SPLK-1001 Practice Test 4 — 10 Questions

Question 1

A Splunk user wants to see the list of fields that are defined in a lookup table named 'assets' without running a search. Which command should they use?

Accepted Answer

| inputlookup assets. The correct command is `| inputlookup assets` because it retrieves the contents of a lookup table named 'assets' without requiring a base search. This command is specifically designed to read lookup files directly, returning all fields and rows. It allows users to inspect the lookup table's schema and data without running a search over indexed data.

Answer

| lookup assets

Answer

| stats values(*) as * by *

Answer

| fields assets

Question 2

A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?

Accepted Answer

Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches. Exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.

Answer

Create a search-time field extraction that parses the dest_ip to derive owner and department

Answer

Increase the number of indexers to parallelize the lookup operations

Answer

Use the 'lookup' command with a KV Store lookup that is populated from the database in real time

Question 3

A data model for web traffic has a child dataset 'Error_Pages' that should only include events with status code 5xx. The admin wants to ensure that when the data model is used with tstats, only these events are searched. Which definition should they use in the data model?

Accepted Answer

Add a constraint: status>=500 AND status<=599. Constraints in a Splunk data model define the base search that restricts which events are included in a child dataset. By adding a constraint of `status>=500 AND status<=599`, the Error_Pages dataset will only contain events with HTTP status codes in the 5xx range. When `tstats` is used against this dataset, it automatically respects the constraint, ensuring only those events are searched without needing additional filters at query time.

Answer

Add a filter: status>=500 AND status<=599

Answer

Use a tag: error_tag for status>=500

Answer

Use a calculated field: error=(status>=500)

Question 4

Which THREE of the following are valid uses of the stats command?

Accepted Answer

stats avg(response_time) as avg_time. Option B is correct because stats supports statistical aggregation functions such as avg() with an optional as clause to rename the resulting field, so stats avg(response_time) as avg_time is a valid use. Option C is correct because stats sum(bytes) by source applies the sum() aggregation function grouped by the source field, which is a standard stats usage. Option D is correct because stats count by host uses the count aggregation function with a by clause to group results by host, a canonical stats pattern. Option A is not valid because eval() is not an aggregation function and cannot be used inside stats; eval is a separate command for calculating expressions. Option E is not valid because table is a separate command, not a stats function, so stats table user is not a legitimate stats invocation.

Answer

stats eval(x=1) by category

Answer

stats table user

Question 5

A Splunk admin is troubleshooting a slow report that uses an accelerated data model. The report uses tstats commands and filters on a field that is not a constraint field in the data model. Which of the following best explains why the report is slow?

Accepted Answer

The field used in the filter is not defined as a constraint field in the data model, so tstats cannot use acceleration for that filter.. C is correct because `tstats` relies on acceleration summaries that are built only for fields defined as constraint fields in the data model. When a filter is applied on a non-constraint field, `tstats` cannot use the pre-computed acceleration summary and must fall back to scanning the raw events, which significantly degrades performance.

Answer

The acceleration summary for that data model has not been rebuilt recently, causing outdated data.

Answer

The report is using the data model incorrectly; it should use |datamodel instead of |tstats.

Answer

The time range is too broad, causing the acceleration summary to include too many events.

Question 6

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. Option A is correct because the stats command is Splunk's primary aggregation command, computing summary statistics such as count, sum, avg, min, max, dc (distinct count), and many other statistical functions over the result set. Option E is correct because stats supports a by clause (e.g., `stats count by host`) to group results by one or more fields, and those by fields must already exist in the search results for the grouping to work. Option B is incorrect because listing individual events is the job of commands like table or raw event display, not stats, which collapses events into aggregated rows. Option C is incorrect because creating new fields is done with eval, not stats, which only aggregates existing fields. Option D is incorrect because stats works with non-numeric fields too, for example count, dc, values, and list operate on string fields.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 7

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

Accepted Answer

Add an index to the lookup file by converting to KV Store. To improve performance with a large CSV lookup (200,000 rows), converting it to a KV Store (Option C) is the best choice because KV Store lookups are indexed, making field matching much faster than searching the entire CSV file each time. Option A (external lookup) is wrong because querying a database adds network and database overhead, often slowing performance further. Option B (increasing timeout) does not speed up the lookup; it only prevents timeouts during long operations. Option D (increasing max_matches) controls how many matching results are returned, but does not affect the speed of the lookup operation itself.

Answer

Switch to an external lookup that queries a database

Answer

Increase the lookup timeout value

Answer

Increase the max_matches setting for the lookup

Question 8

Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?

Accepted Answer

Stacked column chart. A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.

Answer

Line chart

Answer

Pie chart

Answer

Scatter chart

Question 9

Which TWO of the following are valid ways to access the Search & Reporting app in Splunk Web? (Choose two.)

Accepted Answer

Click the 'Search & Reporting' link on the Splunk Home page.. Option A is correct because the Splunk Home page lists the installed apps, including Search & Reporting, as clickable links that launch the app directly. Option C is correct because the Apps menu in the top navigation bar lets users switch between installed apps, and Search & Reporting appears there as a selectable app. Option B is incorrect because Settings > Search does not exist as a navigation path for launching the Search & Reporting app; Settings contains configuration items such as licensing, users, and indexes. Option D is incorrect because typing 'search' in the browser address bar performs a web search or invalid URL entry, not navigation within Splunk Web. Option E is incorrect because the Help menu provides documentation and support links, not a Search Assistant for opening the Search & Reporting app.

Answer

Navigate to Settings > Search.

Answer

Type 'search' in the browser address bar.

Answer

Open the Search Assistant from the Help menu.

Question 10

A Splunk administrator notices that a data model acceleration summary is not updating as expected. The data model is accelerated with a summary range of 30 days. What is the most likely cause of this issue?

Accepted Answer

The summary index is not writable due to insufficient disk space.. Data model acceleration relies on a summary index to store pre-computed results. If the disk hosting that summary index is full, the acceleration process cannot write new data, causing the summary to stop updating. Splunk will log errors related to disk space, and the acceleration status will show as stalled or incomplete.

Answer

The data model is based on a time range older than the summary range.

Answer

The data model includes calculated fields that are not search-time extractable.

Answer

The data model acceleration is configured to run only on real-time searches.