SPLK-1001 Practice Test 28 — 15 Questions

Question 1

After running a search, the Fields sidebar shows several fields but the analyst wants to see all fields. Which button should they click?

Accepted Answer

The gear icon next to 'Selected Fields'. The gear icon next to 'Selected Fields' opens the field list configuration, allowing you to toggle between showing only selected fields or all fields. By default, Splunk displays only the most relevant fields in the Fields sidebar; clicking the gear icon lets you select 'All fields' from the dropdown to display every extracted field for the search results.

Answer

'Add field' button

Answer

'All fields' button

Answer

'Show all fields' checkbox

Question 2

A lookup definition in transforms.conf includes the following settings: `filename = employees.csv`, `max_matches = 0`, `case_sensitive_match = false`. Which three statements about this lookup are true? (Choose three.)

Accepted Answer

The lookup matching is case-insensitive.. The `case_sensitive_match = false` setting in transforms.conf explicitly makes the lookup matching case-insensitive. This means that when the lookup is performed, the comparison between the event field value and the lookup key ignores differences in uppercase and lowercase characters.

Answer

The lookup will fail if there are duplicate keys.

Answer

The lookup will only return the first match for each event.

Question 3

A search needs to replace a field value 'user' with 'full name' using a CSV lookup that has 'username' and 'fullname' columns. Which lookup command is correct?

Accepted Answer

| lookup users.csv username AS user OUTPUT fullname AS full_name. The `lookup` command syntax requires specifying the lookup file, then the field name in the lookup file (`username`) mapped to the field in the event (`user`) using `AS`, and then `OUTPUT` to bring the `fullname` field into the event as a new field named `full_name`. This matches the requirement to replace the field value 'user' with 'full name' by using the CSV lookup's `fullname` column.

Answer

| lookup users.csv username AS user OUTPUTNEW fullname

Answer

| lookup users.csv user AS username OUTPUT fullname

Answer

| lookup users.csv user AS fullname OUTPUT username

Question 4

A large enterprise has multiple Splunk indexers and is using data model acceleration to speed up dashboards. The dashboards are slow despite acceleration being enabled. The data model has many root events and child datasets. Which best practice should the administrator consider to improve performance?

Accepted Answer

Reduce the number of root events in the data model.. Data model acceleration creates a summary of the data, but the acceleration process must traverse all root events to build the child datasets. If there are too many root events, the acceleration job itself becomes slow and resource-intensive, negating the performance benefit. Reducing the number of root events directly reduces the workload for acceleration, allowing the summaries to be built faster and queries to run against the accelerated data more efficiently.

Answer

Use tstats commands on the data model without acceleration.

Answer

Replicate the data model on each indexer to distribute load.

Answer

Increase the summary range to cover more data.

Question 5

A network operations team uses Splunk to monitor netflow data stored in index='net' and sourcetype='netflow'. The events contain fields: src_ip, dest_ip, bytes, and protocols. The team needs to identify the top 5 source IPs by total bytes transferred (based on the bytes field). For each of those top source IPs, they also want to list the destination IPs and the number of times they communicated. The data volume is large, so performance is important. Which SPL approach returns the desired results efficiently?

Accepted Answer

index=net sourcetype=netflow [ search index=net sourcetype=netflow | stats sum(bytes) as total_bytes by src_ip | sort -total_bytes | head 5 | fields src_ip ] | stats count by src_ip, dest_ip. It uses a subsearch to first identify the top 5 source IPs by total bytes, then passes those IPs to the outer search to efficiently compute the count of communications per destination IP. This approach minimizes the data processed in the outer search by filtering only the relevant source IPs, which is critical for performance on large netflow datasets.

Answer

index=net sourcetype=netflow | eventstats sum(bytes) as total_bytes by src_ip | stats count by src_ip, dest_ip

Answer

index=net sourcetype=netflow | stats sum(bytes) as total_bytes, count by src_ip, dest_ip | sort -total_bytes | head 5

Answer

index=net sourcetype=netflow | top limit=5 src_ip by bytes | fields src_ip | search index=net sourcetype=netflow | stats count by src_ip, dest_ip

Question 6

Refer to the exhibit. A data analyst is analyzing web traffic and wants to find the most accessed products. The rex command extracts product IDs from URI paths. Why might the top command return inaccurate results?

Accepted Answer

Events without matching product IDs will be counted as a single value. The `top` command counts all events, including those where the `rex` command failed to extract a product ID. Such events have a null value for the extracted field, and `top` groups all null values together as a single category, often resulting in 'null' appearing as the top value, thus skewing the results. This is a common pitfall when using `rex` before `top`.

Answer

The regex pattern is incorrect

Answer

The limit should be 0 to show all

Answer

The top command is not sorted

Question 7

An analyst has created a search that they want to run regularly. What is the most efficient way to save this search for future use?

Accepted Answer

Save as a report. Saving a search as a report in Splunk stores both the search string and its metadata (such as time range and permissions) in the knowledge object system, making it reusable for future ad-hoc runs, dashboard panels, or alerts without re-entering the search. Reports are the most efficient way to preserve a search for regular manual or scheduled execution, as they can be directly accessed from the Reports listing and used as the foundation for other objects like alerts or dashboards.

Answer

Export to CSV

Answer

Save as an alert

Answer

Save as a dashboard panel

Question 8

Drag and drop the steps to create a simple Splunk search that returns results for a specific error in the last 24 hours into the correct order.

Accepted Answer

Select the Search & Reporting app, Enter the search query for the error, Set the time range to Last 24 hours, Run the search.. Basic search workflow involves selecting the app, entering the search with time range, executing, and reviewing results.

Answer

Set the time range to Last 24 hours, Select the Search & Reporting app, Enter the search query for the error, Run the search.

Answer

Enter the search query for the error, Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search.

Answer

Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search, Enter the search query for the error.

Question 9

Which TWO of the following are best practices when creating a data model in Splunk? (Choose two.)

Accepted Answer

Test the data model on a sample of data before deploying widely.. Testing a data model on a sample of data before deploying widely validates that the root events, fields, and constraints produce accurate and expected results. This practice prevents performance degradation and incorrect reporting in production by catching issues like missing fields or overly broad constraints early, aligning with Splunk's recommended iterative development approach.

Answer

Add many calculated fields to reduce the need for extra searches.

Answer

Only create data models after a search is written to confirm the need.

Answer

Include as many constraints as possible to filter events.

Question 10

The exhibit shows a savedsearch.conf stanza. What is the effect of the setting `displayview = flashtimeline`?

Accepted Answer

It sets the default view to the timeline chart when the search is opened.. `displayview` specifies the default view for displaying search results in Splunk Web; `flashtimeline` refers to the timeline chart, so this setting makes the timeline the default view when the search is opened. Option A is incorrect because `displayview` does not configure the time picker. Option B is incorrect because it does not limit results; it only sets the display view. Option D is incorrect because it does not add an overlay; it sets the default view to the timeline chart.

Answer

It configures the time picker to show the last 30 days.

Answer

It limits the search results to only timeline events.

Answer

It adds a flash timeline overlay to the search results.

Question 11

What is the purpose of this search?

`index=web | top limit=5 status`

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The stem does not include the search query, but based on the options, the correct answer is C because it is the only option that describes a valid outcome of a search using the `top` command to find the most common HTTP status codes. Options A, B, and D are incorrect as they describe sorting or filtering behaviors that are not standard for a single search without additional commands.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 12

A dashboard designer adds a radio button input to filter by department. When a user selects a department, the panel does not update. What is the most likely cause?

Accepted Answer

The search string does not include a token referencing the input. A radio button input in Splunk dashboards generates a token when selected, but the search string must explicitly reference that token using the $token_name$ syntax. Without this token reference in the search, the panel will not re-run with the selected department value, so the dashboard appears unresponsive.

Answer

The radio button input is not configured with a default value

Answer

The token name in the search does not match the input's token name

Answer

The input's label field is empty

Question 13

A Splunk administrator notices that a data model acceleration summary is not updating as expected. The data model is accelerated with a summary range of 30 days. What is the most likely cause of this issue?

Accepted Answer

The summary index is not writable due to insufficient disk space.. Data model acceleration relies on a summary index to store pre-computed results. If the disk hosting that summary index is full, the acceleration process cannot write new data, causing the summary to stop updating. Splunk will log errors related to disk space, and the acceleration status will show as stalled or incomplete.

Answer

The data model is based on a time range older than the summary range.

Answer

The data model includes calculated fields that are not search-time extractable.

Answer

The data model acceleration is configured to run only on real-time searches.

Question 14

A search uses a lookup to enrich results with a field 'status'. After the lookup, some events have empty status values. The lookup file contains a mapping for all possible status codes. What is a likely reason for empty values?

Accepted Answer

The lookup field name in the event does not match the lookup key.. The lookup command matches a field in the event (the lookup key) against a field in the lookup file. If the field name in the event does not exactly match the lookup key field name in the lookup file, no match occurs, and the output field (e.g., 'status') remains empty. This is a common misconfiguration when the lookup key field is misspelled or has a different case.

Answer

The events are not indexed.

Answer

The lookup command uses output_fields incorrectly.

Answer

The lookup file has duplicate keys.

Question 15

Which THREE of the following are true about lookups in Splunk? (Choose three.)

Accepted Answer

A lookup can be defined using a CSV file. Splunk allows you to define a lookup using a static CSV file stored in the lookups directory of an app. This CSV file acts as a lookup table that maps fields in your events to additional fields, enabling field enrichment without modifying the original data.

Answer

Lookups are case-insensitive by default

Answer

Lookups can only return a single field