SPLK-1002 Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. An analyst receives this error when running a tstats search. Which of the following is the most likely cause?

Accepted Answer

The data model name or dataset is misspelled.. The error message in the exhibit indicates that the tstats command cannot find the specified data model or dataset. This typically occurs when the name provided in the 'datamodel=' argument does not match any existing accelerated data model or dataset in Splunk. Option B is correct because a misspelling or incorrect casing in the data model name or dataset is the most common cause of this specific error.

Answer

The syntax should use 'datamodel' as a separate argument without equals sign.

Answer

The analyst does not have permission to use tstats.

Answer

The data model is not accelerated.

Question 2

A security analyst wants to accelerate a frequently run search that uses the `Authentication` data model. Which best practice should they follow to ensure the acceleration consumes minimal disk space?

Accepted Answer

Use data model acceleration with summarization enabled.. Option A is correct because data model acceleration with summarization enabled pre-computes and stores aggregated results for the `Authentication` data model, which reduces the disk space required compared to storing raw events. Summarization creates compact, time-based buckets of statistical data rather than full event copies, minimizing storage overhead while still accelerating frequently run searches.

Answer

Set the acceleration summary range to include all historical data.

Answer

Disable acceleration and rely on raw search.

Answer

Create a separate index for the data model events.

Question 3

A team is designing a data model for IT operations. They have fields like `src_ip`, `dest_ip`, `user`, and `action`. Which best practice should they follow when naming the root event dataset?

Accepted Answer

Use camelCase, e.g., 'itOperations'.. Option A is correct because Splunk data model root event dataset names must follow camelCase naming conventions to ensure compatibility with the Splunk search language and to avoid parsing issues. CamelCase prevents spaces and special characters that could break field references in searches and data model acceleration.

Answer

Use underscores and numbers for clarity.

Answer

Use a short abbreviation like 'ITOps'.

Answer

Use a generic name like 'events'.

Question 4

A data model includes a root event called `Authentication` with a constraint `action=*`. Which of the following is a valid reason to add a child dataset?

Accepted Answer

To define a subset of events with a specific field value, like `action=failure`.. Option B is correct because a child dataset in a Splunk data model is used to define a subset of events from the root event based on specific field values or additional constraints. In this case, adding a child dataset with `action=failure` filters the `Authentication` root events to only those representing failed authentication attempts, enabling focused analysis without altering the root event's definition.

Answer

To enable acceleration for the root event.

Answer

To add additional constraints to the root event.

Answer

To add calculated fields to the root event.

Question 5

Which TWO of the following are valid ways to create a data model in Splunk?

Accepted Answer

From the Settings menu, select Data Models, then click New.. Option B is correct because Splunk provides a dedicated UI path to create data models: from the Settings menu, select Data Models, then click New. This is the standard method for defining a new data model, allowing you to specify constraints, field definitions, and object hierarchies without using any command-line or search-based approach.

Answer

Run the | makeresults command and pipe to | datamodel.

Answer

Import a CSV file from a lookup and convert it to a data model.

Answer

Use the mksplunk command in the CLI.

Question 6

A large e-commerce company ingests 10 TB/day of web access logs into Splunk. They have enabled the CIM-compliant Web data model and created data model acceleration with a 90-day range. Users run reports using pivot to analyze HTTP status codes, client IPs, and URIs. Recently, two issues arose: (1) Pivot reports are returning incomplete or outdated results, sometimes missing data from the last few hours. (2) Acceleration summary size has ballooned to over 500 GB, causing search head performance degradation. The Splunk admin suspects that data model acceleration is not configured optimally. Upon inspection, the Web data model's root search contains a complex filter with multiple eval commands and lookups, and the acceleration time range is set to the same 90 days as the summary range. The admin also notices that the data model is defined as non-time-based, even though the events have timestamps and the pivot often uses time ranges. What is the best course of action to resolve both issues while maintaining accuracy and performance?

Accepted Answer

Change the data model to time-based, narrow acceleration range to 7 days, and simplify the root search by removing expensive eval/ lookups and using search-time field extractions instead.. Option A is correct because making the data model time-based allows acceleration to use time-bucketed summaries, which ensures recent data is included in pivot results and prevents incomplete results. Narrowing the acceleration range to 7 days reduces the summary size drastically (from 500+ GB to a manageable size), and simplifying the root search by removing expensive eval/lookups improves acceleration build performance and reduces overhead. This directly addresses both issues: incomplete recent data and excessive summary size.

Answer

Change the data model to time-based and set acceleration to 180 days to cover all data.

Answer

Keep the data model as non-time-based but reduce acceleration range to 30 days and add a constraint to filter out irrelevant events.

Answer

Disable acceleration for the Web data model and instead create an accelerated search report for each common pivot query.

Question 7

A Splunk user has created a data model for firewall logs and wants to use it to generate a report showing top source IPs. They attempt to run a search using the data model but receive no results, even though a simple search over the same index returns many events. What is the most likely cause?

Accepted Answer

The data model has not been accelerated, and the user is using |tstats without the 'summariesonly=t' option.. Option B is correct because when a data model is not accelerated, the `|tstats` command cannot query it directly unless the `summariesonly=t` argument is used, which forces the search to look only at accelerated summaries. Without acceleration, `|tstats` returns no results because it expects precomputed summary data. A simple search over the same index works because it queries raw events directly, bypassing the data model's summary structure.

Answer

The user lacks the 'run_data_model' capability.

Answer

The time range is outside the data model's acceleration summary.

Answer

The data model definition contains a syntax error in the constraint field.

Question 8

A user wants to rename the field 'src_ip' to 'sourceIP' in all search results without modifying the raw data. Which method should they use?

Accepted Answer

Use the rename command: | rename src_ip as sourceIP. The `rename` command is the correct choice because it changes the field name in the search results without altering the underlying raw data. It operates on the field metadata in the search pipeline, allowing you to display 'sourceIP' instead of 'src_ip' for the duration of the search.

Answer

Use the eval command to assign src_ip to a new field sourceIP

Answer

Add an alias in props.conf

Answer

Use the fields command: | fields src_ip as sourceIP

Question 9

Which THREE of the following are components of a data model in Splunk?

Accepted Answer

Constraints. Constraints are a core component of a data model in Splunk because they define the filtering criteria that restrict which events are included in the dataset. A constraint is a search expression applied to the root event or child objects to ensure only relevant data populates the data model, making it essential for accurate data model acceleration and pivot reporting.

Answer

Dashboard panel

Answer

Saved search

Question 10

Which TWO of the following are true about KV Store lookups in Splunk?

Accepted Answer

KV Store lookups can be used in automatic lookups. Option C is correct because KV Store lookups can be configured as automatic lookups in Splunk, meaning they can be applied at search time without requiring an explicit lookup command. This is done by defining the KV Store collection as a lookup in transforms.conf and then associating it with a source type or host in props.conf, just like CSV or external lookups.

Answer

KV Store lookups automatically support time-based retrieval

Answer

KV Store lookups are stored as CSV files on the search head

Answer

KV Store lookups only support exact match lookups

Question 11

A lookup table has been defined with `max_matches = 5`. What does this setting do?

Accepted Answer

It limits the lookup to return at most 5 results per event.. Option C is correct because the `max_matches` parameter in a Splunk lookup definition controls how many matching rows from the lookup table are appended to a single event. When set to 5, Splunk will return at most 5 lookup results for each event that matches the lookup criteria, preventing excessive field duplication.

Answer

It limits the number of fields output from the lookup.

Answer

It creates a maximum of 5 lookup files.

Answer

It limits the lookup to match only 5 events.

Question 12

An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?

Accepted Answer

where status = "failed". Option D is correct because the `where` command in Splunk allows you to filter events based on a field value using a comparison expression. In this case, `where status = "failed"` evaluates each event and retains only those where the `status` field exactly matches the string "failed". This is the appropriate command when you need to filter results after the initial search has already been run, or when you need to use comparison operators that are not available in the `search` command.

Answer

table status

Answer

search status=failed

Answer

eval status = "failed"

Question 13

An automatic lookup is configured but it is not enriching events. The lookup file is large (100MB) and is updated daily. What setting could improve performance?

Accepted Answer

Enable `batch_index_lookup = true`. Option B is correct because enabling `batch_index_lookup = true` in transforms.conf allows Splunk to process the entire 100MB lookup file in a single batch operation rather than performing individual lookups for each event. This significantly reduces I/O overhead and improves performance for large, daily-updated lookup files by loading the entire lookup into memory once per batch.

Answer

Set `filter` in transforms.conf

Answer

Increase `max_matches`

Answer

Use `| lookup` instead of automatic

Question 14

A Splunk administrator receives a complaint that a saved search is slow. The search uses a lookup to enrich events with a CSV file that has 500,000 rows. Which optimization is most effective?

Accepted Answer

Filter events early using eval or where before applying the lookup.. Option D is correct because filtering events early with `eval` or `where` reduces the volume of data that must be processed by the lookup command. Since lookups perform a row-by-row match against a 500,000-row CSV, minimizing the number of events before the lookup drastically cuts I/O and CPU overhead, making the search faster.

Answer

Sort events by the lookup key field before the lookup command.

Answer

Convert the CSV lookup to a KV store lookup for faster access.

Answer

Increase the search time range to process more events at once.

Question 15

An administrator notices that an automatic lookup is not being applied to events from a certain sourcetype. The lookup file exists and the configuration in props.conf appears correct. What is a possible reason?

Accepted Answer

The lookup table is defined in transforms.conf incorrectly. Option D is correct because the automatic lookup is defined in props.conf, but the actual lookup table configuration (including the lookup file name, field mappings, and match type) is specified in transforms.conf. If transforms.conf is missing, has a syntax error, or incorrectly defines the lookup (e.g., wrong filename, mismatched field names, or incorrect stanza name), the automatic lookup will fail silently, even if props.conf appears correct.

Answer

Splunk needs to be restarted after adding the automatic lookup

Answer

The lookup file is stored in the wrong directory but referenced correctly

Answer

The lookup field is case-sensitive and the data doesn't match

SPLK-1002 Practice Test 28 — 15 Questions

Exhibit

SPLK-1002 Practice Test 28 — 15 Questions

Exhibit