SPLK-1001 Practice Test 25 — 15 Questions

Question 1

A security team wants to add a panel to an existing dashboard that will display the top five source IP addresses by event count for the last 24 hours. The team wants the panel to be reusable across multiple dashboards and to be editable later without rebuilding the panel from scratch. Which two actions should be taken to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Save the search as a report so it can be referenced by panels in multiple dashboards.. Reusability and centralized editing are achieved by saving the search as a report and then adding that report as a panel to each dashboard. The report holds the SPL and visualization defaults, so changes propagate to all panels that reference it. Inline searches and non-panel objects such as alerts or PDF exports do not provide this shared, editable behavior.

Answer

Create the panel as a scheduled alert and add the alert's trigger conditions to the other dashboards.

Answer

Add the panel by selecting 'New Panel' and pasting the SPL directly into the panel's inline search, then save the dashboard.

Answer

Export the dashboard as a PDF and distribute it to the other dashboards' owners so they can import the panel.

Question 2

A Splunk administrator needs to display the 10 most recent authentication failures from the past 24 hours, sorted from newest to oldest. Which SPL search accomplishes this?

Accepted Answer

index=security sourcetype=auth action=failure earliest=-24h | sort -_time | head 10. The correct search must filter events, sort them in descending time order, and then limit to 10. Sorting must occur before limiting to ensure the most recent events are selected. Using head after sort -_time achieves this. The other options either limit before sorting, use a transforming command that does not return raw events, or sort in the wrong direction.

Answer

index=security sourcetype=auth action=failure earliest=-24h | sort _time | tail 10

Answer

index=security sourcetype=auth action=failure earliest=-24h | head 10 | sort -_time

Answer

index=security sourcetype=auth action=failure earliest=-24h | top 10 action

Question 3

A capacity planner needs a dashboard panel that shows the maximum CPU utilization observed for each host over the last 24 hours, with hosts ranked from highest to lowest. Which search should the planner use to produce data suitable for that visualization?

Accepted Answer

index=os sourcetype=cpu | stats max(cpu_pct) as peak by host | sort - peak. The stats command with max(cpu_pct) by host collapses each host's events into a single peak value, and sort - peak ranks those values descending. This produces one row per host, the correct data shape for comparing and ranking hosts by their highest observed CPU utilization.

Answer

index=os sourcetype=cpu | top limit=10 cpu_pct by host

Answer

index=os sourcetype=cpu | stats avg(cpu_pct) as peak by host | sort - peak

Answer

index=os sourcetype=cpu | timechart span=1h max(cpu_pct) by host

Question 4

A Splunk administrator is configuring a lookup definition for a CSV file that contains a column named user_id with values like 'jsmith' and 'MJONES'. The events to be enriched also contain a field named user_id, but the values are stored in lowercase, such as 'jsmith' and 'mjones'. The administrator wants the lookup to match regardless of case. Which setting should the administrator configure on the lookup definition?

Accepted Answer

Disable case sensitive matching. Case sensitivity in lookup matching is controlled by a setting on the lookup definition. Disabling case sensitive matching makes Splunk treat 'MJONES' and 'mjones' as equivalent when performing the lookup, which resolves the mismatch between the mixed-case lookup file and the lowercase event values. Wildcard matching, delimiter changes, and enabling case sensitivity do not address the core issue of case differences.

Answer

Change the lookup file delimiter to comma

Answer

Set the lookup to use wildcard matching

Answer

Enable case sensitive matching

Question 5

A Splunk user is working with a lookup definition named 'employee_lookup' that maps employee IDs to department and manager names. The user wants to ensure that events containing an employee_id field are enriched with the department and manager fields from the lookup. Which two actions are required to make this enrichment work? (Choose two.)

Accepted Answer

The lookup command must reference the employee_lookup definition and specify the employee_id field to match on.. To enrich events with lookup data, the lookup definition must exist and be accessible, and the search must include a lookup command that references that definition and the matching field. Custom regex extraction and KV Store conversion are optional depending on the environment, and admin privileges are not necessary. These two actions form the minimum requirements for the lookup to function in a search.

Answer

The user must have the admin role to run lookups against employee_lookup.

Answer

The lookup file must be converted to a KV Store collection before it can be used in a search.

Answer

The employee_id field must be extracted from the raw events using a regex before the lookup can work.

Question 6

A Splunk user runs a search that returns events with a field `status`. They want to create a table showing only the top 5 most common status values and their counts, sorted from highest to lowest count. Which SPL search accomplishes this?

Accepted Answer

index=web | top limit=5 status. The top command is purpose-built to display the most common values of a field with their counts and percentages, and the limit argument restricts the number of results. While stats with sort and head can produce a similar table, top is the direct and correct choice for this scenario.

Answer

index=web | stats count by status | sort count | head 5

Answer

index=web | stats count by status | sort - count | head 5

Answer

index=web | rare limit=5 status

Question 7

A security analyst runs a search that returns events from a web proxy sourcetype. The analyst needs to add the department name from a CSV lookup named 'departments.csv' to each event, matching on a field called 'src_user'. The lookup contains the columns 'src_user' and 'department'. Which search syntax will correctly enrich the events with the department field?

Accepted Answer

sourcetype=web_proxy | lookup departments.csv src_user OUTPUT department. The lookup command with a filename and a match field followed by OUTPUT is the standard method for enriching events with fields from a CSV lookup. It matches the event field 'src_user' to the lookup's 'src_user' column and appends only the specified 'department' field. This approach preserves the original events and adds the needed data efficiently.

Answer

sourcetype=web_proxy | join src_user [| lookup departments.csv]

Answer

sourcetype=web_proxy | inputlookup departments.csv src_user OUTPUT department

Answer

sourcetype=web_proxy | lookup departments.csv OUTPUT src_user, department

Question 8

A Splunk user runs a search that returns events with a field named action containing values such as 'allow', 'deny', 'drop', and 'reject'. The user wants to create a new field called severity that assigns the value 'high' to 'deny' and 'drop', and 'low' to 'allow' and 'reject'. Which SPL command accomplishes this?

Accepted Answer

eval severity=case(action=="deny" OR action=="drop", "high", action=="allow" OR action=="reject", "low"). The case function evaluates multiple condition-value pairs in order and returns the value for the first matching condition. By testing deny and drop first for high and then allow and reject for low, the eval command creates a severity field with the correct mapping. Using if would not restrict low to only the intended values, and replace would overwrite the original field.

Answer

eval severity=if(action=="deny" OR action=="drop", "high", "low")

Answer

eval severity=case(action=="deny" OR action=="drop", "high")

Answer

replace action WITH severity IN action

Question 9

A Splunk administrator needs to identify the three slowest-performing web transactions from the past hour. The transactions are logged in the 'web_logs' index with a numeric field named 'response_time_ms'. The administrator runs the search 'index=web_logs earliest=-1h | top response_time_ms limit=3' but the results show incorrect counts instead of the transactions with the highest response times. Which search should the administrator use instead?

Accepted Answer

index=web_logs earliest=-1h | sort - response_time_ms | head 3. To find the slowest individual transactions, you must sort events by the numeric response time in descending order and then limit to the top three. The sort command orders events, and head returns the first N. Using top or rare would count field values instead of ranking events, which does not satisfy the requirement.

Answer

index=web_logs earliest=-1h | rare response_time_ms limit=3

Answer

index=web_logs earliest=-1h | top limit=3 response_time_ms

Answer

index=web_logs earliest=-1h | stats max(response_time_ms) as max_time by transaction_id | sort - max_time | head 3

Question 10

A network engineer needs to identify the five hosts that generated the most firewall deny events in the last 24 hours. The raw events contain a field named src_ip. Which search returns exactly those five hosts and their event counts?

Accepted Answer

index=firewall action=denied earliest=-24h | top limit=5 src_ip. The top command is specifically designed to surface the most frequent values of a field and includes an optional limit argument that caps the number of results. Supplying limit=5 src_ip returns the five hosts with the highest deny-event counts along with count and percent columns, directly answering the requirement without extra sorting or filtering commands.

Answer

index=firewall action=denied earliest=-24h | stats count by src_ip | head 5

Answer

index=firewall action=denied earliest=-24h | table src_ip | dedup 5 src_ip

Answer

index=firewall action=denied earliest=-24h | rare limit=5 src_ip

Question 11

A Splunk administrator needs to identify the total license volume consumed by each index over the last 24 hours. The administrator runs a search that reports the sum of raw event bytes grouped by index. Which SPL command must be used to calculate the sum of bytes for each index?

Accepted Answer

stats sum(bytes) AS total_bytes BY index. The stats command is the correct choice because it performs aggregations such as sum() and can group results by a field like index. This produces one row per index with the total bytes, which directly answers the license volume question. Other commands either add fields to events or return frequency counts, not sums.

Answer

eventstats sum(bytes) AS total_bytes BY index

Answer

top bytes BY index

Answer

transaction bytes BY index

Question 12

A Splunk administrator is building a knowledge object strategy for an environment where several sourcetypes share common field names but with different meanings. The administrator needs to create field aliases so that searches can use consistent, friendly field names. Which two statements about field aliases are accurate? (Choose two.)

Accepted Answer

A field alias is applied at search time and does not change the original field name in the event data.. Field aliases are search-time knowledge objects scoped to a host, source, or sourcetype, and they present an existing field under an alternate name without modifying indexed data. The original field remains fully accessible, and aliases cannot chain to other aliases. These properties let administrators normalize field names across sourcetypes while preserving backward compatibility with existing searches.

Answer

A field alias can reference another field alias, allowing chained aliasing across multiple sourcetypes.

Answer

A field alias automatically renames the original field in all searches, removing access to the original field name.

Answer

A field alias creates a new field that is stored separately and persists in the index for future searches.

Question 13

A Splunk administrator needs to create a field alias so that a field named 'src_ip' can also be referenced as 'client_ip' in searches. The administrator wants the alias to apply to all sourcetypes. Which configuration file should the administrator edit to define the field alias?

Accepted Answer

props.conf. Field aliases are defined in props.conf using the FIELDALIAS-<class> setting. This allows a field to be referenced by an alternate name in searches without modifying the original field. To apply the alias to all sourcetypes, the administrator can use a global stanza or specify the alias in the default stanza. The other configuration files serve different purposes and do not handle field aliases.

Answer

fields.conf

Answer

outputs.conf

Answer

transforms.conf

Question 14

A NOC analyst builds a dashboard panel that uses a timechart to show average CPU utilization per host over the last 24 hours. The panel currently displays the default line chart with all hosts overlapping, making it hard to spot a single outlier. The analyst wants to switch the panel to an area chart with stacked series and a logarithmic y-axis so that both small and large values are visible. Where should these changes be made?

Accepted Answer

Open the panel's visualization editor, select the Area Chart type, enable Stacked Series, and set the y-axis scale to Logarithmic.. Visualization formatting in Splunk dashboards is handled by the visualization editor associated with each panel. Selecting the Area Chart type, enabling Stacked Series, and setting the y-axis scale to Logarithmic changes the rendering of the existing timechart results without modifying the search. This keeps the SPL intact and applies the requested presentation changes.

Answer

Change the search to use 'chart' instead of 'timechart' and then select the Area Chart visualization from the Format menu.

Answer

Modify the dashboard's source XML to change the chart type to area and add a 'logScale' attribute to the panel element.

Answer

Edit the panel's search to add the commands 'stacked=true' and 'log=true' at the end of the SPL.

Question 15

A Splunk user wants to create a dashboard that displays a table of the top 10 source IP addresses by event count, and allow other users to click on an IP address to run a search that shows all events from that IP in a new tab. Which dashboard feature should be used to enable this interaction?

Accepted Answer

Token and drilldown. To enable clicking on a table row to run a search based on the clicked value, you need to configure a drilldown on the table panel. The drilldown can set a token to the clicked IP address and then use that token in a search that opens in a new tab. This is achieved through the dashboard's drilldown settings and token usage. Other options like scheduled searches, post-process searches, or form inputs do not provide this specific click-to-search behavior.

Answer

Scheduled search and alert

Answer

Form input with dropdown

Answer

Post-process search