SPLK-1001 Practice Test 5 — 25 Questions

Question 1

A user wants to add a panel to an existing dashboard in Splunk. Which TWO of the following methods can be used to achieve this?

Accepted Answer

From a search results page, click 'Save As' and select 'Dashboard Panel'.. After running a search in the Search & Reporting app, you can click 'Save As' and select 'Dashboard Panel' to add the search results as a new panel to an existing dashboard. Option E is correct because when editing a dashboard, the 'Add Panel' button allows you to create a new panel directly within the dashboard editor, choosing from saved searches or creating a new one.

Answer

From the dashboard, click 'Clone Panel' on an existing panel.

Answer

From the dashboard listing, click 'Edit' and then 'Import Panel'.

Answer

From the search app, click 'Add to Dashboard' after running a search.

Question 2

Drag and drop the steps to install an app from Splunkbase into the correct order.

Accepted Answer

Log in to Splunk Web, then navigate to Splunkbase, then click Install on the app page, then restart Splunk if required.. Installing from Splunkbase requires browsing, installing, and possibly restarting Splunk.

Answer

Navigate to Splunkbase, then log in to Splunk Web, then click Install on the app page, then restart Splunk if required.

Answer

Log in to Splunk Web, then click Install on the app page, then navigate to Splunkbase, then restart Splunk if required.

Answer

Log in to Splunk Web, then navigate to Splunkbase, then restart Splunk if required, then click Install on the app page.

Question 3

A Splunk user has created a data model for firewall logs and wants to use it to generate a report showing top source IPs. They attempt to run a search using the data model but receive no results, even though a simple search over the same index returns many events. What is the most likely cause?

Accepted Answer

The data model has not been accelerated, and the user is using |tstats without the 'summariesonly=t' option.. When a data model is not accelerated, the `|tstats` command cannot query it directly unless the `summariesonly=t` argument is used, which forces the search to look only at accelerated summaries. Without acceleration, `|tstats` returns no results because it expects precomputed summary data. A simple search over the same index works because it queries raw events directly, bypassing the data model's summary structure.

Answer

The user lacks the 'run_data_model' capability.

Answer

The time range is outside the data model's acceleration summary.

Answer

The data model definition contains a syntax error in the constraint field.

Question 4

An analyst runs `| inputlookup mylookup.csv` but gets no results. The lookup file exists. What is the most likely cause?

Accepted Answer

The file is not in the correct lookup directory.. The `| inputlookup` command reads lookup files only from the lookups directory within the current app or from the system-level lookups directory. If the file exists elsewhere on the filesystem (e.g., in a custom path or the user's home directory), the command will return no results. This is the most likely cause because the error is not about the file's existence but about its location relative to Splunk's expected lookup paths.

Answer

The search time range is too narrow.

Answer

The lookup command requires an output fields.

Answer

The file is not sorted.

Question 5

A user wants to create a pie chart showing the distribution of error types from web server logs. Which Splunk command should be used to group the errors before visualization?

Accepted Answer

stats count by error_type. The `stats count by error_type` command groups the raw events by the `error_type` field and computes the count for each group, producing the structured data needed for a pie chart. A pie chart requires aggregated numerical values per category, and `stats count by` is the standard Splunk approach to create this summary from log events.

Answer

table

Answer

eval

Answer

top

Question 6

Refer to the exhibit. A user scheduled a report but it never runs. Which of the following is the most likely reason?

Accepted Answer

The cron schedule is invalid because it lacks the weekday field.. The cron schedule in Splunk must include a weekday field (e.g., `?`, `*`, or specific days like `1-5`). If the cron expression omits this field, Splunk treats it as invalid and the scheduled report never runs. Option D correctly identifies this missing weekday field as the root cause.

Answer

The report needs to be shared with the scheduler role.

Answer

The stats command requires a by clause with a time field.

Answer

The search string is missing the 'timechart' command.

Question 7

Match each knowledge object to its definition.

Accepted Answer

Event: A single record of data that represents an occurrence in a system. The correct matches are: Event (single record), Index (data repository), Report (saved search/visualization), Alert (scheduled search with actions), Field (extracted name-value pair). Common confusions include swapping Index with Report or Event with Indexer Cluster.

Answer

Event: A collection of indexers that process and store data

Answer

Index: A saved search that generates a list of events that satisfy certain criteria

Answer

Report: A field extraction that automatically identifies key-value pairs in raw data

Answer

Alert: A dashboard panel that displays real-time data from a saved search

Answer

Field: A collection of events grouped by a common timestamp or source

Question 8

Which TWO actions should be taken to optimize data model acceleration?

Accepted Answer

Set the acceleration time range to cover the most common reporting period.. Setting the acceleration time range to cover the most common reporting period ensures that the data model's acceleration summary only builds and stores data for the time window users query most frequently. This reduces storage overhead and speeds up acceleration builds, as Splunk does not waste resources pre-computing summaries for rarely accessed older data. The acceleration time range is configured in the data model's acceleration settings and directly controls the scope of the tsidx files created.

Answer

Disable field filtering in Pivot.

Answer

Use data model acceleration only for root datasets.

Answer

Add constraints to each dataset to limit events.

Question 9

Refer to the exhibit. What can be determined about the license usage?

Accepted Answer

180 MB of license capacity is available. The pool has a max size of 500 MB and used size of 320 MB, meaning 180 MB is available. The pool is not full. The stack ID indicates it's for enterprise license, but not necessarily all used for search. The pool is not over-allocated.

Answer

320 MB of license is used for search

Answer

The pool is over-allocated

Answer

The license is expired

Question 10

Which TWO chart types are best suited for showing the distribution of categorical data?

Accepted Answer

Pie chart. Pie charts and column charts are both effective for displaying the distribution of categorical data because they visually compare parts of a whole or the frequency of distinct categories. In Splunk, the `pie` and `column` chart types are commonly used with the `chart` or `timechart` commands to aggregate event counts or statistical values by a categorical field, making it easy to see relative proportions or rankings.

Answer

Scatter chart

Answer

Line chart

Answer

Area chart

Question 11

Refer to the exhibit. The timechart returns only partial results for some sourcetypes, and there are gaps in the timeline. Which is the most likely reason?

Accepted Answer

The tstats command only uses summary data, which may not cover all time ranges. The `tstats` command in Splunk operates on indexed-time summary data stored in the tsidx files, not on raw events. This summary data is generated during indexing based on the data model acceleration or summary indexing configuration, and it may not cover all time ranges if the acceleration has not been built for those periods or if the data model is not fully accelerated. As a result, `tstats` can return partial results and gaps in the timeline, especially when the time range extends beyond the accelerated data coverage.

Answer

The timechart span=1h conflicts with the tstats span

Answer

The sourcetype field is not summarized

Answer

The where clause is invalid

Question 12

A security analyst wants to enrich authentication logs with a lookup table containing user department and manager information. Which TWO statements are true about using lookups in Splunk?

Accepted Answer

The inputlookup command can be used to load a lookup file into a search.. The `inputlookup` command loads the contents of a static lookup file (e.g., CSV, KV store) directly into a search pipeline as events, allowing the analyst to inspect or further process the lookup data. This is a standard Splunk SPL command used for ad-hoc enrichment without requiring a defined lookup definition.

Answer

Once a lookup is defined, it cannot be updated.

Answer

Lookups can only be created from CSV files.

Answer

Lookups can only match on a single field.

Question 13

Which TWO options are valid methods to add a visualization to a dashboard?

Accepted Answer

Save a search as a dashboard panel. Saving a search as a dashboard panel directly creates a visualization on a dashboard. When you run a search that produces a chart or table, the 'Save As' menu includes an option to save it as a dashboard panel, which automatically adds the visualization to an existing or new dashboard.

Answer

Drag a chart from the search page

Answer

Append the chart command to the search

Answer

Use the export to PDF feature

Question 14

Which TWO of the following are true about KV Store lookups in Splunk?

Accepted Answer

KV Store lookups can be used in automatic lookups. KV Store lookups can be configured as automatic lookups in Splunk, meaning they can be applied at search time without requiring an explicit lookup command. This is done by defining the KV Store collection as a lookup in transforms.conf and then associating it with a source type or host in props.conf, just like CSV or external lookups.

Answer

KV Store lookups automatically support time-based retrieval

Answer

KV Store lookups are stored as CSV files on the search head

Answer

KV Store lookups only support exact match lookups

Question 15

Which THREE statements about the 'rex' command are correct? (Choose three.)

Accepted Answer

rex can be used to extract fields from any string field. The 'rex' command can extract fields from any string field, not just the default `_raw` field. By specifying the `field` argument, you can target any field containing string data, such as `field=uri_path` or `field=host`, and use a regular expression to extract new fields from its value.

Answer

rex can only extract one field per command

Answer

rex automatically converts extracted values to numeric

Question 16

An analyst created a report that runs a search over the last 7 days. The report is scheduled to run daily. Each time the report runs, it takes a long time and impacts other searches. What is the best way to improve performance without changing the data model?

Accepted Answer

Enable report acceleration on the report.. Report acceleration pre-computes and stores the results of a report's search in a summary cache, allowing subsequent runs to retrieve the cached data instead of re-executing the full search over the raw data. This drastically reduces runtime and resource consumption without altering the underlying data model or the report's logic.

Answer

Change the schedule to run weekly instead of daily.

Answer

Change the time range to 'Last 24 hours' to reduce data scanned.

Answer

Create a summary index and populate it with a separate scheduled search.

Question 17

A user wants to replace a field value 'ERROR' with 'Error' in search results. Which command should be used within a search to achieve this transformation?

Accepted Answer

eval severity=replace(severity, "ERROR", "Error"). The `replace` function in the `eval` command performs a case-sensitive string replacement on a specific field. In this case, it replaces the exact string 'ERROR' with 'Error' in the `severity` field, which is the precise transformation requested. Unlike `rex`, `replace` does not require regex syntax and directly modifies the field value without affecting other parts of the event.

Answer

rex field=_raw 's/ERROR/Error/g'

Answer

lookup severity_lookup severity OUTPUT new_severity

Answer

convert ctime(_time)

Question 18

Refer to the exhibit. The search results show city and country fields from the GeoIP lookup. What does the automatic lookup use as the input field to match against the lookup table?

Accepted Answer

ip. The automatic GeoIP lookup in Splunk uses the `ip` field as the default input field to match against the lookup table. This is because the GeoIP lookup is designed to map IP addresses to geographic locations, and the lookup table expects an IP address as the key. When you configure an automatic lookup, you specify the input field (e.g., `ip`) that corresponds to the lookup table's key field, allowing Splunk to enrich events with location data.

Answer

All fields in the event

Answer

No input field, it directly appends all lookup fields

Answer

clientip

Question 19

A SOC manager creates a dashboard with multiple time-range pickers (one global, one per panel). The global picker is set to 'Last 7 days' but one panel uses its own picker set to 'Last 24 hours'. When the dashboard loads, which time range will the panel use?

Accepted Answer

The panel's own picker setting of 'Last 24 hours'. In Splunk dashboards, when a panel has its own time-range picker configured, it overrides the global time-range picker for that specific panel. The panel will use its own picker setting of 'Last 24 hours' regardless of the global setting of 'Last 7 days'. This behavior ensures that individual panels can display data for different time ranges as needed.

Answer

The dashboard default of 'Last 24 hours'

Answer

A combination of both: the last 7 days but limited to 24 hours

Answer

The global picker setting of 'Last 7 days'

Question 20

Refer to the exhibit. A Splunk analyst wants to find the top users generating syslog events. If the analyst wants to include all users, not just the top 5, which command modification is correct?

Accepted Answer

Change to stats count by user. The `top` command returns the most common values up to a limit (default 10). Removing `limit=5` restores the default limit of 10, but still does not include all users. In contrast, `stats count by user` counts events for each user without any limit, thereby including all users. Therefore, option B is the correct modification to include all users.

Answer

Replace top with rare

Answer

Add useother=t

Answer

Remove limit=5