SPLK-1002 Practice Test 37 — 15 Questions

Question 1

You are a Splunk administrator at a financial services company. The company has a distributed Splunk environment with 10 indexers and 2 search heads. You have created a data model named 'transaction_analytics' to analyze financial transactions. The data model is accelerated with a summary range of 7 days. Recently, users have reported that dashboards using this data model are extremely slow, sometimes timing out. You check the acceleration status and see that the summary is 'Building' but never completes. The splunkd.log on the search head shows repeated messages: 'Data model acceleration: query timed out after 300 seconds.' The base search for the data model is: index=transactions sourcetype=fin_events | eval risk_score=if(amount>10000, 'high', 'low') | fields transaction_id, user, amount, risk_score, _time. The data model has one root event with two child datasets: one for high-risk transactions and one for low-risk transactions. The total data volume is about 500 GB per day. The indexer where the summary is built has 16 GB of RAM and the search head has 32 GB. What is the best course of action to resolve the acceleration build timeout?

Accepted Answer

Modify the base search to remove the eval statement and instead use a lookup or index-time field for risk_score.. Option A is correct because the eval statement in the base search forces the acceleration to process every raw event during the summary build, which is computationally expensive and causes the 300-second timeout. By moving the risk_score calculation to index time (e.g., using a calculated field or lookup), the acceleration can use the pre-computed field directly from the indexed data, drastically reducing CPU load and allowing the summary to complete within the timeout window.

Answer

Reduce the summary range to 1 day to limit the amount of data processed.

Answer

Disable acceleration and rely on real-time searches for the dashboards.

Answer

Increase the acceleration.max_time to 600 seconds to allow more time for the build.

Question 2

A medium-sized enterprise uses Splunk Enterprise with a single indexer and one search head. They have 50 universal forwarders sending data from web servers, application servers, and database logs. Recently, the indexer crashed during peak hours. The administrator restarted the indexer and it came back up. After analyzing the crash log, they found that the indexer ran out of memory. The indexer has 16 GB RAM and the default memory settings. The daily indexing volume is about 20 GB. The administrator is concerned about stability. They want to prevent future crashes without adding hardware. What should they do?

Accepted Answer

Reduce the max memory for the indexer process in limits.conf. Option C is correct because the indexer crashed due to running out of memory with 16 GB RAM and default settings. Reducing the max memory for the indexer process in limits.conf (specifically the maxMemMB parameter) limits the heap size used by Splunk, preventing out-of-memory (OOM) kills during peak indexing loads. This is a software-level tuning that avoids hardware upgrades by capping memory consumption to a safe level below the physical RAM.

Answer

Reduce the number of forwarders sending data

Answer

Switch universal forwarders to heavy forwarders

Answer

Increase the max memory for the indexer process in limits.conf

Question 3

You are a Splunk administrator at a mid-sized company that uses Splunk Enterprise to monitor application logs from a web server cluster. The cluster has five servers, each sending logs via a universal forwarder to a single indexer. The indexer has ample resources. Recently, users have complained that searches for the last 24 hours are slow, but searches for the last hour are fast. The data volume is about 50 GB per day. You suspect the issue is related to how data is stored or indexed. Which action should you take first to improve search performance for the 24-hour time range?

Accepted Answer

Exclude internal Splunk logs (splunkd.log) from being indexed by setting up appropriate input configurations on forwarders.. Option C is correct because internal Splunk logs (splunkd.log) can generate significant volume and are indexed by default, consuming resources and slowing searches over longer time ranges. Excluding them on the forwarders reduces the total indexed data, improving search performance for the 24-hour window without affecting application log searches.

Answer

Increase the number of parallel search processes in the indexes.conf settings.

Answer

Add a second indexer and distribute incoming data using load balancing.

Answer

Reduce the retention period for the index from 90 days to 30 days.

Question 4

A large e-commerce company uses Splunk to monitor its web application. They have a data model named 'Web_Transactions' that contains fields: status_code, response_time, uri, user_agent. The data model is accelerated with a 30-day time range. Recently, the operations team reported that the dashboard showing average response time by URI is loading slowly, taking over 30 seconds to display. Upon investigation, you find that the data model acceleration summary job is taking longer to complete and sometimes fails. The indexers have sufficient CPU and memory, but the disk I/O is high during the summary job. The volume of web logs is approximately 500 GB per day. Which action should the Splunk administrator take to improve dashboard performance?

Accepted Answer

Increase the maximum number of parallel searches for the data model acceleration job in the limits.conf.. Option B is correct because increasing the `max_concurrent_parallel_searches` for the data model acceleration job in `limits.conf` allows the summary process to use more parallel searches against the indexers, which can reduce the time it takes to build the acceleration summary. Since the indexers have sufficient CPU and memory but disk I/O is high, parallelizing the search workload can better utilize available resources and prevent the job from timing out, thereby improving dashboard performance.

Answer

Disable data model acceleration and create a report that runs a scheduled search every 30 minutes to pre-compute the averages.

Answer

Add more indexers to distribute the data and reduce the load per indexer.

Answer

Decrease the acceleration time range from 30 days to 7 days.

Question 5

You are a Splunk administrator for a large e-commerce company. The marketing team has a dashboard that displays daily sales metrics, including revenue, number of transactions, and average order value. The dashboard is built using a single search that runs a 'timechart' command across all events. Recently, the dashboard has been timing out and failing to load during peak hours (10 AM - 2 PM) when traffic is highest. The team needs the dashboard to be available with minimal latency. You have the following options:

A. Reduce the time range on the dashboard to the last hour instead of the default last 24 hours.
B. Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.
C. Increase the search time limit in the Splunk settings to allow the search to run longer.
D. Split the single search into multiple smaller searches, each for a different metric, and run them concurrently on separate panels.

Which option best addresses the performance issue while maintaining data accuracy?

Accepted Answer

Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.. Option C is correct because creating a summary index that pre-aggregates sales metrics every hour offloads the heavy computation from real-time searches. The dashboard then queries this smaller, pre-computed dataset, drastically reducing search time and avoiding timeouts during peak hours, while maintaining data accuracy since the aggregation is done on the raw data.

Answer

Split the single search into multiple smaller searches.

Answer

Reduce the time range on the dashboard to the last hour.

Answer

Increase the search time limit in Splunk settings.

Question 6

A Splunk admin is tasked with creating a dashboard that shows the top 10 error codes from application logs. The logs contain a field 'error_code' which is extracted automatically. The admin writes the search: index=app sourcetype=app_log | top limit=10 error_code. The dashboard shows the correct data, but the admin wants to add a drilldown that passes the selected error code to another search. The admin considers using the 'fields' command to keep only error_code, the 'table' command to display the data, the 'eval' command to create a new field, or the 'stats' command to count. Which change should the admin make to the search to enable the drilldown functionality?

Accepted Answer

Replace top with table error_code, count. Option C is correct because the `table` command produces a tabular output that inherently supports drilldown in Splunk dashboards by preserving the raw event data and field values. When you use `table error_code, count`, the dashboard can pass the selected `error_code` value to another search via a token. The original `top` command aggregates data into a statistical summary that does not retain the raw event structure required for standard drilldown behavior.

Answer

Add a stats count by error_code

Answer

Replace top with fields to keep only error_code

Answer

Add an eval command to create a clickable link

Question 7

A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?

Accepted Answer

Modify the lookup definition to set case_sensitive_match = false. The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.

Answer

Swap the field order in the lookup command

Answer

Change OUTPUT to OUTPUTNEW to avoid overwriting fields

Answer

Change the index to default

Question 8

You are an admin for a large healthcare organization that uses Splunk for compliance monitoring. You have a data model named 'Patient_Access' that tracks access to patient records. The data model includes fields like 'employee_id', 'patient_id', 'access_time', and 'action'. The data model is accelerated with a 30-day summary. Recently, a new compliance report requires filtering on a field named 'department', which is not currently part of the data model. You add 'department' as a new field to the root event of the data model. After this change, reports using the data model become slower. The data model's acceleration summary size has significantly increased. What is the most likely reason for the slowdown?

Accepted Answer

Adding the field required the acceleration summary to be rebuilt, and the new field increased the summary size because it is not constrained.. When a new field is added to the root event of an accelerated data model, the acceleration summary must be rebuilt to include that field. Because the 'department' field is not constrained (i.e., it is not part of a constraint that limits which events are included), the summary now stores values for this field across all events, significantly increasing the summary size. This larger summary takes more time to scan and process, causing queries to become slower.

Answer

The data model must be re-accelerated manually after adding a field, and the admin did not do so.

Answer

The 'department' field has a high number of unique values, and the acceleration summary cannot handle high-cardinality fields efficiently.

Answer

The new field caused the root event constraint to become more inclusive, adding more events.

Question 9

A Splunk user wants to see a list of all fields that are extracted from events of sourcetype 'apache_access'. They need to know which fields are available for use in searches and lookups. Which command should they use to discover all fields automatically extracted by Splunk for that sourcetype?

Accepted Answer

Use the search 'sourcetype=apache_access | fields' to list all fields in a few sample events. Option A is correct because the `| fields` command, when used without arguments, lists all fields present in the search results. By searching `sourcetype=apache_access` and piping to `| fields`, Splunk returns a table of all extracted fields (both default and custom) from the events of that sourcetype, allowing the user to see which fields are available for searches and lookups.

Answer

Use the 'extract' command with no arguments to show all extracted fields

Answer

Use the 'regex' command with a capturing group to identify fields

Answer

Use the 'inputlookup' command to display field names

Question 10

A Splunk admin configured a CSV-based lookup to map device IP addresses to location data. The lookup 'devices.csv' has columns 'ip', 'building', 'floor'. In props.conf, they set: `LOOKUP-1 = devices ip OUTPUT building floor`. In transforms.conf: `[devices] filename = devices.csv`. The search over sourcetype 'network_logs' returns events with the 'ip' field, but 'building' and 'floor' are missing. The admin confirms the CSV file exists and has data. What is the most likely issue?

Accepted Answer

The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.. Option A is correct because the `LOOKUP-1` definition in `props.conf` incorrectly includes the match and output fields. The correct syntax is `LOOKUP-1 = devices` only, with the match field (`ip`) and output fields (`building`, `floor`) defined in the `transforms.conf` stanza under `[devices]` using `external_type = csv`, `filename = devices.csv`, `match_type = WILDCARD(ip)`, and `default_match = NONE`. The admin's syntax causes Splunk to ignore the lookup configuration entirely, so no fields are added.

Answer

The CSV file is too large and the lookup is not being loaded.

Answer

The 'ip' field is not properly extracted from the sourcetype.

Answer

The lookup file is not accessible from the search head because it is stored on a different host.

Question 11

A Splunk administrator needs to create a field alias that renames the field 'src_ip' to 'source_ip' for events in the index 'network'. The administrator has created the field alias in the Field Aliases settings in the UI. However, when searching index=network, the new field 'source_ip' does not appear in the events. The search still shows 'src_ip'. What could be the reason?

Accepted Answer

The field alias is configured for a specific sourcetype that does not match the events in the index. Option D is correct because field aliases in Splunk are configured per sourcetype. If the alias is applied to a sourcetype that does not match the events in the 'network' index, the alias will not take effect, and the original field name 'src_ip' will continue to appear. The administrator must ensure the alias is assigned to the correct sourcetype(s) present in the index.

Answer

Field aliases only work with lookups, not with standard fields

Answer

The field 'src_ip' is not extracted automatically; an explicit field extraction is required first

Answer

The alias should be created using the 'rename' command in the search, not via the UI

Question 12

A company has 50 Splunk users in the default 'user' role. The Splunk administrator wants to allow a subset of 5 users to create custom alerts and reports, but not modify data inputs or indexes. The administrator creates a new role called 'analyst' and assigns the 'can_create_alerts' and 'can_create_reports' capabilities. However, when these 5 users log in, they cannot create alerts or reports and receive an error that they 'do not have permission to create alerts'. The administrator verifies that the role has both capabilities. Which of the following is the most likely cause and solution?

Accepted Answer

The users are still assigned to the 'user' role, which does not have the creation capabilities, and the roles are not cumulative unless inheritance is set. Remove users from 'user' role or make 'analyst' inherit from 'user'.. Option B is correct because the role inheritance must be configured: the 'user' role must be inherited or the new role must be assigned instead. Option A wrong because the issue is not with other capabilities. Option C wrong because removing from default role is not necessary. Option D wrong because the error is not about email.

Answer

The 'analyst' role lacks the 'edit_search' capability. Add it to the role.

Answer

The administrator must grant the 'can_create_alerts' capability to the 'user' role.

Answer

The administrator must configure an alert action (e.g., email) before alerts can be created.

Question 13

A junior administrator at a mid-size company is responsible for onboarding new data sources into Splunk. She has been asked to add a custom application log file, which is generated in a proprietary text format. The log file is located on a Linux server that is not a Splunk universal forwarder. The administrator plans to use the Add Data wizard in Splunk Web to monitor this file. However, when she navigates to Settings > Add Data, she does not see the option to 'Monitor a file' but only sees options for 'Upload' and 'Forward'. She is logged in as admin. What is the most likely reason for this?

Accepted Answer

The Add Data wizard only monitors files on the local machine where Splunk is installed.. Option A is correct because the 'Monitor' option is available only when Splunk is running locally on the same machine as the file; the Add Data wizard is for the local Splunk instance. If the file is on a remote server, the admin must use a forwarder. Option B is incorrect because the license does not affect the options in the wizard. Option C is incorrect because admin has full capabilities. Option D is incorrect because the license does not add inputs.

Answer

The administrator is not using the correct role; only 'power' users can monitor files.

Answer

The 'Monitor' option appears only after purchasing an additional license for inputs.

Answer

The administrator has exceeded the daily license volume and monitoring is blocked.

Question 14

A support technician is troubleshooting a user who cannot see the 'Field sidebar' and 'Timeline' in the Search & Reporting app. The user says that when they run a search, they only see the results in a table format, but no side panels or timeline below the search bar. The technician checks the user's settings and finds that the user's default app is set to 'Search & Reporting'. The technician then looks at the user's browser and notices that the user has a very small browser window. What is the most likely cause of the missing panels?

Accepted Answer

The browser window is too small, causing panels to be hidden by the responsive interface.. Option D is correct because Splunk Web responsive design may hide side panels if the browser window is too small; the technician observed the small window. Option A is incorrect because the default app is correct. Option B is incorrect because there is no such setting as 'show timeline' in user preferences. Option C is incorrect because the role does not affect the presence of these UI elements; they are universal.

Answer

The user's default app is set incorrectly.

Answer

The user has disabled the timeline in their preferences.

Answer

The user's role does not have permission to view the timeline.

Question 15

A Splunk administrator is reviewing the 'Add Data' wizard for a new data source. The admin wants to monitor a log file that is located on the same server where Splunk is installed. The admin navigates to Settings > Add Data and selects 'Monitor' and then 'Files & Directories'. In the file list, the admin sees a checkbox next to each file. The admin selects the desired file and clicks 'Next'. However, the wizard does not proceed to the next page; instead, nothing happens. The admin has confirmed that the file exists and is readable. What is the most likely cause?

Accepted Answer

The admin's Splunk Web session has timed out.. Option C is correct because the 'Next' button may be disabled if the file is not valid or the index is not set; but the admin didn't fill in required fields? Actually, the typical flow: after selecting file, you click 'Next' to go to source type settings. But if the file is locked or the index is not set, the button might be grayed. However, most likely the wizard requires a source type selection before proceeding; but the default is 'automatic'. Option A is plausible but a popup would appear. Option B is a common issue: the Splunk Web session may have timed out. Option D is unlikely because the file is local. I'll go with B: session timeout.

Answer

The admin did not select a source type for the file.

Answer

The file is already being monitored by another input.

Answer

The file is too large and Splunk is processing it.