SPLK-1002 Practice Questions 1 — 50 Questions

Question 1

During a data model acceleration build, the following error appears in splunkd.log: 'Data model acceleration: not enough memory to complete summary build.' Which best practice should the administrator implement to prevent this error?

Accepted Answer

Increase the memory allocation for the data model acceleration process.. Option B is correct because the error 'not enough memory to complete summary build' indicates that the data model acceleration process has exhausted its allocated memory. Increasing the memory allocation for the data model acceleration process (via the limits.conf or the data model acceleration settings) directly addresses this resource constraint, allowing the summary to build successfully.

Answer

Remove unnecessary fields from the data model to reduce complexity.

Answer

Reduce the summary range to less than 7 days.

Answer

Use tstats instead of data model acceleration for queries.

Question 2

Which TWO are best practices for creating data models in Splunk? (Choose two.)

Accepted Answer

Use data model acceleration to improve query performance on large datasets.. Option A is correct because data model acceleration pre-computes and stores aggregated data in the form of summaries (TSIDX files), which dramatically reduces query latency on large datasets by avoiding full scan of raw events. This is a best practice for optimizing performance when using data models in Splunk.

Answer

Base data models on indexed fields rather than search-time extracted fields.

Answer

Create many-to-many relationships between root events and child datasets.

Answer

Include all available fields to ensure maximum flexibility.

Question 3

A user reports that a data model acceleration is consuming excessive disk space on the indexer. The data model has a summary range of 90 days. Which action is best to reduce disk space usage while maintaining acceptable query performance?

Accepted Answer

Reduce the summary range to 30 days.. Reducing the summary range from 90 days to 30 days directly decreases the amount of data that the acceleration precomputes and stores on the indexer. This minimizes disk space consumption while still accelerating queries for the most recent, commonly accessed data. Maintaining a shorter summary range ensures acceptable performance for recent queries without the overhead of storing summaries for older, less frequently accessed time periods.

Answer

Increase the acceleration frequency to rebuild summaries more often.

Answer

Disable acceleration for the data model.

Answer

Delete old indexed data that is not frequently queried.

Question 4

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

Accepted Answer

Search bar in the Search & Reporting app. The Search bar in the Search & Reporting app is the primary interface for running ad-hoc searches across all indexed data. By entering the suspicious IP address directly into the search bar, the analyst can quickly retrieve all events containing that IP from any log source, leveraging Splunk's search-time field extraction and index-time data ingestion.

Answer

Data Summary

Answer

Dashboard panel

Answer

Alert action

Question 5

A search includes the command '| stats dc(user) by host'. What does this command return?

Accepted Answer

The number of distinct users per host. The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Answer

The number of unique hosts per user

Answer

The count of events per host

Answer

The sum of user values per host

Question 6

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. Option D is correct because it filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 7

You are a Splunk admin for a large enterprise with multiple distributed Splunk components. The security team frequently runs searches that use a large CSV lookup file (500MB) containing threat intelligence indicators. They report that searches are slow and sometimes time out. The lookup file is updated hourly via an automated script. The team currently uses the 'lookup' command in every search. You need to improve performance without sacrificing data freshness. Your environment has a search head cluster and indexer cluster. The lookup file is stored on a shared filesystem accessible to all search heads. Which single approach will best improve search performance while maintaining hourly updates?

Accepted Answer

Configure the lookup as a time-based lookup with a filter condition to only apply to events with matching IP fields, and use automatic lookup to avoid manual command.. Option A is correct because configuring the lookup as a time-based lookup with a filter condition reduces the number of events that need to be matched against the 500MB CSV, and using an automatic lookup eliminates the need for the manual 'lookup' command in every search. This approach improves performance by limiting the lookup scope to relevant events (e.g., only those with matching IP fields) while still allowing the hourly script to update the CSV file, maintaining data freshness.

Answer

Increase the search concurrency limit on the search head to allow more parallel lookups.

Answer

Convert the CSV to a KV Store collection and use the 'lookup' command with the KV Store lookup.

Answer

Move the CSV file to each indexer and use index-time field lookup.

Question 8

A security team wants to create a data model to analyze authentication events from multiple sources (Windows Event Log, Linux syslog, and VPN logs). The data model should normalize the fields for user, source IP, and action (success/failure). Which Splunk best practice should be applied when designing this data model?

Accepted Answer

Define a single data model that maps fields to the Common Information Model (CIM).. Option C is correct because the Common Information Model (CIM) provides a standardized, normalized schema for security events. By mapping fields like user, src_ip, and action to CIM field names, the data model ensures consistent searching and correlation across heterogeneous sources (Windows Event Log, Linux syslog, VPN logs) without per-source customizations. This approach leverages Splunk's built-in CIM add-on to accelerate data model design and maintain interoperability with security analytics apps.

Answer

Use event types to categorize authentication events and then create a data model based on event types.

Answer

Create separate data models for each data source to avoid field conflicts.

Answer

Create field aliases in props.conf for each source to rename fields to a common name, then use a simple data model.

Question 9

What is the purpose of this search?

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The search uses `top` to find the most common values in the `status` field, limited to 5 results. The `top` command counts occurrences and sorts by count descending, so it returns the 5 most frequent HTTP status codes from the web index. Option C correctly describes this behavior.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 10

A user notices that a calculated field defined in props.conf is not appearing in search results. Which of the following is the most likely cause?

Accepted Answer

The source fields used in the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time based on existing extracted source fields. If the source fields referenced in the calculation are not extracted (e.g., due to missing or incorrect field extraction configurations), the calculated field will not appear in search results. Option B correctly identifies this dependency.

Answer

The calculated field requires index-time field extraction.

Answer

The calculated field is defined in a field alias configuration.

Answer

The indexer is not configured to apply calculated fields.

Question 11

A user wants to create a pie chart showing the distribution of error types from web server logs. Which Splunk command should be used to group the errors before visualization?

Accepted Answer

stats count by error_type. Option D is correct because the `stats count by error_type` command groups the raw events by the `error_type` field and computes the count for each group, producing the structured data needed for a pie chart. A pie chart requires aggregated numerical values per category, and `stats count by` is the standard Splunk approach to create this summary from log events.

Answer

table

Answer

eval

Answer

top

Question 12

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. Option A is correct because a root event in a data model can be constrained using a constraint string, which is a search expression that filters the events included in that dataset. This allows you to define a subset of data for the root dataset without modifying the underlying indexed data.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 13

A security analyst has created a report that shows the count of failed login attempts by user. The analyst now wants to display this data as a column chart on a dashboard. Which Splunk feature should be used to convert the report into a visualization?

Accepted Answer

Use the 'Save As Dashboard Panel' option on the report.. The 'Save As Dashboard Panel' option on a report directly converts the report's search and visualization settings into a dashboard panel, preserving the column chart configuration. This is the intended workflow in Splunk for turning a saved report into a reusable dashboard visualization without manual reconfiguration.

Answer

Schedule the report to run and then export the results as a PDF.

Answer

Convert the report to an alert and then add it to the dashboard.

Answer

Copy the report's search string and paste it into a new dashboard panel.

Question 14

Which TWO of the following are valid ways to add a visualization to a dashboard in Splunk?

Accepted Answer

Create a new panel in the dashboard editor and select a visualization type.. Option B is correct because the dashboard editor in Splunk provides a dedicated workflow to add a new panel and then select a visualization type (e.g., chart, table, map) from the 'Visualization' tab. This is the standard method for building a panel from scratch within a dashboard, allowing you to define the search and choose the appropriate visualization for your data.

Answer

Use the 'Edit' button on an existing panel to change it to a new visualization.

Answer

Export a report as a PDF and upload it as an image panel.

Answer

Set up an alert and configure it to add a panel to the dashboard.

Question 15

An IT operations team has a dashboard with multiple panels showing server metrics. Each panel uses a separate search that runs every time the dashboard is loaded, causing slow performance. What is the best practice to improve dashboard load time?

Accepted Answer

Use a base search and post-process searches for dependent panels.. Option A is correct because using a base search with post-process searches allows multiple dashboard panels to share a single, initial data retrieval. Instead of each panel running its own independent search against the index, they all reference the results of the base search, which runs once. This drastically reduces the number of indexer queries and speeds up dashboard load time, especially when panels share a common data source or filtering criteria.

Answer

Reduce the time range picker to the last 24 hours.

Answer

Combine all searches into one large search and use eval to separate results.

Answer

Add more panels to distribute the data load.

Question 16

Refer to the exhibit. A Splunk user is building a data model for Apache error logs. The configuration above extracts an error_type field. However, when previewing data in the data model, the error_type field is not available. What is the most likely cause?

Accepted Answer

The DEST_KEY is set to _meta, which does not make the field available for data models.. Option D is correct because when DEST_KEY is set to _meta, the extracted field is stored in the internal metadata of the event rather than in the event's indexed fields. Data models rely on indexed fields that are part of the event's key-value structure, so fields stored in _meta are not accessible for data model field extraction or preview.

Answer

The regular expression in transforms.conf is incorrectly formatted.

Answer

The transforms.conf is in the wrong app context.

Answer

The transform name in props.conf does not match the transform name in transforms.conf.

Question 17

A security analyst wants to enrich authentication logs with a lookup table containing user department and manager information. Which TWO statements are true about using lookups in Splunk?

Accepted Answer

The inputlookup command can be used to load a lookup file into a search.. Option B is correct because the `inputlookup` command loads the contents of a static lookup file (e.g., CSV, KV store) directly into a search pipeline as events, allowing the analyst to inspect or further process the lookup data. This is a standard Splunk SPL command used for ad-hoc enrichment without requiring a defined lookup definition.

Answer

Once a lookup is defined, it cannot be updated.

Answer

Lookups can only be created from CSV files.

Answer

Lookups can only match on a single field.

Question 18

Which of the following are true about creating and managing dashboards in Splunk? (Choose all that apply. There are four correct answers.)

Accepted Answer

When editing a dashboard, you can set permissions to control which users can view or edit it.. All four selected options are correct because Splunk dashboards are flexible: they can combine panels from saved reports and inline searches, support multiple visualization types (charts, tables, maps), can be built from scratch using the Dashboard Editor without requiring a pre-existing search, and allow permission settings to control user access and editing rights. These features are core to Splunk's dashboard functionality as documented in the Splunk Dashboard documentation.

Answer

All dashboards must be based on a saved report before they can be created.

Answer

Dashboards can only contain up to five panels per dashboard.

Question 19

A Splunk administrator is configuring a lookup to enrich firewall logs with a static CSV file containing allowed IP ranges. Which TWO statements about lookup configuration are correct?

Accepted Answer

The lookup definition must include the fields to match on from the event data.. Option B is correct because a lookup definition must specify the fields from the event data that will be used to match against the lookup table. This is configured in the 'Lookup definition' settings where you define the input fields (event fields) and output fields (lookup fields). Without this match configuration, Splunk cannot correlate the event data with the CSV file contents.

Answer

A KV Store lookup is required for static tables.

Answer

The lookup is defined in macros.conf.

Answer

The CSV file must be placed in an absolute path on the search head.

Question 20

An administrator notices that a user's search is timing out after 60 seconds. The search needs up to 5 minutes to complete. What should the administrator do?

Accepted Answer

Adjust the 'Search Results Retention' in the user's account preferences.. Option B is correct because the 'Search Results Retention' setting in a user's account preferences controls how long Splunk waits for a search to complete before timing out. By default, this is set to 60 seconds, but increasing it to 5 minutes allows the search to run to completion without being terminated prematurely.

Answer

Reduce the time range of the search to run faster.

Answer

Change the search to a real-time search to avoid timeout.

Answer

Increase the 'Search Timeout' setting in system settings.