SPLK-1001 Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. A Splunk analyst wants to find the top users generating syslog events. If the analyst wants to include all users, not just the top 5, which command modification is correct?

Accepted Answer

Change to stats count by user. The `top` command returns the most common values up to a limit (default 10). Removing `limit=5` restores the default limit of 10, but still does not include all users. In contrast, `stats count by user` counts events for each user without any limit, thereby including all users. Therefore, option B is the correct modification to include all users.

Answer

Replace top with rare

Answer

Add useother=t

Answer

Remove limit=5

Question 2

A user wants to see a visual representation of search results over time. Which tab should they use?

Accepted Answer

Visualizations. The Visualizations tab is the correct choice because it provides a graphical representation of search results, such as charts, graphs, and time-series plots, which are essential for visualizing trends over time. In Splunk, after running a search, the user can switch to the Visualizations tab to select from various chart types (e.g., line, column, area) that automatically map the _time field to the x-axis, enabling temporal analysis. This tab is specifically designed for transforming tabular search results into visual formats, making it the appropriate tool for seeing data over time.

Answer

Patterns

Answer

Events

Answer

Statistics

Question 3

A user runs a search but sees zero results. What is the most common cause for this?

Accepted Answer

The time range picker is set to a period with no data.. The most common cause for zero search results in Splunk is that the time range picker is set to a time period that contains no indexed data. By default, Splunk restricts searches to the selected time range, and if no events were indexed during that window, the search returns zero results regardless of the query syntax or index selection.

Answer

The search did not specify an index.

Answer

The source type is incorrect.

Answer

The search syntax contains a typo.

Question 4

A junior analyst creates a dashboard to monitor server CPU usage. The dashboard contains a single panel with a line chart showing CPU percentage over the last 24 hours. The analyst then adds a second panel that displays the same data but as a single value showing the average CPU. Both panels use the exact same search string. The dashboard loads slowly, and users complain of wait times. The analyst wants to improve performance without changing the displayed data. Which course of action is best?

Accepted Answer

Convert the dashboard to use a base search and post-process the panels. Using a base search with post-process searches allows both panels to share a single dataset, reducing redundant search execution. Instead of running the same heavy search twice, the base search runs once, and each panel applies lightweight post-processing (e.g., timechart vs. stats) on the cached results. This directly addresses the slow load time without altering the displayed data.

Answer

Keep both panels but add more resources to the Splunk server

Answer

Remove the single value panel and embed its value in the line chart title

Answer

Enable report acceleration on one of the panels

Question 5

An admin wants to add a new data input for a network device sending syslog. Under which Settings menu would the admin navigate?

Accepted Answer

Settings > Data Inputs. To add a new data input for a network device sending syslog, the admin must navigate to Settings > Data Inputs. This is the central location in Splunk Web where you configure how data enters the Splunk platform, including TCP/UDP ports for syslog, file monitoring, scripted inputs, and modular inputs. Syslog data is typically ingested via a UDP or TCP input on port 514, which is configured under Data Inputs.

Answer

Settings > Knowledge

Answer

Settings > Alerts

Answer

Settings > Reporting

Question 6

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

Accepted Answer

eval. The `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Answer

fields

Answer

convert

Answer

rex

Question 7

A user wants to view the contents of a lookup table file named `users.csv` that is stored in Splunk. Which two commands can be used? (Choose two.)

Accepted Answer

`| inputlookup users.csv`. Option A is correct because `inputlookup` is the Splunk search command that reads the contents of a lookup file and returns them as search results, and specifying the filename `users.csv` directly is a valid way to reference the lookup. Option B is also correct because `inputlookup` accepts the lookup definition name (here `users`), so `| inputlookup users` returns the same table contents when the lookup is defined with that name. Option C is wrong because `fields` only includes or excludes fields from the current result set and cannot read a lookup file. Option D is wrong because `outputlookup` writes results to a lookup file rather than displaying its contents. Option E is wrong because `lookup` enriches events by matching fields against a lookup, not by returning the lookup table itself.

Answer

`| fields users.csv`

Answer

`| outputlookup users.csv`

Answer

`| lookup users.csv`

Question 8

Which TWO methods can be used to create a new field in a search?

Accepted Answer

rex field=raw "(?pattern)". Option C is correct because the rex command extracts a new field at search time using a regular expression with a named capture group, e.g. rex field=raw "(?pattern)", which creates new_field from the matched text. Option E is correct because the eval command creates or overwrites a field by assigning the result of an expression, e.g. eval new_field = some_expression, which is the standard way to derive a calculated field in a search. Option A is incorrect because search new_field=* only filters events where new_field already exists; it does not create the field. Option B is incorrect because timechart count by date is an aggregation/visualization command that produces a time-series chart, not a new field definition. Option D is incorrect because stats count by host is also an aggregation that groups results by the existing host field and does not create a new field.

Answer

search new_field=*

Answer

timechart count by date

Answer

stats count by host

Question 9

Drag and drop the steps to configure Splunk to use LDAP authentication into the correct order.

Accepted Answer

Select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles, then test the LDAP configuration.. LDAP setup involves selecting the method, configuring server details, mapping groups, and testing.

Answer

Map LDAP groups to Splunk roles, then configure LDAP server settings, then select LDAP as authentication method, then test the LDAP configuration.

Answer

Test the LDAP configuration, then select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Answer

Select LDAP as authentication method, then test the LDAP configuration, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Question 10

Match each search mode to its behavior.

Accepted Answer

Fast mode: Returns only fields referenced in the search, improving performance.. Splunk search modes: Fast returns only search-referenced fields; Smart dynamically selects fields; Verbose returns all fields. Confusing these leads to incorrect expectations about performance and output.

Answer

Fast mode: Returns all fields for each event.

Answer

Verbose mode: Returns only fields referenced in the search.