SPLK-1002 Hard Questions — 25 Difficult Questions

Question 1

During a data model acceleration build, the following error appears in splunkd.log: 'Data model acceleration: not enough memory to complete summary build.' Which best practice should the administrator implement to prevent this error?

Accepted Answer

Increase the memory allocation for the data model acceleration process.. Option B is correct because the error 'not enough memory to complete summary build' indicates that the data model acceleration process has exhausted its allocated memory. Increasing the memory allocation for the data model acceleration process (via the limits.conf or the data model acceleration settings) directly addresses this resource constraint, allowing the summary to build successfully.

Answer

Remove unnecessary fields from the data model to reduce complexity.

Answer

Reduce the summary range to less than 7 days.

Answer

Use tstats instead of data model acceleration for queries.

Question 2

A search includes the command '| stats dc(user) by host'. What does this command return?

Accepted Answer

The number of distinct users per host. The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Answer

The number of unique hosts per user

Answer

The count of events per host

Answer

The sum of user values per host

Question 3

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. Option D is correct because it filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 4

You are a Splunk admin for a large enterprise with multiple distributed Splunk components. The security team frequently runs searches that use a large CSV lookup file (500MB) containing threat intelligence indicators. They report that searches are slow and sometimes time out. The lookup file is updated hourly via an automated script. The team currently uses the 'lookup' command in every search. You need to improve performance without sacrificing data freshness. Your environment has a search head cluster and indexer cluster. The lookup file is stored on a shared filesystem accessible to all search heads. Which single approach will best improve search performance while maintaining hourly updates?

Accepted Answer

Configure the lookup as a time-based lookup with a filter condition to only apply to events with matching IP fields, and use automatic lookup to avoid manual command.. Option A is correct because configuring the lookup as a time-based lookup with a filter condition reduces the number of events that need to be matched against the 500MB CSV, and using an automatic lookup eliminates the need for the manual 'lookup' command in every search. This approach improves performance by limiting the lookup scope to relevant events (e.g., only those with matching IP fields) while still allowing the hourly script to update the CSV file, maintaining data freshness.

Answer

Increase the search concurrency limit on the search head to allow more parallel lookups.

Answer

Convert the CSV to a KV Store collection and use the 'lookup' command with the KV Store lookup.

Answer

Move the CSV file to each indexer and use index-time field lookup.

Question 5

What is the purpose of this search?

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The search uses `top` to find the most common values in the `status` field, limited to 5 results. The `top` command counts occurrences and sorts by count descending, so it returns the 5 most frequent HTTP status codes from the web index. Option C correctly describes this behavior.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 6

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. Option A is correct because a root event in a data model can be constrained using a constraint string, which is a search expression that filters the events included in that dataset. This allows you to define a subset of data for the root dataset without modifying the underlying indexed data.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 7

Which TWO of the following are valid ways to add a visualization to a dashboard in Splunk?

Accepted Answer

Create a new panel in the dashboard editor and select a visualization type.. Option B is correct because the dashboard editor in Splunk provides a dedicated workflow to add a new panel and then select a visualization type (e.g., chart, table, map) from the 'Visualization' tab. This is the standard method for building a panel from scratch within a dashboard, allowing you to define the search and choose the appropriate visualization for your data.

Answer

Use the 'Edit' button on an existing panel to change it to a new visualization.

Answer

Export a report as a PDF and upload it as an image panel.

Answer

Set up an alert and configure it to add a panel to the dashboard.

Question 8

An IT operations team has a dashboard with multiple panels showing server metrics. Each panel uses a separate search that runs every time the dashboard is loaded, causing slow performance. What is the best practice to improve dashboard load time?

Accepted Answer

Use a base search and post-process searches for dependent panels.. Option A is correct because using a base search with post-process searches allows multiple dashboard panels to share a single, initial data retrieval. Instead of each panel running its own independent search against the index, they all reference the results of the base search, which runs once. This drastically reduces the number of indexer queries and speeds up dashboard load time, especially when panels share a common data source or filtering criteria.

Answer

Reduce the time range picker to the last 24 hours.

Answer

Combine all searches into one large search and use eval to separate results.

Answer

Add more panels to distribute the data load.

Question 9

A Splunk administrator is configuring a lookup to enrich firewall logs with a static CSV file containing allowed IP ranges. Which TWO statements about lookup configuration are correct?

Accepted Answer

The lookup definition must include the fields to match on from the event data.. Option B is correct because a lookup definition must specify the fields from the event data that will be used to match against the lookup table. This is configured in the 'Lookup definition' settings where you define the input fields (event fields) and output fields (lookup fields). Without this match configuration, Splunk cannot correlate the event data with the CSV file contents.

Answer

A KV Store lookup is required for static tables.

Answer

The lookup is defined in macros.conf.

Answer

The CSV file must be placed in an absolute path on the search head.

Question 10

During onboarding, a new user can't find any data in Splunk. They see 'No results found' for all searches. The data is being forwarded from a universal forwarder. What should they check first?

Accepted Answer

Check if the forwarder is configured to send to the correct indexer. Option B is correct because the most common reason a universal forwarder sends data that never appears in Splunk is misconfiguration of the outputs.conf file. The forwarder must specify the correct indexer IP address or hostname and the receiving port (default 9997) using the TCP output stanza; if this is wrong, data is sent to the wrong destination or nowhere at all. Checking the forwarder's configuration first isolates whether data is even reaching the indexer tier before investigating other potential issues.

Answer

Check if the user has admin role

Answer

Check if the firewall is blocking ports

Answer

Check if the search is using the correct time range

Question 11

Refer to the exhibit. What can be determined about the license usage?

Accepted Answer

180 MB of license capacity is available. The pool has a max size of 500 MB and used size of 320 MB, meaning 180 MB is available. The pool is not full. The stack ID indicates it's for enterprise license, but not necessarily all used for search. The pool is not over-allocated.

Answer

320 MB of license is used for search

Answer

The pool is over-allocated

Answer

The license is expired

Question 12

A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?

Accepted Answer

| eval duration_sec = duration / 1000. Option C is correct because the `eval` command in Splunk is specifically designed to create new fields by evaluating expressions, including arithmetic operations. Using `| eval duration_sec = duration / 1000` creates a new field `duration_sec` that contains the value of `duration` divided by 1000, converting milliseconds to seconds.

Answer

| rename duration as duration_sec

Answer

| convert duration_sec = duration/1000

Answer

| fields duration_sec = duration/1000

Question 13

An organization is ingesting web proxy logs and wants to enrich them with a lookup table that maps internal IP addresses to employee names. The lookup table is updated weekly. Which configuration ensures the lookup is automatically applied to all searches without manual intervention, while also minimizing performance impact?

Accepted Answer

Configure an automatic lookup in props.conf and transforms.conf.. Option D is correct because configuring an automatic lookup in props.conf and transforms.conf allows the lookup to be applied at search time without requiring users to manually invoke the lookup command. This configuration minimizes performance impact by leveraging indexed field values and caching, and it ensures the lookup is automatically applied to all searches as soon as the lookup file is updated weekly.

Answer

Create a macro that includes the 'lookup' command and share it with users.

Answer

Upload the lookup file each week and manually run a search to add the field.

Answer

Use the 'lookup' command in every search to fetch the employee name.

Question 14

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

Accepted Answer

fillnull value=unknown status. Option C is correct because the `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Answer

eval status=coalesce(status, "unknown")

Answer

default status=unknown

Answer

replace status with "unknown"

Question 15

A search includes a lookup that returns multiple values per event. The admin wants to see each matched value as a separate event. Which command should be used after the lookup?

Accepted Answer

mvexpand. The `mvexpand` command is correct because it takes a multivalue field (such as one created by a lookup returning multiple matches) and expands it into separate events, one for each value. This allows the admin to see each matched value as an individual event, which is exactly the requirement.

Answer

untable

Answer

stats

Answer

makemv

Question 16

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Option C is correct because setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 17

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Accepted Answer

Add the dashboard to a dashboard group with view permissions. Option C is correct because Splunk allows you to add a dashboard to a dashboard group and set the group's permissions to 'read' (view) only. This grants users access to view the dashboard without the ability to edit it, as edit permissions are controlled separately via roles and object-level ACLs.

Answer

Embed the dashboard in an external website

Answer

Clone the dashboard and give the clone to users

Answer

Export the dashboard as a PDF and email it

Question 18

A large enterprise has multiple Splunk indexers and is using data model acceleration to speed up dashboards. The dashboards are slow despite acceleration being enabled. The data model has many root events and child datasets. Which best practice should the administrator consider to improve performance?

Accepted Answer

Reduce the number of root events in the data model.. Data model acceleration creates a summary of the data, but the acceleration process must traverse all root events to build the child datasets. If there are too many root events, the acceleration job itself becomes slow and resource-intensive, negating the performance benefit. Reducing the number of root events directly reduces the workload for acceleration, allowing the summaries to be built faster and queries to run against the accelerated data more efficiently.

Answer

Use tstats commands on the data model without acceleration.

Answer

Replicate the data model on each indexer to distribute load.

Answer

Increase the summary range to cover more data.

Question 19

A Splunk administrator notices that a data model acceleration summary is consuming excessive disk space on the indexers. The data model is used for a dashboard that refreshes every 30 minutes. What is the best course of action to reduce disk usage while maintaining dashboard performance?

Accepted Answer

Decrease the acceleration time range in the data model definition.. Option B is correct because decreasing the acceleration time range in the data model definition directly reduces the amount of data the summary covers, which lowers disk usage on the indexers. Since the dashboard refreshes every 30 minutes, a shorter acceleration range (e.g., last 7 days instead of 30) still keeps the most recent data pre-computed for fast queries, maintaining performance for the refresh interval.

Answer

Disable data model acceleration and rely on raw data searches.

Answer

Decrease the backfill time for the data model.

Answer

Increase the acceleration time range to speed up summary generation.

Question 20

Refer to the exhibit. A Splunk admin created this dashboard XML. When viewing the dashboard, the "Response Time" panel shows no data. What is the most likely cause?

Accepted Answer

The 'response_time' field does not exist in the access_combined sourcetype.. The search for response time uses a field 'response_time' which may not exist in the access_combined sourcetype. The access_combined sourcetype typically does not have a response_time field; it might be named differently (e.g., time_taken).

Answer

The index 'web' does not contain any events.

Answer

The bar chart cannot display the results.

Answer

The stats command requires a by clause and host is not a valid field.