SPLK-1001 Practice Test 2 — 25 Questions

Question 1

An analyst wants to compute the average response time for each server from web server logs. The field `response_time` is a string like '120ms'. What is the correct way to convert and compute?

Accepted Answer

eval response_num=replace(response_time, "ms", "") | eval response_num=response_num*1 | stats avg(response_num) by server. It first uses `replace` to strip the 'ms' suffix from the string field `response_time`, then multiplies the resulting string by 1 (`response_num*1`) to coerce it into a numeric type. Only after conversion can `stats avg(response_num) by server` compute a meaningful average. Without the numeric coercion, Splunk would treat the field as a string and either fail or produce incorrect results.

Answer

eval response_time=response_time + "0" | stats avg(response_time) by server

Answer

eval response_num=replace(response_time, "ms", "") | stats avg(response_num) by server

Answer

eval avg_response=avg(response_time)

Question 2

Refer to the exhibit. An analyst wants to see the top 10 most visited URI paths, but the result also includes a 'percent' column. To remove the percent column, which command should be added?

Accepted Answer

| fields - percent. The `fields` command with a minus sign removes specified fields from the results. Since the question asks to remove the 'percent' column, `| fields - percent` is the correct and most direct way to drop that field while keeping all other fields intact.

Answer

| table uri_path count

Answer

| eval percent=null()

Answer

| rename percent as ""

Question 3

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

Accepted Answer

Rewrite the search as `index=main error | stats count by host`.. The original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Answer

Use the `transaction` command to group related events before counting.

Answer

Replace `stats count by host` with `top limit=5 host` to limit output.

Answer

Add a `summarize` command before `stats` to pre-aggregate data.

Question 4

Which THREE of the following are valid methods to access the Search & Reporting app in Splunk Web?

Accepted Answer

Click the 'Search' button on the Splunk Home page.. The Splunk Home page includes a prominent 'Search' button that directly opens the Search & Reporting app. This is the most common method for users to start searching data in Splunk Web.

Answer

Click the Splunk logo and select 'Search & Reporting' from the context menu.

Answer

Use the keyboard shortcut Ctrl+Alt+S.

Question 5

A user wants to save a search as a report that can be used in a dashboard. Which TWO steps are required? (Select two.)

Accepted Answer

Run the search and click 'Save As' > 'Report'. Option B is correct because in Splunk you must first run the search and then use 'Save As' > 'Report' to convert the ad-hoc search into a saved report, which is the prerequisite for dashboard use. Option D is correct because during that save workflow you must provide a report name and configure permissions (owner/app/sharing) so the report is persisted and accessible to the dashboard. Option A is incorrect because scheduling email delivery is an optional alert/report action, not a required step to save a report. Option C is incorrect because a time range can be inherent in the search or set later; it is not a mandatory save step. Option E is incorrect because adding the report to a dashboard panel happens after the report exists and is not part of saving it.

Answer

Schedule the report for email delivery

Answer

Set a time range in the search

Answer

Add the report to a dashboard panel

Question 6

A Splunk user wants to see the list of fields that are defined in a lookup table named 'assets' without running a search. Which command should they use?

Accepted Answer

| inputlookup assets. The correct command is `| inputlookup assets` because it retrieves the contents of a lookup table named 'assets' without requiring a base search. This command is specifically designed to read lookup files directly, returning all fields and rows. It allows users to inspect the lookup table's schema and data without running a search over indexed data.

Answer

| lookup assets

Answer

| stats values(*) as * by *

Answer

| fields assets

Question 7

A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?

Accepted Answer

Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches. Exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.

Answer

Create a search-time field extraction that parses the dest_ip to derive owner and department

Answer

Increase the number of indexers to parallelize the lookup operations

Answer

Use the 'lookup' command with a KV Store lookup that is populated from the database in real time

Question 8

A data model for web traffic has a child dataset 'Error_Pages' that should only include events with status code 5xx. The admin wants to ensure that when the data model is used with tstats, only these events are searched. Which definition should they use in the data model?

Accepted Answer

Add a constraint: status>=500 AND status<=599. Constraints in a Splunk data model define the base search that restricts which events are included in a child dataset. By adding a constraint of `status>=500 AND status<=599`, the Error_Pages dataset will only contain events with HTTP status codes in the 5xx range. When `tstats` is used against this dataset, it automatically respects the constraint, ensuring only those events are searched without needing additional filters at query time.

Answer

Add a filter: status>=500 AND status<=599

Answer

Use a tag: error_tag for status>=500

Answer

Use a calculated field: error=(status>=500)

Question 9

Which THREE of the following are valid uses of the stats command?

Accepted Answer

stats avg(response_time) as avg_time. Option B is correct because stats supports statistical aggregation functions such as avg() with an optional as clause to rename the resulting field, so stats avg(response_time) as avg_time is a valid use. Option C is correct because stats sum(bytes) by source applies the sum() aggregation function grouped by the source field, which is a standard stats usage. Option D is correct because stats count by host uses the count aggregation function with a by clause to group results by host, a canonical stats pattern. Option A is not valid because eval() is not an aggregation function and cannot be used inside stats; eval is a separate command for calculating expressions. Option E is not valid because table is a separate command, not a stats function, so stats table user is not a legitimate stats invocation.

Answer

stats eval(x=1) by category

Answer

stats table user

Question 10

A Splunk admin is troubleshooting a slow report that uses an accelerated data model. The report uses tstats commands and filters on a field that is not a constraint field in the data model. Which of the following best explains why the report is slow?

Accepted Answer

The field used in the filter is not defined as a constraint field in the data model, so tstats cannot use acceleration for that filter.. C is correct because `tstats` relies on acceleration summaries that are built only for fields defined as constraint fields in the data model. When a filter is applied on a non-constraint field, `tstats` cannot use the pre-computed acceleration summary and must fall back to scanning the raw events, which significantly degrades performance.

Answer

The acceleration summary for that data model has not been rebuilt recently, causing outdated data.

Answer

The report is using the data model incorrectly; it should use |datamodel instead of |tstats.

Answer

The time range is too broad, causing the acceleration summary to include too many events.

Question 11

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. Option A is correct because the stats command is Splunk's primary aggregation command, computing summary statistics such as count, sum, avg, min, max, dc (distinct count), and many other statistical functions over the result set. Option E is correct because stats supports a by clause (e.g., `stats count by host`) to group results by one or more fields, and those by fields must already exist in the search results for the grouping to work. Option B is incorrect because listing individual events is the job of commands like table or raw event display, not stats, which collapses events into aggregated rows. Option C is incorrect because creating new fields is done with eval, not stats, which only aggregates existing fields. Option D is incorrect because stats works with non-numeric fields too, for example count, dc, values, and list operate on string fields.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 12

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

Accepted Answer

Add an index to the lookup file by converting to KV Store. To improve performance with a large CSV lookup (200,000 rows), converting it to a KV Store (Option C) is the best choice because KV Store lookups are indexed, making field matching much faster than searching the entire CSV file each time. Option A (external lookup) is wrong because querying a database adds network and database overhead, often slowing performance further. Option B (increasing timeout) does not speed up the lookup; it only prevents timeouts during long operations. Option D (increasing max_matches) controls how many matching results are returned, but does not affect the speed of the lookup operation itself.

Answer

Switch to an external lookup that queries a database

Answer

Increase the lookup timeout value

Answer

Increase the max_matches setting for the lookup

Question 13

Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?

Accepted Answer

Stacked column chart. A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.

Answer

Line chart

Answer

Pie chart

Answer

Scatter chart

Question 14

Which TWO of the following are valid ways to access the Search & Reporting app in Splunk Web? (Choose two.)

Accepted Answer

Click the 'Search & Reporting' link on the Splunk Home page.. Option A is correct because the Splunk Home page lists the installed apps, including Search & Reporting, as clickable links that launch the app directly. Option C is correct because the Apps menu in the top navigation bar lets users switch between installed apps, and Search & Reporting appears there as a selectable app. Option B is incorrect because Settings > Search does not exist as a navigation path for launching the Search & Reporting app; Settings contains configuration items such as licensing, users, and indexes. Option D is incorrect because typing 'search' in the browser address bar performs a web search or invalid URL entry, not navigation within Splunk Web. Option E is incorrect because the Help menu provides documentation and support links, not a Search Assistant for opening the Search & Reporting app.

Answer

Navigate to Settings > Search.

Answer

Type 'search' in the browser address bar.

Answer

Open the Search Assistant from the Help menu.

Question 15

A Splunk administrator notices that a data model acceleration summary is not updating as expected. The data model is accelerated with a summary range of 30 days. What is the most likely cause of this issue?

Accepted Answer

The summary index is not writable due to insufficient disk space.. Data model acceleration relies on a summary index to store pre-computed results. If the disk hosting that summary index is full, the acceleration process cannot write new data, causing the summary to stop updating. Splunk will log errors related to disk space, and the acceleration status will show as stalled or incomplete.

Answer

The data model is based on a time range older than the summary range.

Answer

The data model includes calculated fields that are not search-time extractable.

Answer

The data model acceleration is configured to run only on real-time searches.

Question 16

Refer to the exhibit. A Splunk analyst wants to find the top users generating syslog events. If the analyst wants to include all users, not just the top 5, which command modification is correct?

Accepted Answer

Change to stats count by user. The `top` command returns the most common values up to a limit (default 10). Removing `limit=5` restores the default limit of 10, but still does not include all users. In contrast, `stats count by user` counts events for each user without any limit, thereby including all users. Therefore, option B is the correct modification to include all users.

Answer

Replace top with rare

Answer

Add useother=t

Answer

Remove limit=5

Question 17

A user wants to see a visual representation of search results over time. Which tab should they use?

Accepted Answer

Visualizations. The Visualizations tab is the correct choice because it provides a graphical representation of search results, such as charts, graphs, and time-series plots, which are essential for visualizing trends over time. In Splunk, after running a search, the user can switch to the Visualizations tab to select from various chart types (e.g., line, column, area) that automatically map the _time field to the x-axis, enabling temporal analysis. This tab is specifically designed for transforming tabular search results into visual formats, making it the appropriate tool for seeing data over time.

Answer

Patterns

Answer

Events

Answer

Statistics

Question 18

A user runs a search but sees zero results. What is the most common cause for this?

Accepted Answer

The time range picker is set to a period with no data.. The most common cause for zero search results in Splunk is that the time range picker is set to a time period that contains no indexed data. By default, Splunk restricts searches to the selected time range, and if no events were indexed during that window, the search returns zero results regardless of the query syntax or index selection.

Answer

The search did not specify an index.

Answer

The source type is incorrect.

Answer

The search syntax contains a typo.

Question 19

A junior analyst creates a dashboard to monitor server CPU usage. The dashboard contains a single panel with a line chart showing CPU percentage over the last 24 hours. The analyst then adds a second panel that displays the same data but as a single value showing the average CPU. Both panels use the exact same search string. The dashboard loads slowly, and users complain of wait times. The analyst wants to improve performance without changing the displayed data. Which course of action is best?

Accepted Answer

Convert the dashboard to use a base search and post-process the panels. Using a base search with post-process searches allows both panels to share a single dataset, reducing redundant search execution. Instead of running the same heavy search twice, the base search runs once, and each panel applies lightweight post-processing (e.g., timechart vs. stats) on the cached results. This directly addresses the slow load time without altering the displayed data.

Answer

Keep both panels but add more resources to the Splunk server

Answer

Remove the single value panel and embed its value in the line chart title

Answer

Enable report acceleration on one of the panels

Question 20

An admin wants to add a new data input for a network device sending syslog. Under which Settings menu would the admin navigate?

Accepted Answer

Settings > Data Inputs. To add a new data input for a network device sending syslog, the admin must navigate to Settings > Data Inputs. This is the central location in Splunk Web where you configure how data enters the Splunk platform, including TCP/UDP ports for syslog, file monitoring, scripted inputs, and modular inputs. Syslog data is typically ingested via a UDP or TCP input on port 514, which is configured under Data Inputs.

Answer

Settings > Knowledge

Answer

Settings > Alerts

Answer

Settings > Reporting