SPLK-1002 Splunk Basics and Interface Navigation Practice Test 2 — 15 Questions

Question 1

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

Accepted Answer

Search bar in the Search & Reporting app. The Search bar in the Search & Reporting app is the primary interface for running ad-hoc searches across all indexed data. By entering the suspicious IP address directly into the search bar, the analyst can quickly retrieve all events containing that IP from any log source, leveraging Splunk's search-time field extraction and index-time data ingestion.

Answer

Data Summary

Answer

Dashboard panel

Answer

Alert action

Question 2

A Splunk administrator notices that a new user cannot see any data in the Search & Reporting app, even though the user has the 'user' role. What is the most likely cause?

Accepted Answer

The user has not been granted access to any indexes.. The 'user' role in Splunk includes the 'search' capability by default, which allows users to run searches. However, even with the search capability, a user cannot see any data unless they have explicit read access to one or more indexes. Index-level access is controlled via roles, and the default 'user' role does not grant access to any indexes; it only provides the ability to search indexes that the user has been granted access to. Therefore, the most likely cause is that the new user has not been assigned to a role that includes index access.

Answer

The user does not have the 'search' capability.

Answer

The user is limited to viewing only saved searches.

Answer

The user is not using the correct time range.

Question 3

Which TWO of the following are valid ways to add data to Splunk?

Accepted Answer

Deploying a universal forwarder to monitor a log file.. Option A is correct because a universal forwarder is a dedicated Splunk component designed to collect and forward log data to a Splunk indexer. It monitors specified log files, sends data over a secure TCP connection (default port 9997), and is the standard method for scalable, production-grade data ingestion.

Answer

Creating an alert that writes results to a summary index.

Answer

Using the 'Add Data' button in Splunk Web.

Answer

Typing data directly into the search bar.

Question 4

Refer to the exhibit. After running the search, the user wants to see only events where the HTTP status is 404. Which change to the search is correct?

Accepted Answer

Change the search to: index=main sourcetype=access_combined status=404 | stats count. Option B is correct because adding `status=404` directly in the base search filters events at the index level before any processing, which is the most efficient approach. The `stats count` command then aggregates the filtered results, ensuring only events with HTTP status 404 are included. This leverages Splunk's index-time filtering to reduce data volume early in the pipeline.

Answer

Add | where status=404 after the sort command.

Answer

Add | rename status as status_code and search for status_code=404.

Answer

Replace stats with top limit=1 status.

Question 5

You are a Splunk administrator at a mid-sized company that uses Splunk Enterprise to monitor application logs from a web server cluster. The cluster has five servers, each sending logs via a universal forwarder to a single indexer. The indexer has ample resources. Recently, users have complained that searches for the last 24 hours are slow, but searches for the last hour are fast. The data volume is about 50 GB per day. You suspect the issue is related to how data is stored or indexed. Which action should you take first to improve search performance for the 24-hour time range?

Accepted Answer

Exclude internal Splunk logs (splunkd.log) from being indexed by setting up appropriate input configurations on forwarders.. Option C is correct because internal Splunk logs (splunkd.log) can generate significant volume and are indexed by default, consuming resources and slowing searches over longer time ranges. Excluding them on the forwarders reduces the total indexed data, improving search performance for the 24-hour window without affecting application log searches.

Answer

Increase the number of parallel search processes in the indexes.conf settings.

Answer

Add a second indexer and distribute incoming data using load balancing.

Answer

Reduce the retention period for the index from 90 days to 30 days.

Question 6

A new Splunk user wants to see all events from the last 30 minutes, but the search returns no results. The user knows data is being indexed. Which is the most likely cause?

Accepted Answer

The time range picker is set to 'All time' but the user expects 'Last 30 minutes'.. Option A is correct because the most common reason a search returns no results when data is known to be indexed is an incorrect time range picker setting. If the picker is set to 'All time', it will only show events from the beginning of the index, but if the user expects events from the last 30 minutes, they must select 'Last 30 minutes' or a custom relative time. The time range picker overrides any time modifiers in the search string, so even a correct search string will fail if the picker is set to a non-overlapping range.

Answer

Data is not yet indexed.

Answer

The search is restricted to index=_internal.

Answer

The search string has a typo in the time modifier.

Question 7

A user runs a search and sees the results in the Statistics tab, but the events are not appearing. What is the most likely reason?

Accepted Answer

The search includes a transforming command like stats.. Option C is correct because when a search includes a transforming command like `stats`, `chart`, or `timechart`, Splunk automatically converts the search results into a statistical table. This means the raw events are no longer displayed in the Statistics tab; instead, aggregated data is shown. The Events tab will be empty because the transforming command consumes the raw events to produce the statistical output.

Answer

The search is a scheduled search.

Answer

The user does not have permission to view raw events.

Answer

The time range is too narrow.

Question 8

A user wants to save a search for later use but not schedule it. Which action should the user take?

Accepted Answer

Click Save As > Search.. Option D is correct because clicking Save As > Search saves the search string and properties (time range, mode) as a reusable search without any scheduling or alerting. This allows the user to run the search manually later from the 'Searches & Reports' page without it executing on a schedule.

Answer

Click Save As > Report and schedule it.

Answer

Click Save As > Alert.

Answer

Click Save As > Dashboard Panel.

Question 9

An administrator notices that a user's search is timing out after 60 seconds. The search needs up to 5 minutes to complete. What should the administrator do?

Accepted Answer

Adjust the 'Search Results Retention' in the user's account preferences.. Option B is correct because the 'Search Results Retention' setting in a user's account preferences controls how long Splunk waits for a search to complete before timing out. By default, this is set to 60 seconds, but increasing it to 5 minutes allows the search to run to completion without being terminated prematurely.

Answer

Reduce the time range of the search to run faster.

Answer

Change the search to a real-time search to avoid timeout.

Answer

Increase the 'Search Timeout' setting in system settings.

Question 10

Which three of the following are valid ways to navigate and interact with data in the Splunk Web interface? (Choose three.)

Accepted Answer

Using the Search & Reporting app to run search queries and view results. The Search & Reporting app is the primary interface for running searches and viewing results, making it a valid way to interact with data. Configuring data inputs via the Settings menu is a standard method for bringing data into Splunk. The Dashboards feature allows users to create visualizations from saved searches, which is a core navigation and interaction capability in the Splunk Web interface.

Answer

Installing new Splunk licenses through the Splunk Home page

Answer

Creating a new indexer via the Settings menu to store incoming data

Answer

Editing Splunk configuration files directly from the web interface without command line access

Question 11

Which three options describe features or components of the Splunk default interface that are available to a Core Certified User? (Choose three.)

Accepted Answer

The Search bar allows users to enter SPL queries and use time range pickers to filter results. The Search bar, Data Summary button, and Jobs page are all core features of the Splunk default interface available to any user, including a Core Certified User. The Search bar allows entering SPL queries and selecting time ranges to filter results. The Data Summary button provides a list of all sourcetypes, hosts, and indexes accessible to the user. The Jobs page displays all currently running and completed searches initiated by the user, enabling monitoring and management of search jobs.

Answer

The Distributed Management Console (DMC) is accessible from the Splunk Home page for all users

Answer

The Settings menu includes options to manage users, roles, and authentication methods

Answer

The Alerts menu allows direct modification of alert actions without saving a search

Question 12

Which of the following are components of the Splunk interface that can be used to refine and focus search results? (Choose all that apply. There are four correct answers.)

Accepted Answer

Search History. The Time Range Picker, Search bar, Fields sidebar, and Search History are all interface components in Splunk that directly allow users to refine and focus search results. The Time Range Picker restricts results to a specific time window, the Search bar is where queries are entered and modified, the Fields sidebar enables selection and filtering of specific fields, and Search History allows reusing or refining past searches. These four tools are integral to iterative search refinement in Splunk's Search & Reporting app.

Answer

Job Inspector

Answer

Data Summary tab

Question 13

Drag and drop the steps to create a new Splunk index into the correct order.

Question 14

Drag and drop the steps to install an app from Splunkbase into the correct order.

Question 15

Match each Splunk search command to its primary function.