissions

Question 11

A new user wants to start a search in Splunk Web. Which is the first step they should take?

Accepted Answer

Click into the search bar and type a query.. The search bar is the primary location to enter search queries in Splunk Web. Option B is wrong because 'Add Data' is for data ingestion, not searching. Option C is wrong because 'Settings' is for configuration, not initiating a search. Option D is wrong because 'Reports' lists saved searches, not the starting point for a new ad-hoc search.

Answer

Click on 'Add Data' to ingest logs.

Answer

Click on 'Settings' in the top menu bar.

Answer

Open the 'Reports' listing and select a saved search.

Question 12

Refer to the exhibit. A Splunk user is building a data model for Apache error logs. The configuration above extracts an error_type field. However, when previewing data in the data model, the error_type field is not available. What is the most likely cause?

Accepted Answer

The DEST_KEY is set to _meta, which does not make the field available for data models.. When DEST_KEY is set to _meta, the extracted field is stored in the internal metadata of the event rather than in the event's indexed fields. Data models rely on indexed fields that are part of the event's key-value structure, so fields stored in _meta are not accessible for data model field extraction or preview.

Answer

The regular expression in transforms.conf is incorrectly formatted.

Answer

The transforms.conf is in the wrong app context.

Answer

The transform name in props.conf does not match the transform name in transforms.conf.

Question 13

A company has a distributed Splunk environment with a single search head and 4 indexers. The data volume is approximately 50 GB per day across various sourcetypes. Users frequently run searches that span 'All time' (from the time picker), and these searches are taking significantly longer than expected. The search head shows high CPU usage during these searches, while indexers are moderately loaded. The administrator has verified that all indexers are healthy and that there are no network bottlenecks. The data is raw log data with minimal field extractions. Which course of action will most effectively improve search performance for these 'All time' searches?

Accepted Answer

Enable summary indexing and use the tstats command for searches over large time ranges.. Summary indexing pre-computes statistical data (e.g., counts, sums, averages) and stores it in a separate index. The `tstats` command queries these pre-aggregated summaries instead of scanning raw data, drastically reducing I/O and CPU load on the search head for 'All time' searches. This directly addresses the high CPU usage on the search head and the long search times caused by scanning 50 GB/day of raw logs.

Answer

Upgrade the search head to a larger instance with more CPU cores and memory.

Answer

Increase the number of indexers to 8 to distribute the search load more evenly.

Answer

Reduce the data retention period on the indexers from 90 days to 30 days.

Question 14

A user wants to create a Pivot report that counts failed login attempts by user and hour. Which data model dataset and fields are most appropriate?

Accepted Answer

Authentication dataset, fields: user, action, and use _time for hour. The Authentication dataset is specifically designed to store login-related events, and the 'action' field indicates success or failure. Using 'user' and '_time' (extracted to hour via time bucketing) allows counting failed attempts per user per hour. The other datasets either lack the necessary fields or are not focused on authentication events.

Answer

Web dataset, fields: user, status, time

Answer

Network_Traffic dataset, fields: user, dest, action

Answer

Authentication dataset, fields: user, action, src

Question 15

Refer to the exhibit. The search returns zero results. What is a likely cause?

Accepted Answer

The 'raw_data' field may not contain valid JSON. The 'spath' command extracts fields from JSON, but if 'raw_data' is not a valid JSON string, extraction fails. Also, 'search' after 'spath' should work, but if 'response.status' is not extracted, no results. The most common issue is that the field 'raw_data' might not exist or the JSON path is incorrect.

Answer

The 'spath' command should use 'output=response.status' to create the field

Answer

The search should be 'sourcetype=json_logs' first

Answer

The 'stats' command cannot use 'response.status' because it's not a field

Question 16

A newly created dashboard panel is not displaying data, showing only 'No results found'. The search query works correctly in the Search app. What is the most likely cause?

Accepted Answer

The dashboard's time range picker is set to a different range than the search was tested with.. The most common reason a dashboard panel shows 'No results found' despite the search working in the Search app is a mismatch in the time range. The dashboard's time range picker may be set to a different absolute or relative time (e.g., 'Last 15 minutes' vs. 'All time') than the search was tested with, causing the query to return no events within the dashboard's time boundary.

Answer

The dashboard has not been shared with the user's role.

Answer

The search contains a syntax error that is not caught by the dashboard editor.

Answer

The panel is not based on a saved report.

Question 17

Refer to the exhibit. An analyst runs this search and expects to see a table of status codes with their counts, filtered to those with count greater than 100. The search returns zero results even though there are many events. What is the most likely reason?

Accepted Answer

The rex command is incorrectly extracting the status_code field.. The rex command is incorrectly extracting the status_code field because the regular expression pattern does not match the actual format of the status codes in the events. If the pattern is wrong or the field is not captured correctly, the stats command will not find any values for status_code, resulting in zero results even though events exist. The where command then filters on a field that doesn't exist or is null, returning no rows.

Answer

The sourcetype should be 'access_combined' instead.

Answer

The stats command should use 'values(status_code)' instead.

Answer

The where command should be placed before the stats command.

Question 18

A dashboard has a radio button input that selects a sourcetype. The panel uses `index=web sourcetype=$source$`. However, when the user selects a sourcetype, the panel doesn't update. What is the most likely cause?

Accepted Answer

The token name in the search is `$source$` but the input token is named `sourcetype`.. The dashboard panel does not update because the token referenced in the search string (`$source$`) does not match the name of the radio button input. In Splunk, a dashboard input creates a token with the name specified in its `token` attribute. If the input's token is named `sourcetype`, the search must use `$sourcetype$` to reference its value. Using `$source$` means the search looks for a token that does not exist, so no substitution occurs and the panel remains static.

Answer

The search includes a `stats` command that ignores the token.

Answer

The panel is a single value panel that does not update dynamically.

Answer

The time range is too short and returns no events.

Question 19

Which THREE of the following are standard components of the Splunk Web Search interface? (Choose three.)

Accepted Answer

Field sidebar. The Field sidebar (B) is a standard component of the Splunk Web Search interface that displays extracted fields from search results, allowing users to click on field values to refine searches. It is always present by default in the Search & Reporting app, providing immediate access to field discovery and filtering without additional configuration.

Answer

Commands bar

Answer

Job Inspector

Question 20

Refer to the exhibit. The search runs but the user field is not modified. What is the most likely cause?

Accepted Answer

The function name is misspelled (should be lower).. The `lower()` function in Splunk's `eval` command is case-sensitive and must be written in lowercase. The exhibit shows `Lower(user)` with a capital 'L', which Splunk does not recognize as a valid function, so the `eval` command fails silently and the `user` field remains unmodified.

Answer

The eval command does not modify existing fields.

Answer

The search must be run over a time range.

Answer

The field must be referenced as 'user'.