SPLK-1001 Practice Test 24 — 15 Questions

Question 1

An analyst runs a search that returns events with a field 'response_time' in milliseconds. The analyst wants to calculate the average response time for each 'host' and then sort the results in descending order of average response time. Which search should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=web | stats avg(response_time) as avg_rt by host | sort - avg_rt. To calculate the average response time per host and sort descending, the stats command with avg(response_time) by host creates the summary, and sort - avg_rt sorts the average values in descending order. Using eventstats would not summarize to one row per host, and sorting by response_time after stats is invalid because that field is replaced by the aggregate. The correct approach uses stats and sorts on the renamed field.

Answer

index=web | stats avg(response_time) as avg_rt by host | sort -response_time

Answer

index=web | stats avg(response_time) as avg_rt by host | sort avg_rt

Answer

index=web | eventstats avg(response_time) as avg_rt by host | sort - avg_rt

Question 2

A network operations analyst wants to view the number of firewall deny events per hour for the last seven days, showing a single series over time rather than a table of individual events. Which search produces this time-based summary?

Accepted Answer

index=firewall action=denied earliest=-7d | timechart span=1h count. A time-based summary across a fixed interval is best produced by a transforming command that buckets by _time. Using timechart with span=1h collapses the seven days of deny events into one row per hour and one column for the event count, giving a single series that can be charted directly as an hourly trend.

Answer

index=firewall action=denied earliest=-7d | eventstats count

Answer

index=firewall action=denied earliest=-7d | chart count by action

Answer

index=firewall action=denied earliest=-7d | stats count by _time

Question 3

A Splunk administrator is configuring a knowledge object so that a field named 'clientip' in incoming events is automatically displayed as 'src' in searches without changing the raw event data or reindexing. The administrator wants the alias to apply to all events containing the clientip field. Which configuration should the administrator create?

Accepted Answer

A field alias that maps clientip to src. Field aliases are search-time knowledge objects that let one field name be used in place of another without altering raw events or requiring reindexing. Mapping clientip to src means that whenever clientip exists, searches can reference src and get the same value. Calculated fields and lookups serve different purposes, and reversing the alias direction would not make clientip appear as src.

Answer

A calculated field named clientip that returns src

Answer

A lookup definition named clientip that maps to src

Answer

A field alias that maps src to clientip

Question 4

A Splunk administrator needs to create a dashboard that displays a single value representing the total number of events ingested in the last 24 hours, with a trend indicator showing whether the volume is increasing or decreasing compared to the previous 24-hour period. Which visualization type should be used for this panel?

Accepted Answer

Single Value. The Single Value visualization is the only option that displays a single numeric result and can include a trend indicator by comparing to a previous time range. The administrator can configure the trend interval to show whether the current 24-hour count is higher or lower than the previous 24 hours. Gauge, Line Chart, and Column Chart do not provide this specific combination of features.

Answer

Gauge

Answer

Column Chart

Answer

Line Chart

Question 5

A Splunk user runs a search that returns events with a field named 'src_ip'. They want to create a new field called 'attacker_ip' that always contains the same value as 'src_ip' without modifying the original field. Which of the following should they use?

Accepted Answer

A field alias created via Settings > Fields > Field aliases. A field alias is the correct mechanism to provide an alternate name for an existing field. It is configured in Settings and applies globally to the user or app context. The original field remains available, and the alias can be used interchangeably in searches, reports, and dashboards. This satisfies the requirement of creating a new field name without modifying the source field.

Answer

The rename command in the search pipeline

Answer

The eval command with the expression attacker_ip=src_ip

Answer

A calculated field created via Settings > Fields > Calculated fields

Question 6

A SOC manager wants a single dashboard panel that shows today's count of events by sourcetype as a horizontal bar chart, with the largest count at the top. The manager also wants the panel to automatically refresh every five minutes so the team can monitor live activity. Which approach should be used when building this panel in Splunk Web?

Accepted Answer

Save the search as a report, then add the report to a new dashboard and configure the panel's visualization as a bar chart with a five-minute refresh interval.. A dashboard panel is built from a saved search or an inline search, and its visualization type, sort order, and refresh interval are configured in the dashboard editor. Saving the search as a report and adding it as a panel lets the manager set the bar chart orientation, sort by count descending, and enable a five-minute auto-refresh, meeting every stated requirement.

Answer

Create a new alert that runs the search every five minutes and sends the results to the dashboard's email notification list.

Answer

Use the Search & Reporting app's Statistics tab and rely on the browser's auto-reload extension to refresh the chart every five minutes.

Answer

Schedule the search as a report and configure a dashboard input that re-runs the search when a user clicks a Submit button.

Question 7

A compliance officer asks for a report of the total count of events per sourcetype, but only for sourcetypes that have more than 1000 events. Which search returns this?

Accepted Answer

index=main | stats count by sourcetype | where count > 1000. Aggregation must occur before filtering on the aggregated value. The stats command creates the count field per sourcetype, and the where command then filters rows where count exceeds 1000. Placing where before stats fails because count does not exist yet, and using search or top does not correctly filter or fully aggregate the data.

Answer

index=main | top sourcetype | where count > 1000

Answer

index=main | stats count by sourcetype | search count > 1000

Answer

index=main | where count > 1000 | stats count by sourcetype

Question 8

A Splunk user runs a search in the Search & Reporting app and wants to save the current set of results as a report that can be scheduled and shared with the team. The user also wants the report to use the same time range as the current search. Which action should the user take?

Accepted Answer

Select Save As > Report and configure the time range in the save dialog. The Save As > Report workflow stores the search, time range, and permissions as a report that can be scheduled and shared. Dashboard panels and alerts are different artifact types with different purposes, and exporting to CSV creates a static file rather than a reusable report definition. Only the report save path satisfies both scheduling and sharing requirements.

Answer

Select Save As > Alert and set a trigger condition

Answer

Select Save As > Dashboard Panel and add it to a new dashboard

Answer

Select Export > Export Results to CSV and email the file

Question 9

A Splunk user runs a search that returns events from several indexes. The user wants to save the current search so it can be rerun later with the same search string and time range, and wants it available from the Searches, reports, and alerts page. What should the user do?

Accepted Answer

Click Save As and choose Report. Saving a search as a report preserves the search string and time range and lists it under Searches, reports, and alerts, where it can be rerun later. Exporting creates a one-time file download, saving as a dashboard panel changes the artifact type, and sharing controls permissions rather than persistence. The report option is the only one that meets the stated need to store and rerun the search.

Answer

Click Export and choose CSV

Answer

Click Share and choose Permissions

Answer

Click Save As and choose Dashboard Panel

Question 10

A Splunk user needs to create a lookup definition to enrich events with user details from a CSV file. Which two of the following are required steps to make the lookup available for use with the lookup command? (Choose two.)

Accepted Answer

Upload the CSV file to Splunk via Settings > Lookups > Lookup table files.. To use a CSV lookup, you must first upload the file to Splunk and then create a lookup definition that references it. The definition specifies the file and the fields to match, making the lookup available for the lookup command. Field aliases, sharing settings, and calculated fields are not prerequisites for basic lookup functionality.

Answer

Enable the lookup for the specific app and share it globally.

Answer

Create a field alias for the fields in the CSV file.

Answer

Define a calculated field that uses the lookup function.

Question 11

An analyst needs to calculate the average response time for each HTTP status code, but only for status codes that have at least 100 events. The field 'response_time' is numeric and 'status' is a string. Which SPL search accomplishes this?

Accepted Answer

index=web | stats avg(response_time) as avg_rt count by status | where count >= 100. To calculate the average response time per status code and filter by the number of events, you must include count in the stats command and then use where to filter on count. The stats command must generate both avg(response_time) and count, grouped by status. Placing where after stats allows filtering on the aggregated count field. Filtering on avg_rt or placing where before stats does not meet the requirement.

Answer

index=web | where count >= 100 | stats avg(response_time) as avg_rt by status

Answer

index=web | stats avg(response_time) as avg_rt by status | search count >= 100

Answer

index=web | stats avg(response_time) as avg_rt by status | where avg_rt >= 100

Question 12

A Splunk user needs to create a field alias that maps a field named `clientip` to a new name `src_ip` for a specific sourcetype. They want the alias to be available in all future searches without modifying the search string. Where should they configure this?

Accepted Answer

In the search app's `props.conf` under the `[sourcetype]` stanza using the `FIELDALIAS` setting.. Field aliases are created in `props.conf` within a sourcetype stanza using the `FIELDALIAS` setting. This configuration maps an existing field to a new name at search time, making the alias available globally for that sourcetype without altering searches. Other methods like `eval` are temporary, and `transforms.conf` or `fields.conf` are not used for this purpose. The `FIELDALIAS` setting is the correct and persistent solution.

Answer

In the search bar by adding `| eval src_ip = clientip` at the end of each search.

Answer

In the `fields.conf` file by listing the field as an alias.

Answer

In the `transforms.conf` file using the `REGEX` attribute to rename the field.

Question 13

An analyst wants to organize web events into 10-minute buckets and count them by status code, with each status code shown as its own column across the time buckets. Which search produces that layout directly?

Accepted Answer

index=web | timechart span=10m count by status. A time-series matrix with a column per status code is exactly what timechart produces. Setting span=10m creates the 10-minute buckets and the by status clause splits each bucket into separate status columns. Alternatives using stats or chart either return long-format rows or reverse the axes, and none combine correct time bucketing with the wide per-status column layout.

Answer

index=web | chart count over status by _time

Answer

index=web | stats count by status, date_minute

Answer

index=web | bin _time span=10m | stats count by _time, status

Question 14

A security analyst runs a search that returns events with a field named src_ip. The analyst wants to add a new field called attacker_ip that contains exactly the same value as src_ip, without removing or renaming src_ip, so that existing dashboards using src_ip continue to work. Which SPL command should the analyst use to accomplish this?

Accepted Answer

eval attacker_ip=src_ip. To add a new field that mirrors an existing field without removing the original, eval is the correct tool because it computes and assigns field values per event. Rename would replace the original field, fields only selects fields, and lookup requires an external table. Using eval preserves src_ip for existing dashboards while making attacker_ip available for new searches.

Answer

lookup src_ip AS attacker_ip

Answer

fields src_ip attacker_ip

Answer

rename src_ip AS attacker_ip

Question 15

A Splunk user has a CSV lookup file named 'employees.csv' with columns 'emp_id', 'full_name', and 'department'. The user wants to enrich events that contain an 'emp_id' field by adding the matching 'full_name' and 'department' values to each event. The lookup file is already uploaded and defined. Which SPL command should the user add to the search?

Accepted Answer

lookup employees emp_id. The lookup command enriches events by matching a field in the events against a lookup definition and appending the corresponding fields from the lookup table. It requires the lookup definition name, not the raw CSV file name. inputlookup retrieves lookup contents as results, and outputlookup writes results to a lookup, so neither performs event enrichment.

Answer

inputlookup employees emp_id

Answer

outputlookup employees emp_id

Answer

lookup employees.csv emp_id