SPLK-1002 Practice Test 9 — 10 Questions

Question 1

A data model is set to accelerate with a summary range of 90 days. After some time, the administrator notices that the acceleration is using significant disk space. Which strategy would best reduce disk usage without losing the ability to quickly query the last 30 days of data?

Accepted Answer

Reduce the summary range to 30 days.. Option C is correct. Reducing the summary range to 30 days directly reduces the amount of data summarized, saving disk space while still allowing fast queries on recent data. Option A disables acceleration entirely, losing query performance. Option B increases range, worsening space. Option D is not a valid setting.

Answer

Set the acceleration to use a shorter time window for complete summarization.

Answer

Increase the summary range to 180 days.

Answer

Disable acceleration for the data model.

Question 2

An administrator notices that a data model with acceleration is not returning results for a specific time range. The search uses `| datamodel` command. The summary range is set to 30 days. What is the most likely cause?

Accepted Answer

The search time range exceeds the summary range of the acceleration.. When a data model is accelerated with a summary range of 30 days, the acceleration only precomputes and stores aggregated results for events within that 30-day window. If the search time range exceeds 30 days, the `| datamodel` command cannot use the accelerated summaries for the older data, and it must fall back to searching the raw data. However, if the acceleration is configured to only use summaries (e.g., with `summariesonly=t`), or if the raw data is not available, the search will return no results for the out-of-range period. The most likely cause given the scenario is that the search time range extends beyond the 30-day summary range, making the acceleration ineffective for that portion of the search.

Answer

The acceleration has overwritten the original raw data.

Answer

The `| datamodel` command requires the `summariesonly=t` argument to use acceleration.

Answer

The data model has a constraint that excludes the specific time range.

Question 3

During data model creation, an administrator adds a calculated field that concatenates `src_ip` and `dest_ip` with a hyphen. Which of the following is a best practice for calculated fields in data models?

Accepted Answer

Calculated fields should be used sparingly to avoid impacting search performance.. Calculated fields in data models are evaluated at search time, not index time, meaning they add computational overhead for every search that references them. Using them sparingly is a best practice because excessive calculated fields can degrade search performance, especially in large datasets or when the data model is accelerated. Option B correctly identifies this performance consideration.

Answer

Calculated fields should only use basic mathematical operations, not string functions.

Answer

Calculated fields are evaluated at index time, so they improve search performance.

Answer

Calculated fields are automatically accelerated when the data model is accelerated.

Question 4

An administrator reports that a data model acceleration job is consistently failing for a root event with a large dataset. What is the most likely cause?

Accepted Answer

The acceleration summary range is set to 'All time' and the dataset is very large.. Option D is correct because if the time range for acceleration is too broad, the summarization job may run out of memory or time. Option A is wrong because disk space would cause a different error. Option B is wrong because constraints would affect registration, not acceleration. Option C is wrong because field types are flexible and do not cause acceleration failure.

Answer

The data model has a calculated field with an incorrect type.

Answer

The root event constraint is too restrictive.

Answer

The acceleration summary range is too short.

Question 5

Which TWO of the following are best practices when creating a data model in Splunk? (Choose two.)

Accepted Answer

Test the data model on a sample of data before deploying widely.. Option A is correct because testing a data model on a sample of data before deploying widely validates that the root events, fields, and constraints produce accurate and expected results. This practice prevents performance degradation and incorrect reporting in production by catching issues like missing fields or overly broad constraints early, aligning with Splunk's recommended iterative development approach.

Answer

Add many calculated fields to reduce the need for extra searches.

Answer

Only create data models after a search is written to confirm the need.

Answer

Include as many constraints as possible to filter events.

Question 6

Which THREE of the following are valid considerations when accelerating a data model? (Choose three.)

Accepted Answer

Constraints in the data model affect which events are summarized.. Option A is correct because constraints in a data model (such as `| where` or `| search` filters) limit the set of events that are included in the acceleration summary. Only events matching the constraint are summarized, which reduces the data volume and speeds up query performance. This is a key design consideration when defining data model acceleration.

Answer

A data model must be fully defined before acceleration can be enabled.

Answer

Acceleration runs at index time to pre-calculate results.

Question 7

A company has a data model for email logs that includes a calculated field named 'sentiment_score' derived from a lookup. The data model is accelerated, but some reports using |tstats with 'sentiment_score' are returning incorrect values. What is the most likely reason?

Accepted Answer

The lookup used in the calculated field has been updated after the acceleration summary was built, causing a mismatch.. Option D is correct because when a data model is accelerated, it pre-computes and stores a summary of the data at the time of acceleration. If the lookup used in a calculated field (like 'sentiment_score') is updated after the acceleration summary is built, the |tstats command will query the stale summary, not the current lookup values. This mismatch causes incorrect results, as |tstats does not re-evaluate lookups against the live lookup table for accelerated data models.

Answer

The data model constraint excludes the events that contain the lookup values.

Answer

The |tstats command does not support calculated fields in accelerated data models.

Answer

The calculated field is defined incorrectly in the data model editor.

Question 8

A Splunk admin wants to ensure that data models are built efficiently and do not consume excessive resources. Which of the following is a best practice when creating data models?

Accepted Answer

Define constraints carefully to include only relevant events for each object.. Option A is correct because using constraints to limit the events included in each object improves acceleration performance and reduces resource usage. Option B is incorrect because converting all fields to calculated fields adds overhead. Option C is incorrect because using the root event for all data reduces organization. Option D is incorrect because tagging all fields slows down search.

Answer

Add tags to every field in the data model for better discoverability.

Answer

Convert all fields to calculated fields to normalize the data model.

Answer

Use a single root event with no child objects to simplify the data model.

Question 9

An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?

Accepted Answer

The KV Store lookup is cached and not refreshed between searches. Option B is correct because by default, KV Store lookups are cached and only reloaded when the cache expires or at search time. If the cache is stale, recent updates may not be seen. Option A is wrong because field filtering doesn't affect lookup content. Option C is wrong because lookup is case-sensitive by default. Option D is wrong because time-based lookups are not for KV Store.

Answer

The lookup is configured as time-based and is out of range

Answer

The IP addresses are case-sensitive and messy

Answer

The search does not include the _raw field

Question 10

A user runs a search for errors but notices that the `source` field is not appearing in the selected fields list. What is the most likely reason?

Accepted Answer

The field `source` is a default field and is always present.. Option A is correct because the `source` field is a default metadata field in Splunk, automatically extracted at index time for every event. It is always present in the selected fields list when events are returned, regardless of the search query or data source type.

Answer

The search returned no results.

Answer

The user may have closed the field sidebar.

Answer

The `source` field is only available if explicitly extracted.