SPLK-1001 Practice Test 9 — 10 Questions

Question 1

After running a search, the Fields sidebar shows several fields but the analyst wants to see all fields. Which button should they click?

Accepted Answer

The gear icon next to 'Selected Fields'. The gear icon next to 'Selected Fields' opens the field list configuration, allowing you to toggle between showing only selected fields or all fields. By default, Splunk displays only the most relevant fields in the Fields sidebar; clicking the gear icon lets you select 'All fields' from the dropdown to display every extracted field for the search results.

Answer

'Add field' button

Answer

'All fields' button

Answer

'Show all fields' checkbox

Question 2

A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?

Accepted Answer

index=web status=404 | top src_ip. It first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.

Answer

index=web status=404 | sort src_ip

Answer

index=web | top src_ip

Answer

index=web status=404 | rare src_ip

Question 3

A security analyst needs to create a report that shows the count of failed login attempts by user over the last 24 hours, updated every hour. The report should be accessible to the SOC team but not to other users. Which sequence of steps should the analyst follow?

Accepted Answer

Run the search, click 'Save As' -> 'Report', set permissions to 'Shared in App' with SOC role, then 'Schedule' hourly.. Splunk reports are saved searches that can be scheduled and have permissions applied. To make the report accessible only to the SOC team, the analyst should set permissions to 'Shared in App' and assign the SOC role, then configure an hourly schedule. This satisfies both the access restriction and the recurring update requirement without creating an alert.

Answer

Run the search, click 'Save As' -> 'Report', set schedule to hourly, then create an alert action to email the report to the SOC team.

Answer

Run the search, click 'Save As' -> 'Dashboard Panel', add to a SOC dashboard, then schedule the dashboard.

Answer

Run the search, click 'Save As' -> 'Alert', set permissions to private, then schedule the alert to trigger hourly.

Question 4

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

Accepted Answer

Configure a CSV lookup and use lookup command in search. A CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Answer

Use a time-based lookup to match event time with lookup time

Answer

Set up an external lookup that calls a REST API

Answer

Create a KV Store lookup and update it via REST

Question 5

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. Option A is correct because a root event dataset in a Splunk data model can be filtered with a constraint string (a search-like expression) that limits which events populate the dataset, such as restricting to a specific sourcetype or index. Option C is correct because data models can define fields that are extracted at search time, including eval-based calculated fields and field extractions, not only indexed fields. Option B is incorrect because data models are knowledge objects stored in the search head's knowledge bundle and replicated to search peers, not stored on indexers for faster access. Option D is incorrect because acceleration is optional; a data model can be used in searches (for example via the datamodel command or pivot) without being accelerated, though acceleration improves performance. Option E is incorrect because a data model may contain multiple root datasets, not exactly one.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 6

Refer to the exhibit. The pie chart shows only 10 slices, but the base search stats returns all destinations. What is the reason?

Accepted Answer

The post-process search includes | top limit=10 dest. The base search returns all destinations, but the pie chart shows only 10 slices because the post-process search uses the `| top limit=10 dest` command. The `top` command limits the results to the top 10 values of the `dest` field by count, and this post-process search is applied after the base search, so only those 10 slices are displayed in the pie chart.

Answer

The eval command changes the dest field

Answer

The base search time range is too small

Answer

The charting option 'chart' is set to 'pie'

Question 7

Refer to the exhibit. The search is not returning the `app_name` field as expected. The lookup has many entries with wildcard patterns. What is the most likely issue?

Accepted Answer

The lookup command uses OUTPUTNEW, but the event already has an app_name field (possibly null) so the lookup does not overwrite it.. The `OUTPUTNEW` clause in the `lookup` command only writes the field if it does not already exist in the event. If the event already contains an `app_name` field (even with a null value), the lookup will not overwrite it, so the expected value from the wildcard lookup is not returned. This is a common pitfall when using lookups with fields that may already be present in the data.

Answer

The lookup definition uses WILDCARD match type, which is incompatible with the lookup command.

Answer

The eval statement should not rename src_ip; the lookup should directly use src_ip.

Answer

The lookup command needs the option max_matches=1 to work with wildcards.

Question 8

A user wants to create a report that shows the average response time for each web endpoint over the past week. The data has fields: endpoint, response_time. Which search correctly calculates the average?

Accepted Answer

... | stats avg(response_time) by endpoint. The `stats avg(response_time) by endpoint` command calculates the average (mean) of the response_time field for each unique endpoint value. This directly meets the requirement of showing average response time per web endpoint over the past week, assuming the time range is set in the search bar or via an earliest/latest constraint.

Answer

... | stats mean(response_time) by endpoint

Answer

... | stats avg(response_time) by _time

Answer

... | eval avg=sum(response_time)/count | stats values(avg) by endpoint

Question 9

Which of the following best describes the purpose of the 'fields' command in a search?

Accepted Answer

To keep or remove specified fields from events. The 'fields' command in Splunk is used to either keep (include) or remove (exclude) specified fields from search results. By default, all extracted fields are returned, but 'fields' allows you to narrow the output to only relevant fields (e.g., `fields clientip, status`) or to drop unwanted fields (e.g., `fields - _raw`). This improves readability and performance by reducing the data volume passed to subsequent commands.

Answer

To rename existing fields

Answer

To add fields from a lookup table

Answer

To extract new fields from raw data

Question 10

Which THREE of the following are valid considerations when accelerating a data model? (Choose three.)

Accepted Answer

Constraints in the data model affect which events are summarized.. Option A is correct because constraints defined in the data model (such as filters or restrictions on fields/events) determine which events are eligible to be included in the acceleration summary, so they directly affect what gets summarized. Option D is correct because acceleration works by building and storing pre-computed summary files on disk, which consumes additional storage beyond the raw indexed data. Option E is correct because the acceleration summary range (the time span covered by the summary) should be aligned with the time ranges most frequently queried, so that common searches benefit from the pre-calculated results rather than falling outside the summarized window. Option B is not required: a data model does not need to be fully defined before acceleration is enabled, since acceleration can be applied to the portions of the model that exist. Option C is incorrect because acceleration runs at search time (using pre-built summaries) rather than at index time; the summaries are generated separately and then leveraged during searches, not computed during indexing.

Answer

A data model must be fully defined before acceleration can be enabled.

Answer

Acceleration runs at index time to pre-calculate results.