SPLK-1001 Practice Test 27 — 15 Questions

Question 1

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 2

A security analyst uses Splunk Web daily to investigate incidents. Recently, the analyst noticed that when running a search, the search results are displayed correctly, but the 'Field sidebar' on the left shows the message 'No fields found. Your search may not have generated any fields.' The analyst knows that the data has fields because the same search used to show fields. The analyst has not changed any settings. The analyst is using the same Splunk instance and same data. What is the most likely reason for this issue?

Accepted Answer

The search mode is set to 'Raw' instead of 'Smart' or 'Verbose'.. If the search does not use a transforming command and returns raw events, the field sidebar may initially prompt for a field extraction; but the message 'No fields found' indicates that no fields were extracted from the events. This can happen if the 'Interesting fields' extraction is disabled or if the search returns events that did not have fields extracted due to a sourcetype issue. But the most common cause is that the search is returning events in a mode where fields are not automatically extracted, such as when using 'raw' mode or if the search is not in 'Smart' mode. Actually, the field sidebar should show fields from the interesting fields. Option A is incorrect because the user said they have permission. Option B is plausible: the analyst might have accidentally switched the search mode to 'Raw' which does not extract fields. Option C is incorrect because the index exists. Option D is incorrect because the search string is the same.

Answer

The analyst changed the search string to exclude all fields.

Answer

The data has been moved to a different index.

Answer

The analyst's role no longer has permission to view fields.

Question 3

Which TWO are benefits of using data model acceleration? (Choose two.)

Accepted Answer

Reduced time to run complex aggregations and statistical searches.. Data model acceleration pre-computes and stores aggregated data in the form of summaries (`.tsidx` files), which drastically reduces the time needed to run complex statistical and aggregation searches like `stats`, `timechart`, or `top`. Instead of scanning raw events, Splunk queries these pre-built summaries, enabling sub-second response times for large datasets.

Answer

Reduced disk space usage by compressing indexed data.

Answer

Eliminates the need for data indexing by using summary data.

Answer

Simplified data model design by automatically optimizing relationships.

Question 4

Refer to the exhibit. A user runs this search and the resulting timechart shows multiple lines, one for each host. The user wants to show only the top 3 hosts by total count. Which modification achieves this?

Accepted Answer

Add | top 3 host before timechart. The `top 3 host` command, when placed before `timechart`, calculates the top 3 hosts by total count across the entire search timeframe, then passes only those three hosts to the `timechart` command. This ensures the timechart displays exactly three lines, one for each of the top hosts, based on their overall event count.

Answer

Add | top 3 host after timechart

Answer

Add | where host in (select top 3) after timechart

Answer

Add | head 3 after timechart

Question 5

A security team wants to monitor the count of failed login attempts over the past week. They need a simple at-a-glance number. Which visualization type should they use?

Accepted Answer

Single Value. A Single Value visualization is the correct choice because it displays a single, aggregated number prominently, making it ideal for an at-a-glance metric like the count of failed login attempts over the past week. In Splunk, you can use a stats or timechart command to calculate the total count and then render it as a Single Value, which shows just the number without any trend or distribution detail.

Answer

Line chart

Answer

Bar chart

Answer

Pie chart

Question 6

Which command reads a lookup file and outputs it as search results?

Accepted Answer

| inputlookup mylookup.csv. The `| inputlookup mylookup.csv` command reads the specified lookup file (mylookup.csv) from the lookups directory and outputs its contents as search results, making it the correct choice. This command is specifically designed to load a static lookup table into the search pipeline for further processing or inspection.

Answer

| outputlookup mylookup.csv

Answer

| lookup mylookup.csv

Answer

| lookup definition mylookup

Question 7

A large e-commerce company uses Splunk to monitor its web application. They have a data model named 'Web_Transactions' that contains fields: status_code, response_time, uri, user_agent. The data model is accelerated with a 30-day time range. Recently, the operations team reported that the dashboard showing average response time by URI is loading slowly, taking over 30 seconds to display. Upon investigation, you find that the data model acceleration summary job is taking longer to complete and sometimes fails. The indexers have sufficient CPU and memory, but the disk I/O is high during the summary job. The volume of web logs is approximately 500 GB per day. Which action should the Splunk administrator take to improve dashboard performance?

Accepted Answer

Increase the maximum number of parallel searches for the data model acceleration job in the limits.conf.. Increasing the `max_concurrent_parallel_searches` for the data model acceleration job in `limits.conf` allows the summary process to use more parallel searches against the indexers, which can reduce the time it takes to build the acceleration summary. Since the indexers have sufficient CPU and memory but disk I/O is high, parallelizing the search workload can better utilize available resources and prevent the job from timing out, thereby improving dashboard performance.

Answer

Disable data model acceleration and create a report that runs a scheduled search every 30 minutes to pre-compute the averages.

Answer

Add more indexers to distribute the data and reduce the load per indexer.

Answer

Decrease the acceleration time range from 30 days to 7 days.

Question 8

A user notices that a data model is not updating with recent events. The data model acceleration is enabled and the summary range is set to 30 days. Which action should the admin take to ensure the accelerated data model includes data from the last hour?

Accepted Answer

Rebuild the data model acceleration using '| datamodel rebuild'.. Rebuilding the data model acceleration using the '| datamodel rebuild' command forces a complete re-index of the acceleration summary, which will include all available data, including events from the last hour. This resolves the issue where the accelerated data model is not updating with recent events, even though acceleration is enabled and the summary range covers 30 days.

Answer

Run a '| datamodel <name> search' command.

Answer

Run '| tstats summariesonly=t' against the data model.

Answer

Increase the summary range to 60 days.

Question 9

A new Splunk user wants to view the raw event data for the last hour. Which interface should they use?

Accepted Answer

Search & Reporting. The Search & Reporting interface (D) is the primary Splunk app for running searches and viewing raw event data. By default, it shows events from the last 24 hours, but the user can easily set the time range picker to 'Last hour' to see raw events for that period. This interface provides the search bar, timeline, and event listing necessary to inspect raw data.

Answer

Search History

Answer

Settings

Answer

Data Summary

Question 10

In a dashboard, a user wants to click on a bar in a chart and navigate to another dashboard with relevant data for that bar. Which feature should they configure?

Accepted Answer

Drilldown. Drilldown is the correct feature because it allows a user to click on a data point (e.g., a bar in a chart) and navigate to another dashboard, passing the relevant field values as tokens to filter the target dashboard's data. This is a built-in capability in Splunk dashboards, configurable via the 'Drilldown' editor or XML attributes like `drilldown` on chart elements.

Answer

Link to search

Answer

Custom URL

Answer

Tokens

Question 11

Which three options describe recommended practices for optimizing and maintaining data model acceleration? (Choose three.)

Accepted Answer

Set the acceleration time range to match the most common search timeframe for that data model.. Accelerating only frequently used data models conserves disk space and system resources by avoiding unnecessary summary builds. Setting the acceleration time range to match the most common search timeframe ensures that the accelerated data aligns with user query patterns, maximizing efficiency. Scheduling the acceleration summary rebuild during off-peak hours minimizes the performance impact on concurrent searches, as the rebuild process consumes significant CPU and I/O resources.

Answer

Use the `| datamodel` command to manually trigger acceleration rebuilds after major data additions.

Answer

Increase the number of parallel search processes to automatically improve acceleration speed.

Answer

Avoid using acceleration on data models that contain calculated fields, as they cannot be accelerated.

Question 12

A security analyst wants to create a report showing the number of failed login attempts by user over the past 24 hours, updated automatically every hour. Which approach is most efficient?

Accepted Answer

Create a report with a scheduled search that runs every hour and saves to a CSV file. Scheduled reports with a time range run periodically and save results, reducing resource usage. Option A is wrong because real-time searches are continuous and resource-intensive, not suitable for periodic updates. Option C is wrong because dashboard panels run every time the dashboard loads, not on a fixed schedule, and without saving results. Option D is wrong because tstats is used for accelerated data models, not for ad-hoc reporting.

Answer

Create a real-time search in a dashboard

Answer

Create a dashboard panel with a fast search

Answer

Use the tstats command in a dashboard

Question 13

Which two of the following are valid ways to create a report in Splunk? (Choose two.)

Accepted Answer

Save a search as a report. Splunk allows you to save any search as a report directly from the Search & Reporting app. When you run a search and click 'Save As' > 'Report', Splunk stores the search string, time range, and visualization settings as a reusable report object in the knowledge object store. This is a fundamental method for creating reports in Splunk.

Answer

Convert a dashboard panel to a report

Answer

Schedule an alert

Answer

Import an external CSV as a report

Question 14

Refer to the exhibit. A Splunk admin runs a search using the 'Authentication' data model and notices that the search does not use the acceleration summaries. The admin confirms that acceleration is enabled and the summary range is set correctly. What is the most likely reason for the acceleration being ignored?

Accepted Answer

The constraints are not restrictive enough to reduce the data volume.. The data model does not have a required field constraint on _time; however, for acceleration to be effective, the data model must include a constraint that filters a significant portion of data, typically based on time. In this definition, the only constraint is on 'action', which does not reduce the data enough, causing Splunk to decide not to use acceleration because it would not be efficient. Option A is wrong because there is no missing timestamp; _time is present. Option B is wrong because maxTime does not affect whether acceleration is used; it sets the maximum retention. Option D is wrong because the data model is correctly defined with constraints in the JSON.

Answer

The data model definition is invalid because constraints are required in the JSON.

Answer

The data model does not include a timestamp field.

Answer

The maxTime setting is too short for the search time range.

Question 15

Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?

Accepted Answer

Stacked column chart. A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.

Answer

Line chart

Answer

Pie chart

Answer

Scatter chart