SPLK-1001 Practice Test 35 — 15 Questions

Question 1

A team wants to add an interactive time range picker to a dashboard. The dashboard uses a base search with a token for earliest and latest. Which configuration is required?

Accepted Answer

Add input type='time' token='time_tok' and use $time_tok$ in the search. The `input type='time'` element is the standard way to add an interactive time range picker in Splunk dashboards. By setting the `token` attribute to `time_tok` and referencing `$time_tok$` in the base search, the dashboard dynamically passes the selected time range to the search, overriding any static earliest/latest values.

Answer

Set the search's earliest and latest to -1h and now

Answer

Use the built-in time range picker by adding <option> elements

Answer

Add input type='dropdown' token='time' and use $time$ in the search

Question 2

A Splunk administrator is troubleshooting a slow search on firewall logs. The index is 'firewall', sourcetype is 'cisco:asa', and there is about 500 GB of data per day. The search is: index=firewall sourcetype=cisco:asa action=block | stats count by src_ip | where count > 1000. This search takes over 5 minutes to return results. The administrator needs the same results faster. The index has a data model named 'firewall_dm' that is accelerated with a summary range of 7 days. Which change to the search will improve performance the most while still returning the same results?

Accepted Answer

Change to | tstats count from datamodel=firewall_dm where action=block by src_ip | where count > 1000. It uses `tstats` against an accelerated data model, which pre-aggregates data in the summary range (7 days). This avoids scanning raw 500 GB/day of firewall logs, drastically reducing I/O and CPU. The `where` clause in `tstats` filters on the `action` field directly from the accelerated index, returning the same results much faster.

Answer

Add | stats count by src_ip, _time to the search

Answer

Add | fields src_ip before the stats command

Answer

| search action=block instead of placing action=block in the base search

Question 3

A user frequently runs a long search and wants to save it as a report. What is the best practice when naming the report?

Accepted Answer

Use a descriptive name that reflects the search purpose. Splunk best practices recommend using descriptive, purpose-reflective names for reports to ensure clarity, discoverability, and maintainability across the organization. A descriptive name helps other users quickly understand the report's intent without needing to open the search, which is critical in shared Splunk environments where reports may be scheduled, alerted upon, or embedded in dashboards.

Answer

Include the user's username in the name

Answer

Include the current date in the name

Answer

Use a generic name like 'Daily Report'

Question 4

Which THREE of the following are valid reasons to use data models instead of raw searches?

Accepted Answer

To improve query performance through acceleration.. Data model acceleration pre-computes and stores summarized data in the form of a tsidx file, which significantly reduces the time needed to run searches against large datasets. This acceleration is enabled by creating a data model and then running a summary search that populates the acceleration index, allowing subsequent searches to use the pre-aggregated data rather than scanning raw events.

Answer

To provide real-time indexing of data.

Answer

To enforce role-based access control on specific fields.

Question 5

A security team wants to create a data model to analyze authentication events from multiple sources (Windows Event Log, Linux syslog, and VPN logs). The data model should normalize the fields for user, source IP, and action (success/failure). Which Splunk best practice should be applied when designing this data model?

Accepted Answer

Define a single data model that maps fields to the Common Information Model (CIM).. The Common Information Model (CIM) provides a standardized, normalized schema for security events. By mapping fields like user, src_ip, and action to CIM field names, the data model ensures consistent searching and correlation across heterogeneous sources (Windows Event Log, Linux syslog, VPN logs) without per-source customizations. This approach leverages Splunk's built-in CIM add-on to accelerate data model design and maintain interoperability with security analytics apps.

Answer

Use event types to categorize authentication events and then create a data model based on event types.

Answer

Create separate data models for each data source to avoid field conflicts.

Answer

Create field aliases in props.conf for each source to rename fields to a common name, then use a simple data model.

Question 6

Which TWO statements are true about saved reports in Splunk?

Accepted Answer

Saved reports can be used as data sources for dashboard panels.. Saved reports in Splunk can be used as data sources for dashboard panels. When you create a dashboard panel, you can select a saved report as its data source, which allows the panel to display the report's results. This enables reuse of report logic across multiple dashboards without rewriting the search.

Answer

All saved reports automatically send email alerts.

Answer

Saved reports are created exclusively from dashboard panels.

Answer

Saved reports cannot be edited after creation.

Question 7

A security analyst needs to enrich firewall logs with user identity information stored in a CSV file. The CSV file contains fields: user_id, username, department, location. The firewall logs contain a field 'src_user_id'. Which Splunk feature should be used to add the username and department fields to the firewall events based on matching src_user_id to user_id?

Accepted Answer

Define a lookup table from the CSV file and use the input lookup command or automatic lookup to add username and department. A lookup table defined from the CSV file allows Splunk to map the 'src_user_id' field in firewall events to the 'user_id' field in the CSV, then add the 'username' and 'department' fields from the lookup. This is the standard method for enriching events with external data using the 'inputlookup' command or an automatic lookup configuration.

Answer

Create a field alias that maps src_user_id to username and department

Answer

Use the eval command with an if statement to populate username and department from src_user_id

Answer

Create a calculated field that computes username and department based on src_user_id

Question 8

Refer to the exhibit. A Splunk user runs this search against a lookup file containing application error data. The search returns fewer than 10 results. Which is the most likely reason?

Accepted Answer

The search filter 'severity="high"' is too restrictive, resulting in fewer than 10 matching rows.. The search filters for severity='high', which may be a small subset. The head command limits to 10, but if fewer than 10 match, that's all that's returned.

Answer

The inputlookup command only returns the first 10 rows by default.

Answer

The lookup file contains more than 10 rows.

Answer

The table command limits the number of results.

Question 9

A Splunk user needs to perform a lookup that matches events based on a field 'userid' to a lookup table that contains 'userid', 'full_name', and 'email'. The lookup table is a CSV file named 'users.csv' located in the default lookup directory. The user runs the search: index=main | lookup users.csv userid OUTPUT full_name, email. However, the search returns an error that the lookup table 'users.csv' was not found. What is the most likely reason for this error?

Accepted Answer

The lookup command must reference the lookup definition name, not the CSV file name directly. The `lookup` command in Splunk requires a lookup definition name, not the raw CSV filename. The lookup definition is created in Splunk's configuration (e.g., transforms.conf) and maps a logical name to the actual CSV file. Using the filename directly bypasses this definition, causing Splunk to report the file as not found because it searches for a definition, not the file path.

Answer

The CSV file must have a .csv extension, but the command should omit the extension

Answer

The fields 'full_name' and 'email' are not present in the CSV file

Answer

The CSV file is not in the correct format; it should have a header row

Question 10

Which TWO of the following are valid ways to create a field alias in Splunk?

Accepted Answer

Use the INDEXED_EXTRACTIONS setting with an alias directive. The INDEXED_EXTRACTIONS setting in props.conf can include an alias directive (e.g., `alias::=`) to define field aliases directly at index time. This allows you to map an extracted field to an alternative name without modifying the raw data or using search-time operations.

Answer

Use eval to assign a field to another field name

Answer

Use the rename command in a saved search

Answer

Use the aliases command in a search

Question 11

Refer to the exhibit. What will this search return?

Accepted Answer

The 5 most common URI values. The `top` command in SPL returns the most common values of a field, sorted by count in descending order, limited by default to 10 results. Since the search specifies `limit=5`, it returns the 5 most frequent URI values, making option C correct.

Answer

A time chart of URI counts

Answer

A statistical summary of URI lengths

Answer

A list of all URI values

Question 12

Which TWO of the following are valid ways to add data to Splunk?

Accepted Answer

Deploying a universal forwarder to monitor a log file.. A universal forwarder is a dedicated Splunk component designed to collect and forward log data to a Splunk indexer. It monitors specified log files, sends data over a secure TCP connection (default port 9997), and is the standard method for scalable, production-grade data ingestion.

Answer

Creating an alert that writes results to a summary index.

Answer

Using the 'Add Data' button in Splunk Web.

Answer

Typing data directly into the search bar.

Question 13

An analyst runs: index=app sourcetype=log ERROR | stats count by host | where count > 5. What is the function of the where command in this search?

Accepted Answer

Filter the output of stats to show only hosts with count > 5. The `where` command filters the results of the `stats` calculation, keeping only rows where the `count` field exceeds 5. This is a post-processing filter applied after aggregation, not a pre-filter on raw events. The `where` command operates on the output of `stats`, not on the original events.

Answer

Remove duplicate hosts

Answer

Filter events that contain ERROR before counting

Answer

Rename the count field

Question 14

A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?

Accepted Answer

Modify the lookup definition to set case_sensitive_match = false. The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.

Answer

Swap the field order in the lookup command

Answer

Change OUTPUT to OUTPUTNEW to avoid overwriting fields

Answer

Change the index to default

Question 15

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

Accepted Answer

index=web | stats avg(duration) by url_path. The `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Answer

index=web | timechart avg(duration) by url_path

Answer

index=web | chart avg(duration) by url_path

Answer

index=web | eval avg_duration=avg(duration) | stats by url_path