SPLK-1001 Practice Test 24 — 15 Questions

Question 1

A new user accidentally closed the search bar while in the Search & Reporting app and can no longer see it. What is the most direct way to restore the search bar?

Accepted Answer

Click on the 'Search & Reporting' app link in the top menu bar.. The search bar is part of the Search & Reporting app interface. Clicking the 'Search & Reporting' app link in the top menu bar reloads the app and restores its default view, including the search bar. This is the most direct method because it reinitializes the app's UI components without requiring a full page refresh or server restart.

Answer

Refresh the browser page.

Answer

Go to Settings > Search bar and re-enable it.

Answer

Restart the Splunk server.

Question 2

Refer to the exhibit. A security analyst runs a search to count failed login attempts by hour. Which hour has the highest number of failed login attempts?

Accepted Answer

14:00. The search counts failed login attempts by hour using a Splunk timechart or stats command with a time-based bucket. The exhibit shows that the hour with the highest count is 14:00, which has the peak value in the results table or chart. This is determined by sorting or visually inspecting the count per hour, where 14:00 exceeds all other hourly totals.

Answer

22:00

Answer

03:00

Answer

09:00

Question 3

A user wants to see a list of all sourcetypes in the index "main". Which search command should be used?

Accepted Answer

| stats count by sourcetype. The `stats count by sourcetype` command groups events by sourcetype and returns a table listing each unique sourcetype along with its event count, effectively showing all sourcetypes present in the index. This is the correct approach because it uses aggregation to enumerate distinct values of the sourcetype field across the entire result set.

Answer

| fields sourcetype

Answer

| data sourcetype

Answer

| top sourcetype

Question 4

A security team needs to track authentication events across multiple sources: Windows Security logs, Linux /var/log/auth.log, and network authentication events. They want to create a single data model covering all authentication events with consistent field names. Which best practice should they follow?

Accepted Answer

Use the same data model with constraints to filter each sourcetype into the correct dataset.. Splunk data models use constraints to route events from different sourcetypes into specific datasets within a single data model. This allows the security team to normalize authentication events from Windows Security logs, Linux auth.log, and network authentication sources into consistent field names (e.g., user, src_ip, action) while preserving the ability to search across all sources. Using a single data model with constraints ensures field name consistency and avoids duplication of effort.

Answer

Define the data model with a single dataset and use the 'tag' command to categorize events.

Answer

Create a data model with multiple root events, one per sourcetype.

Answer

Create separate data models for each source to avoid conflicts.

Question 5

A report uses `| timechart count by action`. The user wants to show only the top 3 actions and combine all others into a single 'Other' column. Which argument should be added?

Accepted Answer

`limit=3 useother=t`. The `timechart` command in Splunk uses the `limit` argument to control the number of distinct series (columns) displayed. Adding `limit=3` restricts the output to the top 3 values by count, and `useother=t` automatically groups all remaining values into a single 'Other' column. Without `useother=t`, the extra values are simply dropped, not aggregated.

Answer

`limit=3`

Answer

`useother=t`

Answer

`other=t`

Question 6

Which two of the following search commands are transforming commands? (Choose two.)

Accepted Answer

chart. The `chart` command is a transforming command because it converts raw event data into a data table (statistical summary) by applying an aggregation function (e.g., count, avg) over a specified field, producing results that can be further visualized or pivoted. This transformation changes the data structure from a list of events to a tabular format with rows and columns.

Answer

search

Answer

eval

Answer

fields

Question 7

Refer to the exhibit. The search returns no results for the 'country' field even though the lookup file exists and contains IP-to-country mappings. Which is the most likely issue?

Accepted Answer

The IP field extracted by rex is in a different format than the lookup key.. The most likely issue is that the IP field extracted by the `rex` command is in a different format than the lookup key (e.g., the lookup expects an integer representation of the IP, or a different subnet notation, or the extracted field contains extra characters like whitespace or quotes). Lookups match based on exact string equality, so any mismatch in format (e.g., '192.168.1.1' vs '192.168.001.001' or '3232235521') will cause zero results, even if the lookup file is correctly configured and contains the mapping.

Answer

The lookup command should be placed before the rex command.

Answer

The country field already exists in the events.

Answer

The lookup file is in the wrong directory.

Question 8

A dashboard panel uses a search that returns time-series data. Which TWO chart options are available in the 'Format' tab of the chart editor to modify the appearance of a line chart? (Choose two.)

Accepted Answer

Connect missing data. The 'Connect missing data' setting in the Format tab of the chart editor allows you to bridge gaps in time-series data by drawing a line across null or missing values. This is useful when your search returns sparse data points and you want a continuous visual line, rather than breaks in the chart.

Answer

Pie area

Answer

Stack mode

Answer

Gauge style

Question 9

A search uses a lookup that returns a field 'priority'. The admin wants to use the lookup only for events where the 'source' is 'firewall'. Which command should be used?

Accepted Answer

source=firewall | lookup priority_lookup source OUTPUT priority. It first filters events with `source=firewall` using a search-time field filter, then applies the `lookup` command only to those events. This ensures the lookup is performed exclusively on firewall events, minimizing resource usage and avoiding unnecessary lookups on other sources.

Answer

| lookup priority_lookup source OUTPUT priority

Answer

| lookup priority_lookup source OUTPUT priority | where source="firewall"

Answer

| lookup priority_lookup source OUTPUT priority WHERE source="firewall"

Question 10

Which TWO of the following commands can be used to view the current fields in a search result?

Accepted Answer

| fields. The `| fields` command is used to keep or remove specific fields from search results, effectively showing you the current fields that exist in the result set. The `| fieldsummary` command produces a statistical summary of all fields present in the search results, including count, distinct count, and other metrics, thereby also allowing you to view the current fields.

Answer

| outputlookup mylookup.csv

Answer

| inputlookup mylookup.csv

Answer

| listfields

Question 11

Refer to the exhibit. What does this search do?

Accepted Answer

Counts events from the Web data model where status is 500, grouped by uri_path.. The search uses `| datamodel Web search` to access the Web data model, then pipes the results into a `stats count by uri_path` command. The `where status=500` filter restricts events to those with a 500 status code. This counts events from the Web data model where status is 500, grouped by the uri_path field, making D correct.

Answer

Counts all web events with status 500.

Answer

Counts all events in the data model named Web.

Answer

Displays raw events from Web data model.

Question 12

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

Accepted Answer

Configure a CSV lookup and use lookup command in search. A CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Answer

Use a time-based lookup to match event time with lookup time

Answer

Set up an external lookup that calls a REST API

Answer

Create a KV Store lookup and update it via REST

Question 13

A security analyst needs to create a report that shows the count of failed login attempts by user over the last 24 hours, updated every hour. The report should be accessible to the SOC team but not to other users. Which sequence of steps should the analyst follow?

Accepted Answer

Run the search, click 'Save As' -> 'Report', set permissions to 'Shared in App' with SOC role, then 'Schedule' hourly.. Saving the search as a report, setting permissions to 'Shared in App' with the SOC role, and scheduling it hourly ensures the report is updated regularly and accessible only to the SOC team. Option A is wrong because emailing the report via alert action does not provide on-demand access and is not a report. Option C is wrong because saving as a dashboard panel does not create a scheduled report; dashboards display panels but are not scheduled individually. Option D is wrong because saving as an alert with private permissions and hourly schedule creates an alert, not a report; alerts are for triggering actions based on conditions, not for persistent access.

Answer

Run the search, click 'Save As' -> 'Report', set schedule to hourly, then create an alert action to email the report to the SOC team.

Answer

Run the search, click 'Save As' -> 'Dashboard Panel', add to a SOC dashboard, then schedule the dashboard.

Answer

Run the search, click 'Save As' -> 'Alert', set permissions to private, then schedule the alert to trigger hourly.

Question 14

This is a props.conf configuration snippet. What does it configure?

Accepted Answer

Global default values for host, index, and sourcetype.. The `[default]` stanza in props.conf sets global default values for host, index, and sourcetype that apply to all data inputs unless overridden by a more specific stanza. This stanza is processed first and provides fallback values for any event that does not match a source, sourcetype, or host-specific configuration.

Answer

Settings for the host server1.

Answer

Settings for the syslog sourcetype.

Answer

Default values for all inputs.

Question 15

Refer to the exhibit. The pie chart shows only 10 slices, but the base search stats returns all destinations. What is the reason?

Accepted Answer

The post-process search includes | top limit=10 dest. The base search returns all destinations, but the pie chart shows only 10 slices because the post-process search uses the `| top limit=10 dest` command. The `top` command limits the results to the top 10 values of the `dest` field by count, and this post-process search is applied after the base search, so only those 10 slices are displayed in the pie chart.

Answer

The eval command changes the dest field

Answer

The base search time range is too small

Answer

The charting option 'chart' is set to 'pie'