SPLK-1001 Practice Test 2 — 30 Questions

Question 1

Which THREE of the following are capabilities of the rex command?

Accepted Answer

Extract fields using regex named groups.. The `rex` command can extract fields using regex named groups, where the group name becomes the field name and the matched value becomes the field value. This is a core capability of `rex` for field extraction in Splunk.

Answer

Perform case-insensitive extraction by default.

Answer

Set a default value for a field.

Question 2

A large enterprise uses Splunk to monitor 500+ servers. A search returns results slowly due to high data volume. Which best practice can improve performance when using the top command?

Accepted Answer

Add a limit to top, e.g., top limit=20. Adding a limit to the top command (e.g., top limit=20) restricts the number of results returned, reducing the computational load and memory usage. In high-volume environments, this directly improves search performance by limiting the aggregation work Splunk must perform across all 500+ servers.

Answer

Use the fields command to remove unnecessary fields

Answer

Use rare instead of top to reduce output

Answer

Apply the sort command before top

Question 3

A security analyst runs a search that returns many fields, most of which are not needed. Which command should be used to remove all fields except 'src_ip', 'dest_ip', and 'action'?

Accepted Answer

| fields + src_ip, dest_ip, action. The `fields` command with the `+` prefix explicitly keeps only the listed fields and removes all others from the search results. This is the correct way to retain only `src_ip`, `dest_ip`, and `action` while discarding the rest.

Answer

| rename src_ip as src, dest_ip as dest, action as act

Answer

| fields - src_ip, dest_ip, action

Answer

| table src_ip, dest_ip, action

Question 4

Refer to the exhibit. A user runs the search shown. The search returns results, but the user wants to use a data model to make future searches faster and more consistent. Which data model should the user select and what is the correct acceleration setting?

Accepted Answer

Use the CIM Web data model and accelerate the 'Web' dataset.. The search shown uses fields like `status`, `action`, `uri`, and `method`, which are standard fields in the CIM Web data model. Accelerating the 'Web' dataset pre-computes the relevant field extractions and aggregations, making future searches faster and more consistent without requiring the user to manually define field extractions or transformations.

Answer

Use the CIM Web data model and select 'Accelerate All Datasets' from the settings.

Answer

Create a new data model called 'Access' and enable acceleration on root events.

Answer

Use the built-in 'Searches' data model to pre-compute the count and status fields.

Question 5

Which TWO actions increase the performance of a dashboard in Splunk? (Choose two.)

Accepted Answer

Use scheduled reports as base searches. Scheduled reports as base searches pre-compute and cache results, reducing the real-time query load on the indexers when the dashboard loads. This shifts expensive computation to off-peak times, improving dashboard rendering speed.

Answer

Add a large number of drilldowns

Answer

Use real-time searches

Answer

Add multiple time range pickers to the dashboard

Question 6

An administrator notices that a data model is not appearing in the Pivot interface. What is a possible reason?

Accepted Answer

The data model is not shared with the user's role.. The Pivot interface only displays data models that have been explicitly shared with the user's role via permissions. If the data model is not shared, it will not appear in the Pivot editor, regardless of its internal validity or acceleration status. This is a core access control mechanism in Splunk.

Answer

The data model acceleration is disabled.

Answer

The data model contains errors in field definitions.

Answer

The data model has no root datasets.

Question 7

A user has a search that produces a chart of error counts by host. They want to add a calculated field 'error_rate' as errors per million events. Which approach is correct?

Accepted Answer

Use eventstats to get total counts, then eval to compute rate, then chart. It uses `eventstats` to compute the total count of events per host across the entire result set, then `eval` to calculate the error rate as (error_count / total_count) * 1,000,000, and finally `chart` to display the results. This two-step approach ensures the total count is available for each row before the rate calculation, which is necessary because `chart` alone cannot reference a field computed in the same command.

Answer

Use chart eval(error_count/total_count) by host

Answer

Use stats to compute error_rate directly: stats avg(error_rate) by host

Answer

Use the lookup command to apply a calculated field

Question 8

Which THREE of the following are best practices when designing data models in Splunk?

Accepted Answer

Enable acceleration only on data models that are used frequently.. Enabling acceleration on all data models consumes significant disk space and processing overhead. Acceleration should be reserved for data models that are queried frequently to optimize resource usage and query performance. Splunk's acceleration feature pre-computes summaries for the root events and child objects, which is only beneficial when the data model is regularly accessed.

Answer

Design the data model based on the most common reports to ensure quick results.

Answer

Include every possible field in the data model to avoid future modifications.

Question 9

A security analyst runs a search for failed logins and wants to display the source IP address, username, and count of failures. However, the field 'src_ip' is not showing in the field picker. Which of the following is the most likely reason?

Accepted Answer

The field is not extracted by default from the data source.. In Splunk, fields like 'src_ip' are not automatically extracted from raw event data unless the data source has a predefined source type that includes field extraction rules (e.g., via a technology add-on or custom regex). If the field does not appear in the field picker, it typically means the search has not extracted it from the raw events, so the analyst must use commands like `rex` or `extract` to parse it.

Answer

The field has no values in the results.

Answer

The user does not have permission to view the field.

Answer

The field name contains a typo.

Question 10

Match each index type to its purpose.

Accepted Answer

Main index: Stores all indexed events by default.. The main index stores all default events. Summary indexes accelerate searching by storing pre-computed results. Metrics indexes handle numeric time-series data, and internal indexes contain Splunk operational logs. Common confusions involve mixing up the main and summary indexes.

Answer

Main index: Stores pre-computed results.

Answer

Summary index: Stores all indexed events by default.

Question 11

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Accepted Answer

Save as alert. The 'Save As' menu in the Search app provides direct options to persist search results as an alert, a report, or a dashboard panel. 'Save as alert' (A) creates a scheduled search that triggers actions when conditions are met, which is a core feature for proactive monitoring.

Answer

Save as event type

Answer

Save as search macro

Question 12

A user wants to view the contents of a lookup table file named `users.csv` that is stored in Splunk. Which two commands can be used? (Choose two.)

Accepted Answer

`| inputlookup users.csv`. `| inputlookup users.csv` reads the contents of a static lookup table file named `users.csv` directly from Splunk's lookups directory. Option B is correct because `| inputlookup users` references the lookup by its defined name in transforms.conf, which maps to the file `users.csv`; this is the standard way to access a lookup that has been configured as a lookup definition.

Answer

`| fields users.csv`

Answer

`| outputlookup users.csv`

Answer

`| lookup users.csv`

Question 13

Drag and drop the steps to create a Splunk dashboard with a single panel into the correct order.

Accepted Answer

Execute search, then Save As > Dashboard Panel, then select or create dashboard, then configure panel settings.. The correct sequence for creating a Splunk dashboard with a single panel is to first execute a search, then save it as a dashboard panel (not as a report), select or create the dashboard, and finally configure the panel settings. This ensures the panel is directly linked to the search and properly placed in the dashboard.

Answer

Create dashboard first, then execute search, then add panel to dashboard, then configure panel settings.

Answer

Execute search, then Save As > Report, then add report to dashboard as panel, then configure panel settings.

Answer

Add panel to dashboard first, then execute search, then save results, then configure panel settings.

Question 14

A financial services company uses Splunk to monitor authentication logs from 500 remote servers. They created a data model named 'Authentication' with 15 fields including 'user', 'src_ip', 'dest_ip', 'action', and 'status'. They enabled acceleration with a summary range of 1 day and set the maximum search time range to 30 days. After one month of operation, searches against the data model that used to complete in seconds now time out after 60 seconds. The average daily log volume is 10 GB. The admin runs | datamodel Audit and discovers that the summary size is approximately 5 GB per day, which is similar to the raw data index size. The search head has 16 GB RAM and 4 CPU cores, and no other resource issues are observed. What is the most likely cause of the performance degradation?

Accepted Answer

Review the data model fields and remove high-cardinality fields from the acceleration or the data model itself.. When the summary size is nearly equal to the raw data volume, it indicates that acceleration is not effectively reducing the data. This typically occurs when the data model includes high-cardinality fields (e.g., 'user', 'src_ip', 'dest_ip') that create too many unique combinations, preventing meaningful summarization. As a result, the acceleration summary remains large, causing searches to time out due to I/O overhead. Option A is incorrect because increasing the summary range would further increase the summary size and worsen performance. Option B is incorrect because search-time vs. indexed extractions do not address the root cause of high cardinality. Option D is incorrect because the number of fields alone is not the issue; it is the high cardinality of specific fields that degrades acceleration efficiency.

Answer

Optimize the underlying searches by using indexed field extractions instead of search-time field extractions.

Answer

Increase the summary range from 1 day to 7 days to reduce the number of summaries.

Answer

Reduce the number of fields in the data model to fewer than 10 to improve acceleration efficiency.

Question 15

An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?

Accepted Answer

The KV Store lookup is cached and not refreshed between searches. The most likely cause is that the KV Store lookup is cached. By default, KV Store lookups are cached per search and only refreshed when the cache expires or at the start of a new search. If analysts run searches within the same cache duration, they may miss recent updates. Option A is not applicable because KV Store lookups are not time-based in the same way as time-based lookups. Option B is incorrect because IP addresses are not case-sensitive; lookup matching is case-insensitive by default. Option C is incorrect because the _raw field is unrelated to lookup functionality. Therefore, the correct answer is D.

Answer

The lookup is configured as time-based and is out of range

Answer

The IP addresses are case-sensitive and messy

Answer

The search does not include the _raw field

Question 16

Which of the following are true about creating and managing dashboards in Splunk? (Choose all that apply. There are four correct answers.)

Accepted Answer

A dashboard can include panels based on reports, inline searches, or both.. The four correct statements are: (1) A dashboard can include panels based on reports, inline searches, or both; (2) A dashboard panel can display data using visualizations such as charts, tables, and maps; (3) A dashboard can be created from scratch using the Dashboard Editor without any existing search; (4) When editing a dashboard, you can set permissions to control which users can view or edit it. These are all documented features of Splunk dashboards. The two incorrect statements are false: dashboards do NOT require a saved report (they can use inline searches), and there is no fixed limit of five panels per dashboard.

Answer

Dashboards can only contain up to five panels per dashboard.

Answer

All dashboards must be based on a saved report before they can be created.

Question 17

A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?

Accepted Answer

Use the `| datamodel <model> search` command to preview data and identify missing fields.. The `| datamodel` command allows you to view the underlying data of a data model, which helps identify fields that are not populating correctly. Option B is not the best first step because rebuilding acceleration may be time-consuming and not address the root cause. Option C is incorrect because increasing the acceleration time range does not affect field population; it only caches more data. Option D is incorrect because field extractions in transforms.conf are not directly related to data model field population; the issue is more likely with data model field definitions.

Answer

Rebuild the data model acceleration.

Answer

Increase the acceleration time range.

Answer

Check the field extractions in transforms.conf.

Question 18

When viewing search results, what is the difference between the 'Events' tab and the 'Statistics' tab?

Accepted Answer

Events tab displays raw event data; Statistics tab displays transformed output (statistical tables, charts).. The Events tab displays raw event data, while the Statistics tab displays transformed output such as statistical tables and charts. Option A is wrong because both tabs can filter by time and other fields, not just time. Option B is wrong because both tabs can show data per index or sourcetype; the difference is not about index vs. sourcetype. Option C is wrong because both tabs can show more than 100 events depending on the search and settings.

Answer

Events tab can only filter by time; Statistics can filter by any field.

Answer

Events tab shows data per index; Statistics shows data per sourcetype.

Answer

Events tab shows only the first 100 events, Statistics shows all.

Question 19

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup table in Splunk. The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Answer

The time range is set to a period with no data

Answer

The sort command requires a field name

Answer

The where clause is incorrectly formatted

Question 20

A dashboard designer wants to create a drilldown from one chart to another dashboard. Which TWO actions must be configured? (Select two.)

Accepted Answer

Set the target dashboard's token to accept the drilldown value. Options D and E are correct because for a drilldown from one chart to another dashboard, you must set the source chart's drilldown action to 'link to dashboard' (option E) and configure the target dashboard to accept a token from the drilldown (option D). Option A is incorrect because adding a search command is not required for drilldowns. Option B is incorrect because 'link to search' opens a search, not a dashboard. Option C is not necessary; while dashboard permissions control access, they are not part of the drilldown configuration.

Answer

Add a search command to the chart

Answer

Set the source chart's drilldown to 'link to search'

Answer

Enable dashboard permissions