SPLK-1001 Practice Test 30 — 15 Questions

Question 1

A Splunk admin has a lookup with 10 million rows. The search uses this lookup as a left join and takes too long. Which design change would most improve performance?

Accepted Answer

Filter the main search to only relevant events before the lookup.. Filtering the main search to only relevant events before the lookup reduces the number of rows that need to be matched against the 10-million-row lookup table. This minimizes the computational overhead of the left join operation, as Splunk must compare each event from the main search against every row in the lookup. By narrowing the event set early, you drastically cut the number of comparisons, directly improving search performance.

Answer

Use the 'output' clause to limit returned fields.

Answer

Use an automatic lookup instead of the lookup command.

Answer

Convert the lookup to a KV store collection.

Question 2

Which TWO are best practices for creating data models in Splunk? (Choose two.)

Accepted Answer

Use data model acceleration to improve query performance on large datasets.. Data model acceleration pre-computes and stores aggregated data in the form of summaries (TSIDX files), which dramatically reduces query latency on large datasets by avoiding full scan of raw events. This is a best practice for optimizing performance when using data models in Splunk.

Answer

Base data models on indexed fields rather than search-time extracted fields.

Answer

Create many-to-many relationships between root events and child datasets.

Answer

Include all available fields to ensure maximum flexibility.

Question 3

A financial analyst creates a dashboard in Splunk Web to track daily transaction volumes. The dashboard has three panels: a table of top 10 merchants by transaction count, a bar chart of transactions by hour, and a single value showing total transaction amount. All panels use the same base search from the 'transactions' index. The analyst is in the 'finance' role. The dashboard runs fine in the analyst's session, but when the analyst shares the dashboard with the 'auditor' role, the auditor sees no data in any panel. The auditor role has read access to the dashboard and the 'transactions' index. What is the most likely cause?

Accepted Answer

The base search used in the dashboard's panels is a saved search owned by the analyst, and the 'auditor' role does not have permissions to that saved search. The base search is a saved search owned by the analyst. When a dashboard uses a saved search as its base search, Splunk enforces permissions on that saved search object. Even though the auditor role has read access to the 'transactions' index, if the saved search itself is not shared with the auditor role (e.g., it remains private to the analyst), the dashboard panels will fail to retrieve data for the auditor. This is a common permission scoping issue in Splunk where data access is gated by the saved search object, not just the index.

Answer

The 'auditor' role does not have read access to the 'transactions' index

Answer

The dashboard's permission is set to 'private' and only the analyst can view it

Answer

The dashboard is set to run as the 'finance' role, and the 'auditor' role lacks the 'rbac_perm' privilege

Question 4

A Splunk administrator notices that a data model acceleration summary is consuming excessive disk space on the indexers. The data model is used for a dashboard that refreshes every 30 minutes. What is the best course of action to reduce disk usage while maintaining dashboard performance?

Accepted Answer

Decrease the acceleration time range in the data model definition.. Decreasing the acceleration time range in the data model definition directly reduces the amount of data the summary covers, which lowers disk usage on the indexers. Since the dashboard refreshes every 30 minutes, a shorter acceleration range (e.g., last 7 days instead of 30) still keeps the most recent data pre-computed for fast queries, maintaining performance for the refresh interval.

Answer

Disable data model acceleration and rely on raw data searches.

Answer

Decrease the backfill time for the data model.

Answer

Increase the acceleration time range to speed up summary generation.

Question 5

A junior administrator at a mid-size company is responsible for onboarding new data sources into Splunk. She has been asked to add a custom application log file, which is generated in a proprietary text format. The log file is located on a Linux server that is not a Splunk universal forwarder. The administrator plans to use the Add Data wizard in Splunk Web to monitor this file. However, when she navigates to Settings > Add Data, she does not see the option to 'Monitor a file' but only sees options for 'Upload' and 'Forward'. She is logged in as admin. What is the most likely reason for this?

Accepted Answer

The Add Data wizard only monitors files on the local machine where Splunk is installed.. The Add Data wizard in Splunk Web is designed to monitor files only on the local machine where Splunk is installed. Since the log file resides on a remote Linux server that is not a universal forwarder, the 'Monitor' option does not appear; only 'Upload' (for one-time uploads) and 'Forward' (which typically requires a forwarder) are shown. Option A is incorrect because the admin role has full capabilities, and the issue is not role-based. Option C is incorrect because the license does not affect wizard options. Option D is incorrect because the license volume does not block the monitoring option in the UI.

Answer

The administrator is not using the correct role; only 'power' users can monitor files.

Answer

The 'Monitor' option appears only after purchasing an additional license for inputs.

Answer

The administrator has exceeded the daily license volume and monitoring is blocked.

Question 6

Refer to the exhibit. The lookup file app_versions.csv contains fields 'app' and 'version'. The version values are strings like '1.5', '2.0', '2.1'. What is the issue with this search?

Accepted Answer

Version comparison will not be numeric, giving incorrect results. The issue is that the `where` clause performs lexicographic (string) comparison on the `version` field because the values in the lookup file are stored as strings (e.g., '1.5', '2.0', '2.1'). Since string comparison evaluates character by character, a version like '2.0' would be considered greater than '10.0' because '2' > '1' as a character, leading to incorrect filtering results. To compare versions numerically, you must convert the field to a numeric type using functions like `tonumber()` or parse the version string into comparable components.

Answer

where cannot be used with string comparisons

Answer

inputlookup is not a valid command

Answer

table should be replaced with fields

Question 7

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `top` command automatically removes events with null or empty values for the specified field from the count.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. Importantly, by default, `top` and `rare` include events with null or empty values for the specified field as a separate value, rather than removing them automatically. Therefore, statement D is incorrect. Statements E and F are also false: `rare` can be used on any field, not just regex-extracted; and both commands have default limits (10 results) so the `limit` argument is optional.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Answer

The `rare` command can only be used on fields that have been extracted using regex.

Question 8

An organization needs to enrich authentication events with employee department information stored in a MySQL database. The data is updated frequently. Which lookup type is most appropriate?

Accepted Answer

External lookup. An external lookup is the most appropriate choice for enriching authentication events with data from a MySQL database that is updated frequently. External lookups can execute a script or command (e.g., Python, Perl) that queries the database on every search, or they can be used with Splunk DB Connect to directly connect to MySQL and retrieve fresh data. Unlike KV Store lookups, which rely on manually populating Splunk's internal store and do not natively connect to external databases, external lookups provide real-time access to the live database. CSV lookups are static and require manual reloading, and geographic lookups are for geospatial data only.

Answer

Geographic lookup

Answer

CSV file lookup

Answer

KV store lookup

Question 9

A search uses `| fields - _raw, _time` and then later needs `_time` again. What will happen?

Accepted Answer

The `_time` field is no longer available for later commands.. The `| fields - _raw, _time` command explicitly removes the `_time` field from the search results. Once a field is removed using the `fields` command with a minus sign, it is no longer available for any subsequent commands in the search pipeline. This is because the `fields` command operates on the current working set of events, stripping out the specified fields entirely, and later commands cannot reference a field that has been removed.

Answer

The command removes all fields except _raw and _time.

Answer

The command will cause an error because you cannot remove internal fields.

Answer

The `_time` field will still be available but empty.

Question 10

Refer to the exhibit. What would happen if the eval statement was changed to: eval priority = case(error = "critical", 1, error = "warning", 2, true(), 3)?

Accepted Answer

All events are assigned priority 1. Using assignment `=` instead of comparison `==` in the `case` function causes each condition to evaluate as an assignment. In Splunk eval, assignment returns the assigned value, which is truthy for non-empty strings. The first condition `error = "critical"` is always true, so the first branch is taken for every event, setting `priority=1`. Consequently, the search returns results where every event has priority 1, which differs from the original output where priorities varied. No syntax error occurs.

Answer

The search returns no results

Answer

The search only returns priority 3

Answer

The search returns a syntax error

Question 11

Refer to the exhibit. A user runs this search in Splunk. What will the resulting table include?

Accepted Answer

A row for each hour and a column for each status code, plus a Total column and a Total row. The search uses the `timechart` command with `count by status`. The `timechart` command produces a table with a row for each time bucket (hour) and a column for each distinct value of the `status` field. However, `timechart` does not automatically add a Total column or Total row. In this search, the `addtotals` command is also applied, which adds the Total column (sum across all statuses per row) and the Total row (sum across all time buckets per column). Therefore, the resulting table includes rows per hour, columns per status code, plus a Total column and a Total row.

Answer

A row for each status code and a column for each hour

Answer

A row for each hour and a column for each status code, with no totals

Answer

Only the sum of all events per hour

Question 12

Refer to the exhibit. A user gets an error: 'Error in 'where' command: The field 'count' is not a numeric type.' What is the issue?

Accepted Answer

The 'timechart' command creates multiple 'count' fields for each host, so 'count' is not a single numeric field. When using `timechart count by host`, Splunk creates separate count fields for each host, such as `count: host1`, `count: host2`. Therefore, the field `count` alone is not a single numeric field; it is ambiguous or multivalued. The `where` command requires a single numeric field, so it fails with the error that `count` is not a numeric type.

Answer

The syntax should be 'where count > "100"'

Answer

The 'count' field is a string type

Answer

The 'where' command should be placed before 'timechart'

Question 13

Refer to the exhibit. A user gets this error when running a search with a GeoIP lookup. What is the most likely cause?

Accepted Answer

The lookup file has not been uploaded to Splunk. The error message indicates that Splunk cannot find the lookup table referenced in the search. Option C is correct because the GeoIP lookup file must be uploaded to Splunk (as a CSV or KMZ file) and defined as a lookup table in the lookups.conf configuration before it can be used in a search. Without the file being present in the system, the lookup command fails with a 'lookup table not found' error.

Answer

The user does not have permission to use lookups

Answer

The lookup command syntax is incorrect

Answer

The field name in the lookup does not match the event field

Question 14

After running a search, a user wants to save the search for later use. Which button should they click?

Accepted Answer

Save As. The 'Save As' button in Splunk allows a user to save a completed search as a report, alert, or dashboard panel for later use. This is the standard method for persisting a search definition without executing it immediately, enabling reuse in the future.

Answer

Export

Answer

Share

Answer

Schedule

Question 15

A user wants to save a search for later use but not schedule it. Which action should the user take?

Accepted Answer

Click Save As > Search.. Clicking Save As > Search saves the search string and properties (time range, mode) as a reusable search without any scheduling or alerting. This allows the user to run the search manually later from the 'Searches & Reports' page without it executing on a schedule.

Answer

Click Save As > Report and schedule it.

Answer

Click Save As > Alert.

Answer

Click Save As > Dashboard Panel.