SPLK-1001 Multiple Select — 20 Questions

Question 1

Which three of the following are best practices for creating efficient dashboards? (Choose three.)

Accepted Answer

Use summary indexing to pre-aggregate data. Option A is correct because summary indexing pre-computes and stores aggregated results in a separate index, so dashboard panels can run fast searches against small summary data instead of scanning large raw datasets. Option B is correct because base searches (or base search/post-process patterns) let multiple panels reuse one shared search result set, eliminating duplicated search logic and reducing overall search load. Option C is correct because tokens allow user input (such as a dropdown or time range selection) to be passed between panels, enabling dynamic, reusable dashboards without hard-coding values or duplicating queries. Option D is not a best practice because real-time searches continuously consume resources and are typically reserved for narrow, short-term monitoring rather than efficient dashboard design. Option E is not a best practice because the | map command iterates over results and runs a subsearch per row, which is resource-intensive and scales poorly on large result sets.

Answer

Use real-time searches to ensure data is current

Answer

Use the | map command to iterate over large result sets

Question 2

Which of the following are valid reasons to use a lookup in Splunk? (Choose two.)

Accepted Answer

To enrich events with additional information from an external source.. A lookup in Splunk enriches events by adding fields from an external source, such as a CSV file, KV store, or scripted lookup, based on a matching field in the event. This allows you to bring in contextual data (e.g., user names, device details) without modifying the original raw data.

Answer

To create new fields using the eval command.

Answer

To alias field names permanently.

Answer

To change the timestamp format of events.

Question 3

Which THREE best practices should be followed when creating dashboards for a large organization with many users?

Accepted Answer

Use scheduled searches instead of real-time to reduce load. Option A is correct because scheduled searches cache results at defined intervals, so many concurrent dashboard users read precomputed results instead of each triggering a live search, which dramatically reduces search-head and indexer load in a large multi-user deployment. Option B is correct because each panel typically runs its own search, so keeping the panel count low limits concurrent search jobs, shortens dashboard render time, and avoids overwhelming users with visual clutter. Option D is correct because role-based access controls let you restrict dashboards and individual panels to the appropriate roles, ensuring users in a large organization only see data they are authorized to view and reducing unnecessary search execution. Option C is not a best practice because multiple base searches per panel multiply the number of searches executed and increase load rather than consolidating work into a single shared base search. Option E is not a best practice because exclusive real-time searches are the most resource-intensive mode and scale poorly across many users, which is exactly why scheduled searches are preferred.

Answer

Use multiple base searches per panel for flexibility

Answer

Use exclusively real-time searches for up-to-date data

Question 4

Which THREE of the following are core interface components visible on the Splunk Web search page?

Accepted Answer

Results area (Events, Statistics, Visualization tabs). The Splunk Web search page is built around three core interface components: the Results area (A), which displays search output across the Events, Statistics, and Visualization tabs; the Search bar (D), where users enter their SPL search queries; and the Time range picker (E), which sets the time window applied to the search. These three elements are always present on the Search & Reporting app's search page and form the primary workflow for running and viewing searches. The Settings menu (B) is a global navigation item for configuration tasks, not a component of the search page itself, and the App management interface (C) is accessed through Settings or the Apps menu to install and configure apps, so neither belongs to the search page's core interface.

Answer

Settings menu

Answer

App management interface

Question 5

Which TWO actions increase the performance of a dashboard in Splunk? (Choose two.)

Accepted Answer

Use scheduled reports as base searches. Option A is correct because using scheduled reports as base searches lets the dashboard load precomputed results from the report's cached artifacts instead of re-running the search each time the dashboard is opened, which reduces search load and speeds up panel rendering. Option D is correct because tstats queries accelerated data models, reading precomputed summaries from the TSIDX files rather than scanning raw events, which dramatically reduces the data processed and improves dashboard performance. Option B does not belong because adding many drilldowns increases client-side and search overhead without improving dashboard load or search speed. Option C does not belong because real-time searches continuously consume resources and are more expensive than historical searches, so they decrease rather than increase performance. Option E does not belong because multiple time range pickers add complexity and additional search triggers, not performance gains.

Answer

Add a large number of drilldowns

Answer

Use real-time searches

Answer

Add multiple time range pickers to the dashboard

Question 6

Which THREE of the following are valid methods to access the Search & Reporting app in Splunk Web?

Accepted Answer

Click the 'Search' button on the Splunk Home page.. The Splunk Home page includes a prominent 'Search' button that directly opens the Search & Reporting app. This is the most common method for users to start searching data in Splunk Web.

Answer

Click the Splunk logo and select 'Search & Reporting' from the context menu.

Answer

Use the keyboard shortcut Ctrl+Alt+S.

Question 7

A user wants to save a search as a report that can be used in a dashboard. Which TWO steps are required? (Select two.)

Accepted Answer

Run the search and click 'Save As' > 'Report'. Option B is correct because in Splunk you must first run the search and then use 'Save As' > 'Report' to convert the ad-hoc search into a saved report, which is the prerequisite for dashboard use. Option D is correct because during that save workflow you must provide a report name and configure permissions (owner/app/sharing) so the report is persisted and accessible to the dashboard. Option A is incorrect because scheduling email delivery is an optional alert/report action, not a required step to save a report. Option C is incorrect because a time range can be inherent in the search or set later; it is not a mandatory save step. Option E is incorrect because adding the report to a dashboard panel happens after the report exists and is not part of saving it.

Answer

Schedule the report for email delivery

Answer

Set a time range in the search

Answer

Add the report to a dashboard panel

Question 8

Which THREE of the following are valid uses of the stats command?

Accepted Answer

stats avg(response_time) as avg_time. Option B is correct because stats supports statistical aggregation functions such as avg() with an optional as clause to rename the resulting field, so stats avg(response_time) as avg_time is a valid use. Option C is correct because stats sum(bytes) by source applies the sum() aggregation function grouped by the source field, which is a standard stats usage. Option D is correct because stats count by host uses the count aggregation function with a by clause to group results by host, a canonical stats pattern. Option A is not valid because eval() is not an aggregation function and cannot be used inside stats; eval is a separate command for calculating expressions. Option E is not valid because table is a separate command, not a stats function, so stats table user is not a legitimate stats invocation.

Answer

stats eval(x=1) by category

Answer

stats table user

Question 9

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. Option A is correct because the stats command is Splunk's primary aggregation command, computing summary statistics such as count, sum, avg, min, max, dc (distinct count), and many other statistical functions over the result set. Option E is correct because stats supports a by clause (e.g., `stats count by host`) to group results by one or more fields, and those by fields must already exist in the search results for the grouping to work. Option B is incorrect because listing individual events is the job of commands like table or raw event display, not stats, which collapses events into aggregated rows. Option C is incorrect because creating new fields is done with eval, not stats, which only aggregates existing fields. Option D is incorrect because stats works with non-numeric fields too, for example count, dc, values, and list operate on string fields.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 10

Which TWO of the following are valid ways to access the Search & Reporting app in Splunk Web? (Choose two.)

Accepted Answer

Click the 'Search & Reporting' link on the Splunk Home page.. Option A is correct because the Splunk Home page lists the installed apps, including Search & Reporting, as clickable links that launch the app directly. Option C is correct because the Apps menu in the top navigation bar lets users switch between installed apps, and Search & Reporting appears there as a selectable app. Option B is incorrect because Settings > Search does not exist as a navigation path for launching the Search & Reporting app; Settings contains configuration items such as licensing, users, and indexes. Option D is incorrect because typing 'search' in the browser address bar performs a web search or invalid URL entry, not navigation within Splunk Web. Option E is incorrect because the Help menu provides documentation and support links, not a Search Assistant for opening the Search & Reporting app.

Answer

Navigate to Settings > Search.

Answer

Type 'search' in the browser address bar.

Answer

Open the Search Assistant from the Help menu.

Question 11

A user wants to view the contents of a lookup table file named `users.csv` that is stored in Splunk. Which two commands can be used? (Choose two.)

Accepted Answer

`| inputlookup users.csv`. Option A is correct because `inputlookup` is the Splunk search command that reads the contents of a lookup file and returns them as search results, and specifying the filename `users.csv` directly is a valid way to reference the lookup. Option B is also correct because `inputlookup` accepts the lookup definition name (here `users`), so `| inputlookup users` returns the same table contents when the lookup is defined with that name. Option C is wrong because `fields` only includes or excludes fields from the current result set and cannot read a lookup file. Option D is wrong because `outputlookup` writes results to a lookup file rather than displaying its contents. Option E is wrong because `lookup` enriches events by matching fields against a lookup, not by returning the lookup table itself.

Answer

`| fields users.csv`

Answer

`| outputlookup users.csv`

Answer

`| lookup users.csv`

Question 12

Which TWO methods can be used to create a new field in a search?

Accepted Answer

rex field=raw "(?pattern)". Option C is correct because the rex command extracts a new field at search time using a regular expression with a named capture group, e.g. rex field=raw "(?pattern)", which creates new_field from the matched text. Option E is correct because the eval command creates or overwrites a field by assigning the result of an expression, e.g. eval new_field = some_expression, which is the standard way to derive a calculated field in a search. Option A is incorrect because search new_field=* only filters events where new_field already exists; it does not create the field. Option B is incorrect because timechart count by date is an aggregation/visualization command that produces a time-series chart, not a new field definition. Option D is incorrect because stats count by host is also an aggregation that groups results by the existing host field and does not create a new field.

Answer

search new_field=*

Answer

timechart count by date

Answer

stats count by host

Question 13

Which TWO of the following must be true for the lookup to return results?

Accepted Answer

The events must contain a field named 'zip_code'.. The `lookup` command matches a field in the event data to a field in the lookup file. For the lookup to return results, the event must contain the field specified as the lookup input field (here, `zip_code`). Without this field in the events, there is no value to match against the lookup file, so no results are returned.

Answer

The events must contain a field named 'county'.

Answer

The lookup must be configured with `inputlookup` instead of `lookup`.

Answer

The lookup file must contain a field named 'city'.

Question 14

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Accepted Answer

Save as alert. In the Splunk Search app, the "Save As" menu exposes three primary destinations for a completed search: "Alert" (A), which creates a saved search configured with alert conditions and trigger actions; "Report" (D), which stores the search and its time range as a reusable saved search for later running or scheduling; and "Dashboard Panel" (E), which adds the current search/visualization directly into a new or existing dashboard. These three are exactly the options the Save As dialog offers, since they map to the saved-search object types Splunk supports from the search bar. Options B (event type) and C (search macro) are not offered from Save As; event types are created via Settings > Event Types (or the "Save As Event Type" action in some contexts, not the standard Save As menu), and search macros are defined under Settings > Advanced Search > Search Macros, so neither belongs here.

Answer

Save as event type

Answer

Save as search macro

Question 15

Which TWO of the following are valid ways to navigate from a search result to a dashboard?

Accepted Answer

Click 'Open in Dashboard' from the search actions menu (ellipsis).. Option C is correct because the search actions menu (the ellipsis next to the search bar) includes an 'Open in Dashboard' command that lets you immediately place the current search results into a new or existing dashboard panel. Option D is correct because saving the search as a report and then adding that report to a dashboard panel is the standard, supported workflow for reusing a saved search on a dashboard. Option A is incorrect because dragging a field from the Fields sidebar only adds that field to the current search/table, not to a dashboard. Option B is incorrect because there is no 'Dashboard' button on the search bar that performs navigation to a dashboard. Option E is incorrect because right-clicking the timeline does not expose an 'Open in Dashboard' action.

Answer

Drag a field from the Fields sidebar to the dashboard canvas.

Answer

Click the 'Dashboard' button on the search bar.

Answer

Right-click on the timeline and select 'Open in Dashboard'.

Question 16

Which THREE statements about Splunk lookups are true?

Accepted Answer

Lookups can be defined in the Lookups section of Settings.. Splunk lookups are defined and managed in the Lookups section under Settings > Lookups, where you can upload lookup files, create lookup definitions, and configure automatic lookups. This is the central location for all lookup configuration, including CSV files, KV store collections, and external lookups.

Answer

Lookups are automatically applied to all events in a search.

Answer

Lookups can only be performed on a single field.

Question 17

Which two of the following are best practices when designing Splunk data models? (Choose two.)

Accepted Answer

Avoid using wildcards in field names.. Wildcards in field names can cause performance degradation and ambiguity in data model acceleration. Splunk recommends using explicit, descriptive field names to ensure efficient indexing and query execution, as wildcards force the search-time field extraction to scan more data than necessary.

Answer

Limit the number of fields to no more than 100.

Answer

Avoid time-based constraints to ensure all historical data is searchable.

Answer

Leave constraints undefined to include all events.

Question 18

Which THREE statements about the 'rex' command are correct? (Choose three.)

Accepted Answer

rex can be used to extract fields from any string field. Option A is correct because the rex command is a Splunk search command that applies a regular expression to any string field (not just _raw) and extracts new fields from it via the max_match and field arguments. Option B is correct because rex supports named capturing groups in the form (?<name>pattern), which become the extracted field names in the results. Option E is correct because rex can overwrite an existing field when the named capture group matches an already-present field name, effectively modifying that field's value. Option C is incorrect because rex can extract multiple fields in a single invocation by using multiple named capturing groups in one regular expression. Option D is incorrect because rex leaves extracted values as strings and does not automatically cast them to numeric types; a separate conversion such as the eval or convert command is required.

Answer

rex can only extract one field per command

Answer

rex automatically converts extracted values to numeric

Question 19

Which TWO statements about designing Splunk data models are correct? (Choose two.)

Accepted Answer

Root events in a data model can be constrained using a constraint string.. Option A is correct because a root event dataset in a Splunk data model can be filtered with a constraint string (a search-like expression) that limits which events populate the dataset, such as restricting to a specific sourcetype or index. Option C is correct because data models can define fields that are extracted at search time, including eval-based calculated fields and field extractions, not only indexed fields. Option B is incorrect because data models are knowledge objects stored in the search head's knowledge bundle and replicated to search peers, not stored on indexers for faster access. Option D is incorrect because acceleration is optional; a data model can be used in searches (for example via the datamodel command or pivot) without being accelerated, though acceleration improves performance. Option E is incorrect because a data model may contain multiple root datasets, not exactly one.

Answer

Data models are stored on indexers for faster access.

Answer

Data models require acceleration to be used in searches.

Answer

A data model must contain exactly one root dataset.

Question 20

Which THREE of the following are valid considerations when accelerating a data model? (Choose three.)

Accepted Answer

Constraints in the data model affect which events are summarized.. Option A is correct because constraints defined in the data model (such as filters or restrictions on fields/events) determine which events are eligible to be included in the acceleration summary, so they directly affect what gets summarized. Option D is correct because acceleration works by building and storing pre-computed summary files on disk, which consumes additional storage beyond the raw indexed data. Option E is correct because the acceleration summary range (the time span covered by the summary) should be aligned with the time ranges most frequently queried, so that common searches benefit from the pre-calculated results rather than falling outside the summarized window. Option B is not required: a data model does not need to be fully defined before acceleration is enabled, since acceleration can be applied to the portions of the model that exist. Option C is incorrect because acceleration runs at search time (using pre-built summaries) rather than at index time; the summaries are generated separately and then leveraged during searches, not computed during indexing.

Answer

A data model must be fully defined before acceleration can be enabled.

Answer

Acceleration runs at index time to pre-calculate results.