SPLK-1001 Practice Questions 2 — 50 Questions

Question 1

An analyst wants to save a search so that they can run it again with a single click in the future. Which action should they take?

Accepted Answer

Click 'Save As' and choose 'Report'.. Saving a search as a Report in Splunk creates a persistent, reusable search that can be executed with a single click from the Reports listing or dashboard. Reports store the search string, time range, and view format, allowing the analyst to run the exact same search without re-entering the query. This directly meets the requirement of running the search again with a single click in the future.

Answer

Click the 'Share' button and copy the search URL.

Answer

Click the 'History' button to see past search strings.

Answer

Click 'Save As' and choose 'Alert'.

Question 2

A search uses a lookup that returns a field 'priority'. The admin wants to use the lookup only for events where the 'source' is 'firewall'. Which command should be used?

Accepted Answer

source=firewall | lookup priority_lookup source OUTPUT priority. It first filters events with `source=firewall` using a search-time field filter, then applies the `lookup` command only to those events. This ensures the lookup is performed exclusively on firewall events, minimizing resource usage and avoiding unnecessary lookups on other sources.

Answer

| lookup priority_lookup source OUTPUT priority

Answer

| lookup priority_lookup source OUTPUT priority | where source="firewall"

Answer

| lookup priority_lookup source OUTPUT priority WHERE source="firewall"

Question 3

A data model includes a root event called `Authentication` with a constraint `action=*`. Which of the following is a valid reason to add a child dataset?

Accepted Answer

To define a subset of events with a specific field value, like `action=failure`.. A child dataset in a Splunk data model is used to define a subset of events from the root event based on specific field values or additional constraints. In this case, adding a child dataset with `action=failure` filters the `Authentication` root events to only those representing failed authentication attempts, enabling focused analysis without altering the root event's definition.

Answer

To enable acceleration for the root event.

Answer

To add additional constraints to the root event.

Answer

To add calculated fields to the root event.

Question 4

A large enterprise is using Splunk Enterprise to monitor web server logs from 200 servers. The logs are forwarded via a heavy forwarder cluster. Recently, a user has reported that when they log into Splunk Web and navigate to the Search & Reporting app, the search bar is empty, and they cannot see any data. The user has confirmed that other users can see data and run searches. The user is part of the 'power' role. The queries for the web server logs use the index 'web_logs'. The user can see the index in the Data Summary. The user has cleared the browser cache and tried a different browser, but the issue persists. What is the most likely cause of this issue?

Accepted Answer

The user's search time range is set to a timeframe before any data was indexed.. The most likely cause is that the user's search time range is set to a timeframe before any data was indexed, resulting in an empty search bar and no visible data. Since the user can see the index in Data Summary and other users can search successfully, permissions and browser issues are ruled out. The time range picker directly controls what data is returned.

Answer

The user's account lacks read permission on the index 'web_logs'.

Answer

The browser is blocking Splunk Web from communicating with the search heads.

Answer

The 'power' role is restricted from running searches on the 'web_logs' index.

Question 5

After running a search, an analyst sees a timeline graph at the top of the results. What is the primary purpose of the timeline?

Accepted Answer

To show the distribution of events over time and allow selecting a time range.. The timeline graph in Splunk displays the count of events over time, allowing analysts to quickly identify patterns, spikes, or gaps in the data. Its primary purpose is to show the distribution of events across the time range and to enable interactive selection of a specific sub-time range for further analysis, which is essential for narrowing down results.

Answer

To list the fields extracted from the events.

Answer

To indicate which data sources contributed to the results.

Answer

To display statistical summaries of the search results.

Question 6

A large enterprise uses Splunk across 50 indexers and a search head cluster. An analyst reports that a search using a lookup file 'employees.csv' (500 MB, 10 million rows) is extremely slow. The search is: `index=winlogs sourcetype=Security EventCode=4624 | lookup employees.csv account AS User OUTPUT department, manager`. The lookup currently runs on each event, and the entire CSV is loaded into memory on the search head each time. There are about 5 million matching events per day. The company has a separate Identity Management system that updates employee data hourly. The analyst needs the lookup to be fast and up-to-date. Which solution should the Splunk admin implement?

Accepted Answer

Convert the lookup to a KV store collection and use the lookup as a key-value store.. Converting the large, frequently updated CSV lookup to a KV store collection allows Splunk to index the data and perform key-value lookups efficiently without loading the entire file into memory on the search head. The KV store supports real-time updates from the Identity Management system via REST API, ensuring the lookup remains up-to-date while drastically improving search performance for 5 million daily events across 50 indexers.

Answer

Use a static CSV but compress it and use `lookup` command with `| makeresults` approach.

Answer

Increase the `max_mem_usage` setting for the lookup in limits.conf.

Answer

Add a time range early in the search to reduce events.

Question 7

Which TWO of the following must be true for the lookup to return results?

Accepted Answer

The events must contain a field named 'zip_code'.. The `lookup` command matches a field in the event data to a field in the lookup file. For the lookup to return results, the event must contain the field specified as the lookup input field (here, `zip_code`). Without this field in the events, there is no value to match against the lookup file, so no results are returned.

Answer

The events must contain a field named 'county'.

Answer

The lookup must be configured with `inputlookup` instead of `lookup`.

Answer

The lookup file must contain a field named 'city'.

Question 8

A search using index=security sourcetype=windows_security returns events with EventCode=4625. The user wants to find the top 10 source IP addresses. Which search will accomplish this?

Accepted Answer

index=security sourcetype=windows_security | top 10 src_ip. For Windows security events with EventCode 4625, Splunk (with the appropriate TA) automatically extracts the source IP address into a field named `src_ip`. Therefore, the search `index=security sourcetype=windows_security | top 10 src_ip` directly provides the top 10 source IP addresses from all events. The first filter for EventCode=4625 is omitted in this option, but the question stem states that the initial search already returns only those events, so the filter is redundant.

Answer

index=security sourcetype=windows_security EventCode=4625 | rex field=Account "from (\d+\.\d+\.\d+\.\d+)" | top 10 ip

Answer

index=security sourcetype=windows_security EventCode=4625 | top 10 Account

Answer

index=security sourcetype=windows_security EventCode=4625 | table Account | top 10

Question 9

A search is slow and the user wants to check the performance metrics. Which part of the UI provides details like run duration, scan count, and result count?

Accepted Answer

Job Inspector. The Job Inspector is the correct tool because it provides detailed performance metrics for a specific search, including run duration, scan count, and result count. Unlike other UI elements, it exposes internal search execution data such as the number of events scanned, the time taken for each phase, and the final result count, which are essential for diagnosing slow searches.

Answer

Timeline

Answer

Statistics tab

Answer

Search History

Question 10

A security team wants to monitor the count of failed login attempts over the past week. They need a simple at-a-glance number. Which visualization type should they use?

Accepted Answer

Single Value. A Single Value visualization is the correct choice because it displays a single, aggregated number prominently, making it ideal for an at-a-glance metric like the count of failed login attempts over the past week. In Splunk, you can use a stats or timechart command to calculate the total count and then render it as a Single Value, which shows just the number without any trend or distribution detail.

Answer

Line chart

Answer

Bar chart

Answer

Pie chart

Question 11

A user frequently runs a long search and wants to save it as a report. What is the best practice when naming the report?

Accepted Answer

Use a descriptive name that reflects the search purpose. Splunk best practices recommend using descriptive, purpose-reflective names for reports to ensure clarity, discoverability, and maintainability across the organization. A descriptive name helps other users quickly understand the report's intent without needing to open the search, which is critical in shared Splunk environments where reports may be scheduled, alerted upon, or embedded in dashboards.

Answer

Include the user's username in the name

Answer

Include the current date in the name

Answer

Use a generic name like 'Daily Report'

Question 12

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Accepted Answer

Save as alert. In the Splunk Search app, the "Save As" menu exposes three primary destinations for a completed search: "Alert" (A), which creates a saved search configured with alert conditions and trigger actions; "Report" (D), which stores the search and its time range as a reusable saved search for later running or scheduling; and "Dashboard Panel" (E), which adds the current search/visualization directly into a new or existing dashboard. These three are exactly the options the Save As dialog offers, since they map to the saved-search object types Splunk supports from the search bar. Options B (event type) and C (search macro) are not offered from Save As; event types are created via Settings > Event Types (or the "Save As Event Type" action in some contexts, not the standard Save As menu), and search macros are defined under Settings > Advanced Search > Search Macros, so neither belongs here.

Answer

Save as event type

Answer

Save as search macro

Question 13

A newly created dashboard panel is not displaying data, showing only 'No results found'. The search query works correctly in the Search app. What is the most likely cause?

Accepted Answer

The dashboard's time range picker is set to a different range than the search was tested with.. The most common reason a dashboard panel shows 'No results found' despite the search working in the Search app is a mismatch in the time range. The dashboard's time range picker may be set to a different absolute or relative time (e.g., 'Last 15 minutes' vs. 'All time') than the search was tested with, causing the query to return no events within the dashboard's time boundary.

Answer

The dashboard has not been shared with the user's role.

Answer

The search contains a syntax error that is not caught by the dashboard editor.

Answer

The panel is not based on a saved report.

Question 14

Which TWO of the following are valid ways to navigate from a search result to a dashboard?

Accepted Answer

Click 'Open in Dashboard' from the search actions menu (ellipsis).. Option C is correct because the search actions menu (the ellipsis next to the search bar) includes an 'Open in Dashboard' command that lets you immediately place the current search results into a new or existing dashboard panel. Option D is correct because saving the search as a report and then adding that report to a dashboard panel is the standard, supported workflow for reusing a saved search on a dashboard. Option A is incorrect because dragging a field from the Fields sidebar only adds that field to the current search/table, not to a dashboard. Option B is incorrect because there is no 'Dashboard' button on the search bar that performs navigation to a dashboard. Option E is incorrect because right-clicking the timeline does not expose an 'Open in Dashboard' action.

Answer

Drag a field from the Fields sidebar to the dashboard canvas.

Answer

Click the 'Dashboard' button on the search bar.

Answer

Right-click on the timeline and select 'Open in Dashboard'.

Question 15

A user needs to quickly find a specific event from last week. Which navigation method is most efficient?

Accepted Answer

Set the time range picker to 'Last 7 days' before running the search. Setting the time range picker to 'Last 7 days' before running the search is the most efficient way to narrow the dataset to the relevant period. This pre-filtering reduces the index scan to only events within that window, minimizing search time and resource consumption. It directly targets the user's need to find a specific event from last week without requiring post-hoc adjustments.

Answer

Use the 'All Fields' button on the left

Answer

Click on the Timeline histogram to zoom in

Answer

Search without a time range, then use Smart Mode

Question 16

A user wants to add a trend indicator to a single value visualization showing whether the count increased or decreased compared to the previous period. Which feature should be used?

Accepted Answer

Comparison. The Comparison feature in a single value visualization allows you to show a trend indicator (e.g., an up or down arrow) that compares the current value to a previous time period, such as the previous week or month. This directly answers the user's need to see whether the count increased or decreased compared to the previous period. It is configured in the 'Single Value' visualization options under 'Comparison' settings.

Answer

Trendline

Answer

Color coding

Answer

Sparkline

Question 17

Which THREE statements about Splunk lookups are true?

Accepted Answer

Lookups can be defined in the Lookups section of Settings.. Splunk lookups are defined and managed in the Lookups section under Settings > Lookups, where you can upload lookup files, create lookup definitions, and configure automatic lookups. This is the central location for all lookup configuration, including CSV files, KV store collections, and external lookups.

Answer

Lookups are automatically applied to all events in a search.

Answer

Lookups can only be performed on a single field.

Question 18

Which two of the following are best practices when designing Splunk data models? (Choose two.)

Accepted Answer

Avoid using wildcards in field names.. Wildcards in field names can cause performance degradation and ambiguity in data model acceleration. Splunk recommends using explicit, descriptive field names to ensure efficient indexing and query execution, as wildcards force the search-time field extraction to scan more data than necessary.

Answer

Limit the number of fields to no more than 100.

Answer

Avoid time-based constraints to ensure all historical data is searchable.

Answer

Leave constraints undefined to include all events.

Question 19

A dashboard has multiple panels that each use the same base search but apply different aggregate functions. To avoid running the base search multiple times, which technique should be used?

Accepted Answer

Use a base search with post-process panels. Splunk's post-process search feature allows a dashboard to define a single base search that runs once, and then multiple panels can apply different aggregate functions (e.g., stats, timechart) on the results without re-executing the base search. This is achieved by using the `base` and `postprocess` attributes in the dashboard XML or Simple XML, which significantly reduces search overhead and improves dashboard performance.

Answer

Use | savedsearch to reference the base search

Answer

Use | multisearch to combine all aggregations

Answer

Use | map to run the base search for each panel

Question 20

A dashboard panel using a bar chart shows a large number of values on the x-axis, making the chart unreadable. Which dashboard option should be used to limit the number of bars shown?

Accepted Answer

Limit in the chart options. The 'Limit' option in the chart configuration allows you to specify the maximum number of data points (bars) displayed on the x-axis. By setting a limit, you reduce the number of bars shown, preventing overcrowding and making the chart readable. This is a direct control over the cardinality of the x-axis values in Splunk's visualization settings.

Answer

Overlay in the chart options

Answer

Color by field in the chart options

Answer

Stack mode in the chart options