SPLK-1002 Data Models and Best Practices — 30 Questions

Question 1

A security analyst needs to create a data model for authentication logs that allows both event counts and average duration calculations. The data model should support fast search performance. Which approach best follows Splunk best practices for data model design?

Accepted Answer

Define root events as event types and add child transactions for duration calculations.. Option A is correct because Splunk best practices for data model design recommend using root events as event types for base calculations like counts, and adding child transactions (or child datasets) for calculations that require grouping multiple events, such as average duration. This separation optimizes search performance by allowing the data model to leverage the faster event-based search for counts while using transactions only when necessary for duration calculations.

Answer

Define the root event as an event type with calculated fields for duration.

Answer

Define the root event as a transaction type to include duration inherently.

Answer

Create separate data models for counts and durations.

Question 2

A Splunk administrator notices that a data model acceleration summary is not updating as expected. The data model is accelerated with a summary range of 30 days. What is the most likely cause of this issue?

Accepted Answer

The summary index is not writable due to insufficient disk space.. Option B is correct because data model acceleration relies on a summary index to store pre-computed results. If the disk hosting that summary index is full, the acceleration process cannot write new data, causing the summary to stop updating. Splunk will log errors related to disk space, and the acceleration status will show as stalled or incomplete.

Answer

The data model is based on a time range older than the summary range.

Answer

The data model includes calculated fields that are not search-time extractable.

Answer

The data model acceleration is configured to run only on real-time searches.

Question 3

A large enterprise has multiple Splunk indexers and is using data model acceleration to speed up dashboards. The dashboards are slow despite acceleration being enabled. The data model has many root events and child datasets. Which best practice should the administrator consider to improve performance?

Accepted Answer

Reduce the number of root events in the data model.. Data model acceleration creates a summary of the data, but the acceleration process must traverse all root events to build the child datasets. If there are too many root events, the acceleration job itself becomes slow and resource-intensive, negating the performance benefit. Reducing the number of root events directly reduces the workload for acceleration, allowing the summaries to be built faster and queries to run against the accelerated data more efficiently.

Answer

Use tstats commands on the data model without acceleration.

Answer

Replicate the data model on each indexer to distribute load.

Answer

Increase the summary range to cover more data.

Question 4

An analyst wants to create a data model that includes fields from both web server logs and database logs. The two sourcetypes have different timestamp formats. Which best practice should the analyst follow when designing the data model?

Accepted Answer

Normalize the timestamp fields using eval expressions in the data model definition.. Option B is correct because the best practice for handling different timestamp formats in a data model is to normalize them using eval expressions within the data model definition. This ensures that all events share a common, consistent timestamp field, which is essential for accurate time-based searches and pivot operations across multiple sourcetypes.

Answer

Use the data model to define new timestamp fields based on indexed data.

Answer

Use the same timestamp field name but ignore the format differences.

Answer

Create two separate data models, one for each sourcetype.

Question 5

A user reports that a data model acceleration is consuming excessive disk space on the indexer. The data model has a summary range of 90 days. Which action is best to reduce disk space usage while maintaining acceptable query performance?

Accepted Answer

Reduce the summary range to 30 days.. Reducing the summary range from 90 days to 30 days directly decreases the amount of data that the acceleration precomputes and stores on the indexer. This minimizes disk space consumption while still accelerating queries for the most recent, commonly accessed data. Maintaining a shorter summary range ensures acceptable performance for recent queries without the overhead of storing summaries for older, less frequently accessed time periods.

Answer

Increase the acceleration frequency to rebuild summaries more often.

Answer

Disable acceleration for the data model.

Answer

Delete old indexed data that is not frequently queried.

Question 6

During a data model acceleration build, the following error appears in splunkd.log: 'Data model acceleration: not enough memory to complete summary build.' Which best practice should the administrator implement to prevent this error?

Accepted Answer

Increase the memory allocation for the data model acceleration process.. Option B is correct because the error 'not enough memory to complete summary build' indicates that the data model acceleration process has exhausted its allocated memory. Increasing the memory allocation for the data model acceleration process (via the limits.conf or the data model acceleration settings) directly addresses this resource constraint, allowing the summary to build successfully.

Answer

Remove unnecessary fields from the data model to reduce complexity.

Answer

Reduce the summary range to less than 7 days.

Answer

Use tstats instead of data model acceleration for queries.

Question 7

A Splunk administrator is designing a data model for network traffic logs. The logs contain source IP, destination IP, bytes transferred, and protocol. The administrator wants to create a root event that counts connections and a child transaction that sums bytes per session. Which constraint type should be used for the root event?

Accepted Answer

Event constraint. The root event in a data model must use an Event constraint because it defines the base dataset from which all child objects inherit their data. Event constraints filter raw events based on search criteria, ensuring the root event contains only the relevant network traffic logs (source IP, destination IP, bytes, protocol) needed to count connections. Child constraints, search constraints, and transaction constraints are not valid constraint types for defining the root event in a Splunk data model.

Answer

Child constraint

Answer

Search constraint

Answer

Transaction constraint

Question 8

Which TWO are best practices for creating data models in Splunk? (Choose two.)

Accepted Answer

Use data model acceleration to improve query performance on large datasets.. Option A is correct because data model acceleration pre-computes and stores aggregated data in the form of summaries (TSIDX files), which dramatically reduces query latency on large datasets by avoiding full scan of raw events. This is a best practice for optimizing performance when using data models in Splunk.

Answer

Base data models on indexed fields rather than search-time extracted fields.

Answer

Create many-to-many relationships between root events and child datasets.

Answer

Include all available fields to ensure maximum flexibility.

Question 9

Which THREE are valid considerations when troubleshooting data model acceleration? (Choose three.)

Accepted Answer

The summary index must be writable and have enough disk space.. Option A is correct because data model acceleration creates a summary index that stores pre-computed results. If the summary index is not writable or lacks sufficient disk space, the acceleration process will fail, preventing the data model from being accelerated.

Answer

Too many fields in the data model can cause acceleration to fail.

Answer

The data model must be based on a real-time search to be accelerated.

Question 10

Which TWO are benefits of using data model acceleration? (Choose two.)

Accepted Answer

Reduced time to run complex aggregations and statistical searches.. Option A is correct because data model acceleration pre-computes and stores aggregated data in the form of summaries (`.tsidx` files), which drastically reduces the time needed to run complex statistical and aggregation searches like `stats`, `timechart`, or `top`. Instead of scanning raw events, Splunk queries these pre-built summaries, enabling sub-second response times for large datasets.

Answer

Reduced disk space usage by compressing indexed data.

Answer

Eliminates the need for data indexing by using summary data.

Answer

Simplified data model design by automatically optimizing relationships.

Question 11

You are a Splunk administrator at a financial services company. The company has a distributed Splunk environment with 10 indexers and 2 search heads. You have created a data model named 'transaction_analytics' to analyze financial transactions. The data model is accelerated with a summary range of 7 days. Recently, users have reported that dashboards using this data model are extremely slow, sometimes timing out. You check the acceleration status and see that the summary is 'Building' but never completes. The splunkd.log on the search head shows repeated messages: 'Data model acceleration: query timed out after 300 seconds.' The base search for the data model is: index=transactions sourcetype=fin_events | eval risk_score=if(amount>10000, 'high', 'low') | fields transaction_id, user, amount, risk_score, _time. The data model has one root event with two child datasets: one for high-risk transactions and one for low-risk transactions. The total data volume is about 500 GB per day. The indexer where the summary is built has 16 GB of RAM and the search head has 32 GB. What is the best course of action to resolve the acceleration build timeout?

Accepted Answer

Modify the base search to remove the eval statement and instead use a lookup or index-time field for risk_score.. Option A is correct because the eval statement in the base search forces the acceleration to process every raw event during the summary build, which is computationally expensive and causes the 300-second timeout. By moving the risk_score calculation to index time (e.g., using a calculated field or lookup), the acceleration can use the pre-computed field directly from the indexed data, drastically reducing CPU load and allowing the summary to complete within the timeout window.

Answer

Reduce the summary range to 1 day to limit the amount of data processed.

Answer

Disable acceleration and rely on real-time searches for the dashboards.

Answer

Increase the acceleration.max_time to 600 seconds to allow more time for the build.

Question 12

A security team wants to create a data model to analyze authentication events from multiple sources (Windows Event Log, Linux syslog, and VPN logs). The data model should normalize the fields for user, source IP, and action (success/failure). Which Splunk best practice should be applied when designing this data model?

Accepted Answer

Define a single data model that maps fields to the Common Information Model (CIM).. Option C is correct because the Common Information Model (CIM) provides a standardized, normalized schema for security events. By mapping fields like user, src_ip, and action to CIM field names, the data model ensures consistent searching and correlation across heterogeneous sources (Windows Event Log, Linux syslog, VPN logs) without per-source customizations. This approach leverages Splunk's built-in CIM add-on to accelerate data model design and maintain interoperability with security analytics apps.

Answer

Use event types to categorize authentication events and then create a data model based on event types.

Answer

Create separate data models for each data source to avoid field conflicts.

Answer

Create field aliases in props.conf for each source to rename fields to a common name, then use a simple data model.

Question 13

A Splunk administrator notices that a data model acceleration summary is consuming excessive disk space on the indexers. The data model is used for a dashboard that refreshes every 30 minutes. What is the best course of action to reduce disk usage while maintaining dashboard performance?

Accepted Answer

Decrease the acceleration time range in the data model definition.. Option B is correct because decreasing the acceleration time range in the data model definition directly reduces the amount of data the summary covers, which lowers disk usage on the indexers. Since the dashboard refreshes every 30 minutes, a shorter acceleration range (e.g., last 7 days instead of 30) still keeps the most recent data pre-computed for fast queries, maintaining performance for the refresh interval.

Answer

Disable data model acceleration and rely on raw data searches.

Answer

Decrease the backfill time for the data model.

Answer

Increase the acceleration time range to speed up summary generation.

Question 14

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. Option A is correct because a root event in a data model can be constrained using a constraint string, which is a search expression that filters the events included in that dataset. This allows you to define a subset of data for the root dataset without modifying the underlying indexed data.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 15

Refer to the exhibit. A Splunk user is building a data model for Apache error logs. The configuration above extracts an error_type field. However, when previewing data in the data model, the error_type field is not available. What is the most likely cause?

Accepted Answer

The DEST_KEY is set to _meta, which does not make the field available for data models.. Option D is correct because when DEST_KEY is set to _meta, the extracted field is stored in the internal metadata of the event rather than in the event's indexed fields. Data models rely on indexed fields that are part of the event's key-value structure, so fields stored in _meta are not accessible for data model field extraction or preview.

Answer

The regular expression in transforms.conf is incorrectly formatted.

Answer

The transforms.conf is in the wrong app context.

Answer

The transform name in props.conf does not match the transform name in transforms.conf.

Question 16

A large e-commerce company uses Splunk to monitor its web application. They have a data model named 'Web_Transactions' that contains fields: status_code, response_time, uri, user_agent. The data model is accelerated with a 30-day time range. Recently, the operations team reported that the dashboard showing average response time by URI is loading slowly, taking over 30 seconds to display. Upon investigation, you find that the data model acceleration summary job is taking longer to complete and sometimes fails. The indexers have sufficient CPU and memory, but the disk I/O is high during the summary job. The volume of web logs is approximately 500 GB per day. Which action should the Splunk administrator take to improve dashboard performance?

Accepted Answer

Increase the maximum number of parallel searches for the data model acceleration job in the limits.conf.. Option B is correct because increasing the `max_concurrent_parallel_searches` for the data model acceleration job in `limits.conf` allows the summary process to use more parallel searches against the indexers, which can reduce the time it takes to build the acceleration summary. Since the indexers have sufficient CPU and memory but disk I/O is high, parallelizing the search workload can better utilize available resources and prevent the job from timing out, thereby improving dashboard performance.

Answer

Disable data model acceleration and create a report that runs a scheduled search every 30 minutes to pre-compute the averages.

Answer

Add more indexers to distribute the data and reduce the load per indexer.

Answer

Decrease the acceleration time range from 30 days to 7 days.

Question 17

Which TWO of the following are best practices when creating and using data models in Splunk?

Accepted Answer

Accelerate data models to improve search performance on large datasets.. Option A is correct because accelerating a data model pre-computes the data model's field values and stores them in a summary index, which significantly reduces search time when running reports or Pivot searches against large datasets. This is a core best practice for optimizing performance with data models in Splunk.

Answer

Always accelerate root events in a data model to ensure all data is pre-computed.

Answer

Define all possible fields in the data model to ensure maximum flexibility.

Answer

Use data model acceleration only when building Pivot reports.

Question 18

Refer to the exhibit. A user runs the search shown. The search returns results, but the user wants to use a data model to make future searches faster and more consistent. Which data model should the user select and what is the correct acceleration setting?

Accepted Answer

Use the CIM Web data model and accelerate the 'Web' dataset.. Option A is correct because the search shown uses fields like `status`, `action`, `uri`, and `method`, which are standard fields in the CIM Web data model. Accelerating the 'Web' dataset pre-computes the relevant field extractions and aggregations, making future searches faster and more consistent without requiring the user to manually define field extractions or transformations.

Answer

Use the CIM Web data model and select 'Accelerate All Datasets' from the settings.

Answer

Create a new data model called 'Access' and enable acceleration on root events.

Answer

Use the built-in 'Searches' data model to pre-compute the count and status fields.

Question 19

You are a Splunk administrator for a large e-commerce company. The security team frequently runs searches against the web access logs (sourcetype=access_combined) to investigate suspicious activity. These searches often take 5-10 minutes to complete, and the team is frustrated. You decide to implement a data model to accelerate these searches. After creating a data model based on the CIM Web model and enabling acceleration for the 'Web' dataset, you notice that the acceleration summary size grows to over 50 GB and the rebuild process takes more than an hour every night, causing some searches to time out during the rebuild window. What is the most effective way to address this issue?

Accepted Answer

Reduce the acceleration time range from 'All time' to 'Last 7 days' to limit the summary size and rebuild duration.. Option C is correct because reducing the acceleration time range from 'All time' to a shorter window like 'Last 7 days' directly limits the amount of data the acceleration summary must cover. This shrinks the summary size (under 50 GB) and shortens the nightly rebuild time, preventing search timeouts during the rebuild window while still accelerating the most relevant recent data for security investigations.

Answer

Increase the bucket size in the acceleration settings to reduce the number of buckets being rebuilt.

Answer

Create a custom data model that includes only the fields needed for security investigations and enable acceleration.

Answer

Disable acceleration and instead rely on the security team to use more focused time ranges.

Question 20

Which three of the following are best practices when working with Data Models in Splunk? (Choose three.)

Accepted Answer

Regularly rebuild data model acceleration summaries after making changes to the data model.. Constraints are essential for limiting the events in a data model to only those relevant to the dataset, which improves performance and accuracy. Rebuilding acceleration summaries after changes ensures that the pre-computed data reflects the updated model, preventing stale results. Defining fields using Eval expressions allows you to derive calculated values from raw data, enriching the dataset without modifying the underlying indexed data.

Answer

Always set acceleration to the maximum time range (e.g., All time) to ensure all data is pre-computed.

Answer

Design data models with a flat, non-hierarchical structure whenever possible to simplify acceleration.

Answer

Create root-level child fields that are independent of any specific dataset hierarchy to improve search efficiency.