SPLK-1001 Practice Test 22 — 15 Questions

Question 1

A large financial institution uses Splunk to consolidate logs from thousands of ATMs. Each ATM sends a heartbeat event every 5 minutes containing fields: atm_id, timestamp, status (OK or ERROR), and firmware_version. The operations team wants to find the number of ATMs that have reported at least one ERROR status in the last hour. The initial search is: index=atm sourcetype=heartbeat status=ERROR | dedup atm_id | stats count. However, this search returns a count that is too high because some ATMs report multiple errors within the hour. The team needs an accurate count of ATMs that had any error, regardless of how many error events each ATM generated. The search must be efficient due to the high volume of events. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=atm sourcetype=heartbeat status=ERROR | stats dc(atm_id) as errored_atms. `stats dc(atm_id)` computes the distinct count of `atm_id` values, directly giving the number of unique ATMs that had at least one ERROR event in the last hour. This is efficient as it processes all matching events in a single pass without needing intermediate deduplication or subsearches, which is critical for high-volume ATM log data.

Answer

index=atm sourcetype=heartbeat status=ERROR | stats count(atm_id) as error_events | eval error_events

Answer

index=atm sourcetype=heartbeat status=ERROR | stats count by atm_id | where count >=1 | dedup atm_id | stats count

Answer

index=atm sourcetype=heartbeat status=ERROR | stats values(atm_id)

Question 2

Drag and drop the steps to configure a Splunk alert that sends an email when a specific condition is met into the correct order.

Accepted Answer

Run a search that returns the condition you want to alert on, then save the search as an alert, then define the trigger condition, then add the email action.. Alerts are created from a search, with conditions and actions defined in the alert configuration.

Answer

Save the search as an alert, then run the search, then add the email action, then define the trigger condition.

Answer

Define the trigger condition, then add the email action, then run the search, then save the search as an alert.

Answer

Run a search, then define the trigger condition, then add the email action, then save the search as an alert.

Question 3

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

Accepted Answer

Step 1: Check the time range; Step 2: Check the search syntax; Step 3: Verify that data is being indexed; Step 4: Check internal Splunk logs (e.g., _internal).. Troubleshooting no results involves checking time range, syntax, data existence, and logs.

Answer

Step 1: Check the search syntax; Step 2: Check the time range; Step 3: Verify that data is being indexed; Step 4: Check internal Splunk logs.

Answer

Step 1: Check internal Splunk logs; Step 2: Verify that data is being indexed; Step 3: Check the search syntax; Step 4: Check the time range.

Answer

Step 1: Verify that data is being indexed; Step 2: Check the time range; Step 3: Check the search syntax; Step 4: Check internal Splunk logs.

Question 4

A user wants to see a visual representation of search results over time. Which tab should they use?

Accepted Answer

Visualizations. The Visualizations tab is the correct choice because it provides a graphical representation of search results, such as charts, graphs, and time-series plots, which are essential for visualizing trends over time. In Splunk, after running a search, the user can switch to the Visualizations tab to select from various chart types (e.g., line, column, area) that automatically map the _time field to the x-axis, enabling temporal analysis. This tab is specifically designed for transforming tabular search results into visual formats, making it the appropriate tool for seeing data over time.

Answer

Patterns

Answer

Events

Answer

Statistics

Question 5

Refer to the exhibit. An analyst runs a search that uses this lookup. The lookup returns multiple matches for some events. Which of the following is true?

Accepted Answer

Only the first 5 matching rows are returned.. By default, Splunk's lookup command returns only the first matching row from the lookup table when multiple matches exist for a single event. This behavior is controlled by the `max_matches` parameter, which defaults to 1, but the question states that the first 5 matching rows are returned, indicating that the `max_matches` setting has been explicitly configured to 5. The lookup command does not automatically return all matches or require a sorted lookup file for this behavior.

Answer

The default value 'UNKNOWN' is used when there is no match.

Answer

All matching rows are returned for each event.

Answer

The lookup file must be sorted.

Question 6

Which three of the following are valid approaches for creating a dashboard in Splunk Web? (Choose three.)

Accepted Answer

Convert an existing report into a dashboard panel.. These three options are correct because Splunk Web provides direct, supported methods for creating dashboards. Converting an existing report into a dashboard panel is a standard workflow from the report's 'Edit' menu. The Dashboard Studio editor is the modern, built-in interface for creating dashboards from scratch. Importing a dashboard definition from a saved XML file is supported via the 'Create New Dashboard' dialog, which allows you to upload a dashboard XML definition.

Answer

Generate a dashboard automatically from a search job's statistics tab.

Answer

Use the REST API to create a dashboard from a CSV lookup file.

Answer

Clone a dashboard from the Settings > Knowledge menu.

Question 7

Which THREE of the following are valid ways to narrow search results?

Accepted Answer

Using the time range picker. The time range picker in Splunk restricts the search to events within a specified time window, reducing the dataset before the search executes. This is a fundamental way to narrow results by limiting the scope of indexed data that the search head retrieves from indexers.

Answer

Deleting events

Answer

Changing the source type

Question 8

A company uses Splunk to monitor web server logs. They have a lookup table that maps IP addresses to geographic locations (city, country). The lookup is defined as a CSV file with fields: ip, city, country. The lookup definition is named 'geo'. The team wants to automatically add city and country to every web event at index time, so that all future searches have this enrichment without adding the lookup command. The team tries to set up an automatic lookup in props.conf for the sourcetype 'web_access', but the city and country fields still do not appear in the events. They verify that the lookup file exists and that the lookup definition works when used manually with the lookup command. What is the most likely cause of the automatic lookup not working?

Accepted Answer

The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype. The automatic lookup definition in props.conf must be correctly configured for the intended sourcetype. The most common misconfiguration is specifying the wrong sourcetype or incorrect syntax in the TRANSFORMS directive, which prevents the lookup from being applied at index time. Since the lookup works manually, the issue is with the props.conf configuration, not the lookup file or definition itself.

Answer

Index-time lookups are not supported; enrichment can only be done at search time

Answer

The lookup file must be in KV Store format for index-time lookups

Answer

The lookup must be invoked with the 'lookup' command in the search to populate the fields

Question 9

You are a Splunk administrator for a large e-commerce company. The company ingests approximately 500 GB of web server logs per day into a single index named 'web_logs'. A data model named 'Web_Transactions' has been created to analyze user browsing behavior. The data model has a root event with no constraints, and three child objects: 'Page_Views', 'Searches', and 'Purchases'. Each child object has a constraint based on a key-value pair in the logs: e.g., 'action=view', 'action=search', 'action=purchase'. The data model is accelerated with a 7-day summary, but reports that query specific child objects are taking over 10 minutes to return. The reports use |tstats and filter on common fields like 'user_id' and 'session_id'. The admin suspects the acceleration summary is too large. Which of the following actions will most effectively reduce report latency while maintaining the ability to analyze all three transaction types?

Accepted Answer

Add a constraint to the root event to include only events that match the action field values (view, search, purchase).. Adding a constraint to the root event to filter only events with action=view, action=search, or action=purchase reduces the size of the acceleration summary. The root event currently has no constraints, so the acceleration summary includes all 500 GB of daily web logs, even though only three action types are needed. By constraining the root event, the summary stores only relevant data, making |tstats queries on child objects much faster.

Answer

Use the |datamodel command with the 'search' parameter instead of |tstats.

Answer

Remove the child objects and use only the root event for all reports.

Answer

Increase the acceleration summary time range to 30 days to capture more data in one summary.

Question 10

Which TWO of the following are best practices when designing data models in Splunk?

Accepted Answer

Use fixed field names across datasets to avoid confusion.. Using fixed field names across datasets ensures consistency and predictability when searching and reporting across multiple data sources. This practice simplifies data model design, reduces the need for field aliasing, and prevents confusion when the same logical field (e.g., 'status') is named differently in different sourcetypes. Splunk's data model acceleration and pivot functionality rely on stable field names to function correctly.

Answer

Set acceleration for all data models regardless of usage.

Answer

Use the 'auto-extract' feature to generate fields dynamically.

Answer

Create a separate data model for each sourcetype.

Question 11

An analyst wants to count the number of failed login attempts from a specific user using an accelerated data model named 'Authentication'. The data model has a dataset 'Failed_Authentication'. Which SPL query should they use?

Accepted Answer

| tstats count from datamodel=Authentication.Failed_Authentication where user="jsmith". `tstats` is the only command that can directly query an accelerated data model. It uses the `datamodel=` prefix to specify the data model and dataset, and the `where` clause filters for the specific user. This leverages the acceleration summary for fast results.

Answer

| tstats count from Authentication.Failed_Authentication where user="jsmith"

Answer

| search sourcetype=Authentication* user="jsmith" | stats count

Answer

| datamodel Authentication.Failed_Authentication search | stats count by user | where user="jsmith"

Question 12

A medium-sized company uses Splunk to monitor its e-commerce platform. The platform generates around 10 million events per day from web servers, application logs, and databases. The security team wants to identify the top 10 IP addresses that trigger the most 403 Forbidden errors in the last 24 hours. However, when they run the search: index=ecom sourcetype=web status=403 | top src_ip, the search takes over 5 minutes to complete and sometimes times out. The team needs a faster approach that still accurately identifies the top IPs. The team's Splunk environment uses indexers and a search head. The data is not accelerated. What should the team do to improve search performance?

Accepted Answer

Create a report acceleration summary for the search or implement summary indexing. Report acceleration or summary indexing pre-computes and stores the results of the search, allowing subsequent runs to retrieve the aggregated data almost instantly. Given the environment has indexers and a search head but no acceleration, enabling report acceleration on the search creates a summary that updates periodically, bypassing the need to scan all raw events each time. This directly addresses the timeout issue by reducing the per-search data volume to the pre-built summary.

Answer

Replace 'top' with 'rare' to reduce the amount of data processed

Answer

Use 'stats count by src_ip | sort - count | head 10' instead of top

Answer

Add 'fields src_ip' before top to remove other fields

Question 13

A new Splunk user logs in and sees the Home page. What is the most direct way to start searching data?

Accepted Answer

Click on 'Search & Reporting' in the App bar.. The 'Search & Reporting' app is the primary interface for running searches in Splunk. When a new user logs in, they see the Home page, but the most direct way to start searching is to click on 'Search & Reporting' in the App bar, which opens the search view with the search bar and time range picker ready for input.

Answer

Click on the 'Home' button on the top left.

Answer

Go to 'Settings' and select 'Search'.

Answer

Type a search query directly into the Home page search bar.

Question 14

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Accepted Answer

Add the dashboard to a dashboard group with view permissions. Splunk allows you to add a dashboard to a dashboard group and set the group's permissions to 'read' (view) only. This grants users access to view the dashboard without the ability to edit it, as edit permissions are controlled separately via roles and object-level ACLs.

Answer

Embed the dashboard in an external website

Answer

Clone the dashboard and give the clone to users

Answer

Export the dashboard as a PDF and email it

Question 15

An analyst runs a search and notices that a field `status_code` contains values like '200', '404', '500'. They want to categorize these as 'Success' or 'Error'. Which approach is most efficient?

Accepted Answer

Use eval with case function to map status codes to categories directly in the search.. Using `eval` with `case` is the most efficient approach for a simple, static mapping of status codes to categories directly within the search pipeline. It avoids the overhead of disk I/O and lookup table management, and it executes entirely in memory on the search head or indexer, making it ideal for small, hardcoded mappings.

Answer

Use the csv file as a lookup and inputlookup to filter.

Answer

Create a lookup table with status codes and categories, then use the lookup command.

Answer

Use the rename command to change field values.