SPLK-1001 Practice Test 21 — 15 Questions

Question 1

An analyst needs to find the count of events by source type for each day in the past week, but only for source types with more than 1000 events. Which search is correct?

Accepted Answer

index=* earliest=-7d | bucket _time span=1d | stats count by sourcetype _time | where count>1000. It uses `bucket _time span=1d` to group events into daily time buckets, then `stats count by sourcetype _time` to count events per source type per day, and finally `where count>1000` to filter for source types exceeding 1000 events per day. The `bucket` command is essential to create discrete daily intervals; without it, `stats count by sourcetype _time` would treat each unique _time value as a separate bucket, which is not the intended daily aggregation.

Answer

index=* earliest=-7d | stats count by sourcetype _time | where count>1000

Answer

index=* earliest=-7d | timechart count by sourcetype | search count>1000

Answer

index=* earliest=-7d | timechart count by sourcetype | where count>1000

Question 2

A user notices that a search returns results only from the last 15 minutes, even though the time range picker is set to "All time". The search string is: error | timechart count. Which is the most likely cause?

Accepted Answer

The search includes an implicit time range like earliest=-15m@m in a saved search or settings.. The search includes an implicit time range, such as `earliest=-15m@m`, which overrides the global time range picker set to 'All time'. This can occur in saved search settings or search macros, forcing the search to only look at the last 15 minutes regardless of the picker selection. The `timechart` command does not impose a time window itself; it only aggregates results within the time range provided by the search.

Answer

The user selected All time but applied a subsearch.

Answer

The indexer is only returning recent data due to performance.

Answer

The timechart command defaults to a 15-minute window.

Question 3

A user selects 'Last 24 hours' from the time picker but their search returns events from only the last hour. What is the most likely cause?

Accepted Answer

The search includes a constraint like `earliest=-1h`. The search string explicitly overrides the time picker with `earliest=-1h`, which restricts results to the last hour regardless of the selected 'Last 24 hours' time range. In Splunk, explicit time modifiers in the search query take precedence over the time picker setting, so the search will only return events from the last hour.

Answer

The user's role restricts time ranges

Answer

The indexer is down, preventing older events from being retrieved

Answer

The timezone is misconfigured, shifting the time range

Question 4

A security team wants to add department info from an external CSV file to events containing user IDs. The CSV has columns 'userid' and 'department'. What is the correct configuration?

Accepted Answer

Define a lookup definition with userid as input field and department as output field, then use | lookup department_lookup userid OUTPUT department. It follows the proper Splunk workflow for enriching events with external data: first define a lookup definition that maps the CSV file's 'userid' as the input field and 'department' as the output field, then use the `| lookup` command with the lookup name (not the filename) to automatically match the userid field in each event and add the corresponding department. This approach is efficient and scalable, as it performs a field-based lookup without requiring a separate join or manual file reference.

Answer

Define a lookup definition, then use | inputlookup department.csv

Answer

Define a lookup table, then use | lookup department.csv userid OUTPUT department

Answer

Use | join userid with department.csv

Question 5

Refer to the exhibit. What is the primary purpose of this search?

Accepted Answer

Identify top URI paths by 404 count. The search uses `top` to find the most frequent URI paths among events with a 404 status code, then displays them in descending order of count. This directly identifies the top URI paths by 404 count, making option C correct.

Answer

Count all events

Answer

List all URIs with 404 errors

Answer

Count 404 errors by URI path

Question 6

A search is slow and the user wants to check the performance metrics. Which part of the UI provides details like run duration, scan count, and result count?

Accepted Answer

Job Inspector. The Job Inspector is the correct tool because it provides detailed performance metrics for a specific search, including run duration, scan count, and result count. Unlike other UI elements, it exposes internal search execution data such as the number of events scanned, the time taken for each phase, and the final result count, which are essential for diagnosing slow searches.

Answer

Timeline

Answer

Statistics tab

Answer

Search History

Question 7

Refer to the exhibit. A user reports they cannot log in to Splunk Web and sees this error in the logs. What is the most likely cause?

Accepted Answer

The user's session has expired or the CSRF token is invalid.. The error message indicates an invalid CSRF token or expired session, which is a security mechanism in Splunk Web that prevents cross-site request forgery. When a session expires or the CSRF token is invalid, the user cannot authenticate or maintain their session, leading to a login failure. This is distinct from incorrect credentials, which would produce a different error.

Answer

The user typed an incorrect username or password.

Answer

The Splunk indexer is not responding.

Answer

The user ran too many searches and hit a limit.

Question 8

Refer to the exhibit. What is the most likely cause of the error?

Accepted Answer

The KV Store is not running. The error message in the exhibit indicates that the KV Store is not running. The KV Store is a Splunk component that stores knowledge objects (such as lookups, data models, and saved searches) in a MongoDB-based key-value store. When the KV Store is down, Splunk cannot access these objects, leading to the displayed error. Restarting the KV Store or ensuring it is enabled in the server.conf file resolves the issue.

Answer

The firewall is blocking port 8191

Answer

The search head is overloaded

Answer

The indexer is out of disk space

Question 9

A user needs to export search results to a CSV file for further analysis. Which method is the most straightforward?

Accepted Answer

Click the Export button and select CSV.. Clicking the Export button and selecting CSV is the most straightforward method for exporting search results to a CSV file in Splunk. This GUI-based approach requires no knowledge of specific commands and is accessible directly from the Search & Reporting app's results page, making it ideal for quick data extraction without altering the search logic.

Answer

Use the | outputcsv command.

Answer

Use the | csv command.

Answer

Use the | append command.

Question 10

Which two of the following are best practices when designing Splunk data models? (Choose two.)

Accepted Answer

Avoid using wildcards in field names.. Wildcards in field names can cause performance degradation and ambiguity in data model acceleration. Splunk recommends using explicit, descriptive field names to ensure efficient indexing and query execution, as wildcards force the search-time field extraction to scan more data than necessary.

Answer

Limit the number of fields to no more than 100.

Answer

Avoid time-based constraints to ensure all historical data is searchable.

Answer

Leave constraints undefined to include all events.

Question 11

Which TWO options are valid ways to add a visualization to a dashboard using Splunk Web? (Choose two.)

Accepted Answer

Clone an existing panel and modify its search. Cloning an existing panel in Splunk Web allows you to duplicate a panel along with its search, then modify the search to create a new visualization without starting from scratch. This is a standard workflow for reusing dashboard configurations efficiently.

Answer

Upload a CSV file directly as a new panel

Answer

Paste a URL of an external chart

Answer

Drag a visualization from the search results page onto the dashboard

Question 12

Refer to the exhibit. The search is not returning the `app_name` field as expected. The lookup has many entries with wildcard patterns. What is the most likely issue?

Accepted Answer

The lookup command uses OUTPUTNEW, but the event already has an app_name field (possibly null) so the lookup does not overwrite it.. The `OUTPUTNEW` clause in the `lookup` command only writes the field if it does not already exist in the event. If the event already contains an `app_name` field (even with a null value), the lookup will not overwrite it, so the expected value from the wildcard lookup is not returned. This is a common pitfall when using lookups with fields that may already be present in the data.

Answer

The lookup definition uses WILDCARD match type, which is incompatible with the lookup command.

Answer

The eval statement should not rename src_ip; the lookup should directly use src_ip.

Answer

The lookup command needs the option max_matches=1 to work with wildcards.

Question 13

Refer to the exhibit. Which severity values will appear in the results?

Accepted Answer

Error, Warning, and Info. The eval command assigns severity based on the case function. If error=1, severity='Error'; if warn=1, severity='Warning'; otherwise, severity='Info'. So all three values are possible.

Answer

Only Error and Warning

Answer

Only Info

Answer

Only Error

Question 14

From the Splunk Home page, which of the following can be accessed directly?

Accepted Answer

All of the above. The Splunk Home page provides direct access to the Search & Reporting app (via the app tile), Settings (via the gear icon in the top navigation bar), and Dashboards (via the Dashboards tile or the dashboards link). Therefore, all three options (B, C, D) are individually accessible, making option A 'All of the above' the correct answer.

Answer

Settings

Answer

Search app

Answer

Dashboards

Question 15

An analyst runs the search `index=web | stats count by status | sort - count` and wants to show only status codes with count greater than 100. Which command should be added before the sort?

Accepted Answer

where count>100. The `where` command is used to filter results based on a condition after statistical aggregation. In this search, `stats count by status` creates a field called `count`, and `where count>100` filters the results to show only status codes with a count greater than 100. The `where` command operates on the results of the `stats` command, making it the appropriate choice for post-aggregation filtering.

Answer

eval count>100

Answer

search count>100

Answer

filter count>100