SPLK-1001 Practice Test 8 — 10 Questions

Question 1

A security analyst wants to create a report that shows the count of failed login attempts per user over the last 24 hours, but only for users with more than 5 failures. Which Splunk command sequence should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=main action=failure | stats count by user | where count > 5. It first filters events to only failed login attempts using `index=main action=failure`, then uses `stats count by user` to count failures per user, and finally applies `where count > 5` to keep only users with more than 5 failures. This sequence ensures the count is calculated only on the relevant subset of events and the filter is applied after aggregation.

Answer

index=main action=failure | top limit=5 user

Answer

index=main | stats count by user | where count > 5

Answer

index=main action=failure | stats count by user | search count > 5

Question 2

A Splunk admin notices that a lookup is not matching fields correctly. The lookup file has a header row with field names. The search uses `lookup usernames.csv user_id OUTPUT username`. Some events have `user_id` values that exist in the lookup but no match occurs. What is the most likely cause?

Accepted Answer

The lookup file has leading or trailing spaces in the matching column.. Leading or trailing spaces in the lookup file's matching column prevent exact string matching. When Splunk performs a lookup, it compares the field value from the event with the lookup file value using an exact string match. If the lookup file contains spaces (e.g., '123 ' instead of '123'), the values will not match even though the event's `user_id` appears correct. This is a common data quality issue in CSV files.

Answer

The lookup file is missing the header row.

Answer

The lookup is case-sensitive and the search field has different case.

Answer

The lookup file has quotes around field values that are not stripped.

Question 3

A lookup definition is configured with a very large CSV file. The lookup performs slowly. Which change would most improve performance?

Accepted Answer

Ensure the lookup field in the file is the first column.. Splunk's lookup command performs a linear scan of the CSV file to find matching values. By placing the lookup field as the first column, Splunk can use an internal optimization that reduces the search space, as it can quickly locate the matching row without scanning the entire file. This is the most effective single change for improving performance with a large CSV-based lookup.

Answer

Use inputlookup instead of lookup.

Answer

Add an index to the lookup file.

Answer

Convert the CSV to a TSV.

Question 4

Which of the following are valid reasons to use a lookup in Splunk? (Choose two.)

Accepted Answer

To enrich events with additional information from an external source.. A lookup in Splunk enriches events by adding fields from an external source, such as a CSV file, KV store, or scripted lookup, based on a matching field in the event. This allows you to bring in contextual data (e.g., user names, device details) without modifying the original raw data.

Answer

To create new fields using the eval command.

Answer

To alias field names permanently.

Answer

To change the timestamp format of events.

Question 5

An analyst wants to see all field names and their types from a search result. Which command can be used?

Accepted Answer

fieldsummary. The `fieldsummary` command returns a table listing all field names, their types (e.g., number, string), and basic statistics (count, distinct count) from the search results. This directly meets the analyst's requirement to see field names and their types without manually inspecting raw events.

Answer

fields *

Answer

eval

Answer

rex

Question 6

An analyst needs to create a lookup file. Which TWO methods can be used?

Accepted Answer

Upload a CSV file via the Lookups UI.. The Lookups UI in Splunk Web provides a direct method to upload a CSV file and create a lookup table file (static lookup) without needing to write any commands. Option E is correct because the `outputlookup` command writes the results of a search directly into a lookup file, creating or appending to a lookup definition. Both are standard methods for creating lookup files in Splunk.

Answer

Use inputlookup command.

Answer

Use rex to parse and then outputcsv.

Answer

Use eval to create a table and then export.

Question 7

Which THREE best practices should be followed when creating dashboards for a large organization with many users?

Accepted Answer

Use scheduled searches instead of real-time to reduce load. Scheduled searches run at defined intervals and cache results, reducing the load on indexers and search heads compared to real-time searches that continuously stream data. This is especially important in large organizations with many users, as real-time searches can consume significant system resources and degrade performance for all users.

Answer

Use multiple base searches per panel for flexibility

Answer

Use exclusively real-time searches for up-to-date data

Question 8

An analyst creates a dashboard with multiple panels. One panel shows a table of top users by login count. The analyst wants to add a second panel that updates based on the user clicked in the first panel. Which feature should be used?

Accepted Answer

Enable drilldown on the first panel to set a token, and reference that token in the second panel's search.. Drilldown in Splunk allows you to pass context from one panel to another by setting tokens when a user clicks on a value. The first panel's drilldown can set a token (e.g., `$clicked_user$`) which is then referenced in the second panel's search using `| search user=$clicked_user$`. This enables dynamic filtering without requiring separate reports or manual interaction.

Answer

Schedule the first panel as a report and the second as a related report.

Answer

Use the same chart type for both panels to ensure consistency.

Answer

Set both panels to use the same time range picker.

Question 9

A security analyst creates a report that shows the count of failed login attempts by user over the last 7 days. The report uses the `top` command. However, the report only shows the top 10 users, but the analyst wants to see all users. What should the analyst do?

Accepted Answer

Add the `limit=0` argument to the `top` command.. The `top` command in Splunk defaults to showing the top 10 results. Adding `limit=0` removes this limit, displaying all users with failed login attempts. This is the correct approach because `top` already counts occurrences and sorts them, so the analyst only needs to override the default limit.

Answer

Use the `rare` command instead.

Answer

Change the time range to include more data.

Answer

Use the `stats count by user` command and sort descending.

Question 10

A dashboard panel using a bar chart shows a large number of values on the x-axis, making the chart unreadable. Which dashboard option should be used to limit the number of bars shown?

Accepted Answer

Limit in the chart options. The 'Limit' option in the chart configuration allows you to specify the maximum number of data points (bars) displayed on the x-axis. By setting a limit, you reduce the number of bars shown, preventing overcrowding and making the chart readable. This is a direct control over the cardinality of the x-axis values in Splunk's visualization settings.

Answer

Overlay in the chart options

Answer

Color by field in the chart options

Answer

Stack mode in the chart options