SPLK-1001 Practice Test 4 — 25 Questions

Question 1

A user created a dashboard panel with a search that uses a token. The token is not being applied when the user modifies the dropdown. What is the most likely cause?

Accepted Answer

The token name in the search does not match the token in the input. For a token to dynamically filter search results in a Splunk dashboard, the token name referenced in the search string (e.g., `$token_name$`) must exactly match the token name defined in the input's `token` attribute. If these names differ, the search will not receive the selected value, and the token will appear unapplied.

Answer

The input has a default value that overrides user selections

Answer

The dashboard is set to 'disabled' mode

Answer

The panel is set to 'static'

Question 2

Which THREE statements about the 'rex' command are correct? (Choose three.)

Accepted Answer

rex can be used to extract fields from any string field. Option A is correct because the rex command is a Splunk search command that applies a regular expression to any string field (not just _raw) and extracts new fields from it via the max_match and field arguments. Option B is correct because rex supports named capturing groups in the form (?<name>pattern), which become the extracted field names in the results. Option E is correct because rex can overwrite an existing field when the named capture group matches an already-present field name, effectively modifying that field's value. Option C is incorrect because rex can extract multiple fields in a single invocation by using multiple named capturing groups in one regular expression. Option D is incorrect because rex leaves extracted values as strings and does not automatically cast them to numeric types; a separate conversion such as the eval or convert command is required.

Answer

rex can only extract one field per command

Answer

rex automatically converts extracted values to numeric

Question 3

Which command reads a lookup file and outputs it as search results?

Accepted Answer

| inputlookup mylookup.csv. The `| inputlookup mylookup.csv` command reads the specified lookup file (mylookup.csv) from the lookups directory and outputs its contents as search results, making it the correct choice. This command is specifically designed to load a static lookup table into the search pipeline for further processing or inspection.

Answer

| outputlookup mylookup.csv

Answer

| lookup mylookup.csv

Answer

| lookup definition mylookup

Question 4

A user wants to view only specific fields in the search results. Which interface element can be used to select which fields to show?

Accepted Answer

Fields sidebar. The Fields sidebar in Splunk's Search & Reporting app lists all fields extracted from the current search results and lets users select which fields to display in the Events tab. Clicking a field name toggles its visibility, and users can also use 'Selected Fields' vs. 'Interesting Fields' to curate the view. This is the canonical UI element for controlling field display without modifying the search itself.

Answer

Statistics tab

Answer

Events tab

Answer

Patterns tab

Question 5

A data model is set to accelerate with a summary range of 90 days. After some time, the administrator notices that the acceleration is using significant disk space. Which strategy would best reduce disk usage without losing the ability to quickly query the last 30 days of data?

Accepted Answer

Reduce the summary range to 30 days.. Reducing the summary range to 30 days directly aligns with the requirement: it stops the acceleration from pre-computing and storing summaries for data older than 30 days, freeing disk space while still providing accelerated query performance for the most recent 30 days. The summary range defines how far back the acceleration engine pre-aggregates data; a shorter range means fewer stored results.

Answer

Set the acceleration to use a shorter time window for complete summarization.

Answer

Increase the summary range to 180 days.

Answer

Disable acceleration for the data model.

Question 6

After running a search, the Fields sidebar shows several fields but the analyst wants to see all fields. Which button should they click?

Accepted Answer

The gear icon next to 'Selected Fields'. The gear icon next to 'Selected Fields' opens the field list configuration, allowing you to toggle between showing only selected fields or all fields. By default, Splunk displays only the most relevant fields in the Fields sidebar; clicking the gear icon lets you select 'All fields' from the dropdown to display every extracted field for the search results.

Answer

'Add field' button

Answer

'All fields' button

Answer

'Show all fields' checkbox

Question 7

A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?

Accepted Answer

index=web status=404 | top src_ip. It first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.

Answer

index=web status=404 | sort src_ip

Answer

index=web | top src_ip

Answer

index=web status=404 | rare src_ip

Question 8

A security analyst needs to create a report that shows the count of failed login attempts by user over the last 24 hours, updated every hour. The report should be accessible to the SOC team but not to other users. Which sequence of steps should the analyst follow?

Accepted Answer

Run the search, click 'Save As' -> 'Report', set permissions to 'Shared in App' with SOC role, then 'Schedule' hourly.. Splunk reports are saved searches that can be scheduled and have permissions applied. To make the report accessible only to the SOC team, the analyst should set permissions to 'Shared in App' and assign the SOC role, then configure an hourly schedule. This satisfies both the access restriction and the recurring update requirement without creating an alert.

Answer

Run the search, click 'Save As' -> 'Report', set schedule to hourly, then create an alert action to email the report to the SOC team.

Answer

Run the search, click 'Save As' -> 'Dashboard Panel', add to a SOC dashboard, then schedule the dashboard.

Answer

Run the search, click 'Save As' -> 'Alert', set permissions to private, then schedule the alert to trigger hourly.

Question 9

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

Accepted Answer

Configure a CSV lookup and use lookup command in search. A CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Answer

Use a time-based lookup to match event time with lookup time

Answer

Set up an external lookup that calls a REST API

Answer

Create a KV Store lookup and update it via REST

Question 10

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. Option A is correct because a root event dataset in a Splunk data model can be filtered with a constraint string (a search-like expression) that limits which events populate the dataset, such as restricting to a specific sourcetype or index. Option C is correct because data models can define fields that are extracted at search time, including eval-based calculated fields and field extractions, not only indexed fields. Option B is incorrect because data models are knowledge objects stored in the search head's knowledge bundle and replicated to search peers, not stored on indexers for faster access. Option D is incorrect because acceleration is optional; a data model can be used in searches (for example via the datamodel command or pivot) without being accelerated, though acceleration improves performance. Option E is incorrect because a data model may contain multiple root datasets, not exactly one.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 11

Refer to the exhibit. The pie chart shows only 10 slices, but the base search stats returns all destinations. What is the reason?

Accepted Answer

The post-process search includes | top limit=10 dest. The base search returns all destinations, but the pie chart shows only 10 slices because the post-process search uses the `| top limit=10 dest` command. The `top` command limits the results to the top 10 values of the `dest` field by count, and this post-process search is applied after the base search, so only those 10 slices are displayed in the pie chart.

Answer

The eval command changes the dest field

Answer

The base search time range is too small

Answer

The charting option 'chart' is set to 'pie'

Question 12

Refer to the exhibit. The search is not returning the `app_name` field as expected. The lookup has many entries with wildcard patterns. What is the most likely issue?

Accepted Answer

The lookup command uses OUTPUTNEW, but the event already has an app_name field (possibly null) so the lookup does not overwrite it.. The `OUTPUTNEW` clause in the `lookup` command only writes the field if it does not already exist in the event. If the event already contains an `app_name` field (even with a null value), the lookup will not overwrite it, so the expected value from the wildcard lookup is not returned. This is a common pitfall when using lookups with fields that may already be present in the data.

Answer

The lookup definition uses WILDCARD match type, which is incompatible with the lookup command.

Answer

The eval statement should not rename src_ip; the lookup should directly use src_ip.

Answer

The lookup command needs the option max_matches=1 to work with wildcards.

Question 13

A user wants to create a report that shows the average response time for each web endpoint over the past week. The data has fields: endpoint, response_time. Which search correctly calculates the average?

Accepted Answer

... | stats avg(response_time) by endpoint. The `stats avg(response_time) by endpoint` command calculates the average (mean) of the response_time field for each unique endpoint value. This directly meets the requirement of showing average response time per web endpoint over the past week, assuming the time range is set in the search bar or via an earliest/latest constraint.

Answer

... | stats mean(response_time) by endpoint

Answer

... | stats avg(response_time) by _time

Answer

... | eval avg=sum(response_time)/count | stats values(avg) by endpoint

Question 14

Which of the following best describes the purpose of the 'fields' command in a search?

Accepted Answer

To keep or remove specified fields from events. The 'fields' command in Splunk is used to either keep (include) or remove (exclude) specified fields from search results. By default, all extracted fields are returned, but 'fields' allows you to narrow the output to only relevant fields (e.g., `fields clientip, status`) or to drop unwanted fields (e.g., `fields - _raw`). This improves readability and performance by reducing the data volume passed to subsequent commands.

Answer

To rename existing fields

Answer

To add fields from a lookup table

Answer

To extract new fields from raw data

Question 15

Which THREE of the following are valid considerations when accelerating a data model? (Choose three.)

Accepted Answer

Constraints in the data model affect which events are summarized.. Option A is correct because constraints defined in the data model (such as filters or restrictions on fields/events) determine which events are eligible to be included in the acceleration summary, so they directly affect what gets summarized. Option D is correct because acceleration works by building and storing pre-computed summary files on disk, which consumes additional storage beyond the raw indexed data. Option E is correct because the acceleration summary range (the time span covered by the summary) should be aligned with the time ranges most frequently queried, so that common searches benefit from the pre-calculated results rather than falling outside the summarized window. Option B is not required: a data model does not need to be fully defined before acceleration is enabled, since acceleration can be applied to the portions of the model that exist. Option C is incorrect because acceleration runs at search time (using pre-built summaries) rather than at index time; the summaries are generated separately and then leveraged during searches, not computed during indexing.

Answer

A data model must be fully defined before acceleration can be enabled.

Answer

Acceleration runs at index time to pre-calculate results.

Question 16

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 17

Which THREE of the following are best practices when designing data models in Splunk?

Accepted Answer

Enable acceleration only on data models that are used frequently.. Option B is correct because data model acceleration consumes significant storage and search resources, so it should be enabled only on frequently used data models to balance performance against cost. Option D is correct because constraints on root events (such as a search filter or field constraint) restrict the dataset to only relevant events, which improves search efficiency and reduces the scope of the data model. Option E is correct because organizing different sourcetypes into separate child objects under a common root event allows each sourcetype to have its own fields and constraints while still sharing the root event's base dataset, which is a recommended hierarchical design. Option A is not a best practice because data models should be designed around the underlying data and business needs, not solely to optimize the most common reports. Option C is not a best practice because including every possible field bloats the data model, increases acceleration costs, and reduces maintainability; fields should be added as needed.

Answer

Design the data model based on the most common reports to ensure quick results.

Answer

Include every possible field in the data model to avoid future modifications.

Question 18

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Accepted Answer

Concatenating two strings: eval fullname = firstname + " " + lastname. Option B is correct because eval can compute a new field using string concatenation with the + operator, so eval fullname = firstname + " " + lastname joins the two string fields with a space. Option D is correct because eval supports arithmetic expressions, so eval ratio = count / total derives a new field by dividing two numeric values. Option E is correct because eval supports conditional functions such as if(), so eval status = if(error > 0, "Error", "OK") creates a field whose value depends on the error count. Option A is not a valid eval use because grouping is done with the by clause of transforming commands like stats or chart, not with eval. Option C is not a valid eval use because sorting is performed by the sort command, not by eval.

Answer

Grouping events by a field: eval by host

Answer

Sorting events by a field: eval sort by _time

Question 19

Which command is used to export the current search results to a CSV file that can be used as a lookup table?

Accepted Answer

outputlookup. The `outputlookup` command is used to export the current search results to a CSV file that can be used as a lookup table. It writes the results to a lookup definition in Splunk, making the data available for subsequent searches via `inputlookup` or automatic lookup configurations.

Answer

outputcsv

Answer

inputlookup

Answer

lookup

Question 20

A user wants to save a search for later use but not schedule it. Which action should the user take?

Accepted Answer

Click Save As > Search.. Clicking Save As > Search saves the search string and properties (time range, mode) as a reusable search without any scheduling or alerting. This allows the user to run the search manually later from the 'Searches & Reports' page without it executing on a schedule.

Answer

Click Save As > Report and schedule it.

Answer

Click Save As > Alert.

Answer

Click Save As > Dashboard Panel.