SPLK-1001 Practice Test 22 — 15 Questions

Question 1

An analyst creates a dashboard with a single-value panel that shows the total number of blocked intrusions in the last hour. The panel currently displays a raw number such as 47. The analyst wants the panel to show a green background when the count is below 10, yellow when between 10 and 50, and red when above 50, so operators can see status at a glance. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the single-value panel's visualization editor, open the Color settings and define threshold ranges with corresponding colors for the value field.. Single-value visualizations support threshold-based coloring through the Color settings in the visualization editor. By defining boundaries at 10 and 50 and assigning green, yellow, and red to the resulting ranges, the panel background updates automatically as the underlying count changes. No search modification is needed, and the panel remains a single-value display.

Answer

Create three separate single-value panels, one for each range, and use a dashboard input to show only the panel matching the current count.

Answer

Convert the panel to a gauge visualization and set the gauge's color ranges to green, yellow, and red with the same numeric boundaries.

Answer

Add a 'where' clause to the search that filters results into three ranges and use the 'eval' command to assign a color name to each range.

Question 2

A Splunk user is creating a dashboard to monitor web server performance. They want to display the average response time over time as a line chart. Which search command should they use to generate the data for this visualization?

Accepted Answer

timechart avg(response_time). The timechart command is purpose-built for creating time-series data, which is ideal for line charts. It automatically buckets events into time intervals and calculates statistics like average. The chart command with 'over time' is invalid syntax, stats by _time does not bucket time, and eventstats does not summarize data. Therefore, timechart avg(response_time) is the correct search to generate the data for a line chart showing average response time over time.

Answer

stats avg(response_time) by _time

Answer

eventstats avg(response_time)

Answer

chart avg(response_time) over time

Question 3

A Splunk administrator needs to view the list of fields that are defined in a lookup table named 'assets' without running a search against indexed events. Which command should the administrator use?

Accepted Answer

inputlookup assets. The inputlookup command reads a lookup table and returns its rows as search results, which lets the administrator inspect the columns and values defined in the assets lookup without querying indexed events. The lookup command enriches events, while outputlookup writes data into a lookup, so neither serves the inspection purpose.

Answer

outputlookup assets

Answer

fieldsummary assets

Answer

lookup assets

Question 4

A support team wants a dashboard panel that displays the geographic distribution of incoming requests on a world map, using a field named clientip that contains public IP addresses. Which visualization should the analyst select for that panel?

Accepted Answer

Choropleth map. A choropleth map is the visualization built for geographic distribution, and Splunk can resolve IP address fields to locations automatically. Selecting it with clientip produces a world map shaded by request volume per region. Single value, pie chart, and scatter plot each serve different analytical purposes and lack the spatial mapping capability required to show where requests originate.

Answer

Scatter plot

Answer

Single value

Answer

Pie chart

Question 5

A Splunk user runs a search and notices that a field named `status_code` is not being extracted automatically from the raw event data. The user wants to create a permanent field extraction that applies to a specific sourcetype and host. Which method should the user use?

Accepted Answer

Create a field extraction using the Settings > Fields > Field extractions menu.. Permanent field extractions are created through the Settings menu, specifically under Fields > Field extractions. This allows the user to define a regular expression or delimiter-based extraction and apply it to a specific sourcetype and host. Search-time commands like `rex` or `extract` are temporary and do not persist. The Fields sidebar is for interactive extraction but is not the standard way to create scoped, permanent extractions.

Answer

Use the `extract` command with the `kv` argument.

Answer

Use the `rex` command in the search to extract the field.

Answer

Create a field extraction using the Fields sidebar in the Search app.

Question 6

A Splunk user runs a search and notices that the 'status' field is not being extracted from the raw event data. The user wants to manually extract this field using a regular expression and ensure it is available for subsequent commands in the search pipeline. Which command should the user employ?

Accepted Answer

rex. The rex command is designed to extract fields from raw event data using regular expressions. It creates new fields that are immediately available for subsequent commands in the search. This is the correct tool for manually parsing a field like 'status' when automatic extraction has not occurred.

Answer

fieldformat

Answer

extract

Answer

eval

Question 7

A compliance officer needs a dashboard panel that lists the 20 most recent policy violations with columns for timestamp, user, and policy name. The officer wants to be able to click a column header to sort the results interactively and to export the visible rows to CSV. Which visualization type should be used for this panel?

Accepted Answer

A table visualization that includes the timestamp, user, and policy name fields in the search results.. A table visualization is designed for row-level results and supports interactive column sorting and CSV export of the displayed data. By including timestamp, user, and policy name in the search and limiting results to the 20 most recent, the panel meets the compliance officer's requirements for a sortable, exportable list.

Answer

A column chart with the timestamp on the x-axis and the violation count on the y-axis.

Answer

A single-value panel that shows the total number of policy violations in the selected time range.

Answer

A pie chart that breaks down violations by policy name across the selected time range.

Question 8

A dashboard developer needs to add a panel that displays a choropleth map showing the number of events per country. The search returns a field named "country" and a count field named "count." Which visualization type should be selected for this panel?

Accepted Answer

Choropleth Map. The choropleth map visualization is specifically designed to display data values across geographic regions by shading them. It requires a geographic field like country and a numerical field like count. This matches the scenario exactly. Other visualization types like cluster maps, pie charts, or single values do not provide the regional shading needed to show event counts per country on a map.

Answer

Single Value

Answer

Cluster Map

Answer

Pie Chart

Question 9

A security team wants a dashboard panel that shows the total number of blocked connections as a single large number, turning red when the count exceeds 500 and green otherwise. Which configuration achieves this in a classic dashboard?

Accepted Answer

Add a single value visualization and configure color thresholds based on the count value. A single value visualization renders one large number and supports threshold-based color ranges, so configuring a threshold at 500 makes the panel turn red above that value and green at or below it. The coloring updates automatically as results change. Table cell formatting is static, a gauge shows a dial rather than a number, and a line chart with a reference line shows trends without conditional recoloring.

Answer

Add a line chart and enable a reference line at the value 500

Answer

Add a table panel and manually format the count cell's background color to red

Answer

Add a gauge visualization and set the needle to point at the count value

Question 10

A network engineer is analyzing firewall logs and wants to see the number of events per hour for the last 24 hours, broken down by 'action' (allowed or denied). The engineer runs: index=firewall | timechart span=1h count by action. The results show a table with time buckets and columns for allowed and denied counts. However, the engineer notices that some time buckets have no data for one of the actions, resulting in null values. The engineer wants to replace those null values with zero. Which command should be added to the search?

Accepted Answer

| fillnull value=0. The fillnull command is designed to replace null values in search results with a specified value. After a timechart, null values appear in time buckets where no events occurred for a particular series. Using fillnull value=0 ensures that every time bucket has a numeric value for each action, making the time series complete and easier to visualize.

Answer

| delta count as change

Answer

| replace null with 0

Answer

| eval action=coalesce(action, 0)

Question 11

A Splunk admin configured a CSV-based lookup to map device IP addresses to location data. The lookup 'devices.csv' has columns 'ip', 'building', 'floor'. In props.conf, they set: `LOOKUP-1 = devices ip OUTPUT building floor`. In transforms.conf: `[devices] filename = devices.csv`. The search over sourcetype 'network_logs' returns events with the 'ip' field, but 'building' and 'floor' are missing. The admin confirms the CSV file exists and has data. What is the most likely issue?

Accepted Answer

The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.. The `LOOKUP-1` definition in `props.conf` incorrectly includes the match and output fields. The correct syntax is `LOOKUP-1 = devices` only, with the match field (`ip`) and output fields (`building`, `floor`) defined in the `transforms.conf` stanza under `[devices]` using `external_type = csv`, `filename = devices.csv`, `match_type = WILDCARD(ip)`, and `default_match = NONE`. The admin's syntax causes Splunk to ignore the lookup configuration entirely, so no fields are added.

Answer

The CSV file is too large and the lookup is not being loaded.

Answer

The 'ip' field is not properly extracted from the sourcetype.

Answer

The lookup file is not accessible from the search head because it is stored on a different host.

Question 12

A user wants to create a dashboard panel that shows a single number representing the total number of errors in the last 24 hours. Which visualization type should be used?

Accepted Answer

Single value. A Single Value visualization is designed to display a single numeric metric prominently, making it the ideal choice for showing the total number of errors in the last 24 hours. It directly answers the user's requirement for a single number without any additional chart elements or time-series context.

Answer

Pie chart

Answer

Bar chart

Answer

Line chart

Question 13

An analyst has a dashboard panel whose base search returns events for all departments. The analyst wants dashboard users to filter every panel by selecting a department from a dropdown, without editing each panel's search. What should the analyst configure?

Accepted Answer

A dropdown input whose token is referenced by each panel's search using $token$ syntax.. Dropdown inputs generate tokens from a field's values, and panels referencing that token with $token$ syntax apply the selection as a filter. This gives a single control that dynamically narrows all dependent panels to the chosen department without rewriting each panel's base search.

Answer

A text input that appends the department name as a free-text keyword to every panel.

Answer

A time range picker input that sets the dashboard's global time window.

Answer

A checkbox input that toggles the visibility of panels based on department.

Question 14

A security analyst opens Splunk Web and wants to quickly switch from the Search & Reporting app to the Dashboards app without leaving the current browser tab. Which interface element should the analyst use?

Accepted Answer

The Apps menu in the top navigation bar. Splunk Web exposes installed apps through the Apps menu in the top navigation bar. Choosing an app there loads its default view in the current tab, which matches the analyst's goal of switching to Dashboards quickly. Settings, the search bar, and the Job menu serve configuration, querying, and job management respectively, not app switching.

Answer

The Job menu in the Search & Reporting app

Answer

The Search bar at the top of the Search & Reporting app

Answer

The Settings menu under the user name drop-down

Question 15

A Splunk user needs to enrich events with department information from a CSV lookup file. The events contain a field 'employee_id', and the lookup file 'employees.csv' has columns 'employee_id' and 'department'. Which search command correctly adds the 'department' field to the events?

Accepted Answer

| lookup employees.csv employee_id OUTPUT department. The lookup command is designed to add fields from an external lookup table to events based on a matching field. The syntax specifies the lookup file, the field to match on, and the fields to output. This enriches each event with the department information without requiring a subsearch or complex join.

Answer

| inputlookup employees.csv employee_id OUTPUT department

Answer

| join employee_id [| inputlookup employees.csv]

Answer

| eval department = lookup(employees.csv, employee_id, department)