SPLK-1001 Splunk Basics and Interface Navigation Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. What can be determined about the license usage?

Accepted Answer

180 MB of license capacity is available. The pool has a max size of 500 MB and used size of 320 MB, meaning 180 MB is available. The pool is not full. The stack ID indicates it's for enterprise license, but not necessarily all used for search. The pool is not over-allocated.

Answer

320 MB of license is used for search

Answer

The pool is over-allocated

Answer

The license is expired

Question 2

Refer to the exhibit. What is the most likely cause of the error?

Accepted Answer

The KV Store is not running. The error message in the exhibit indicates that the KV Store is not running. The KV Store is a Splunk component that stores knowledge objects (such as lookups, data models, and saved searches) in a MongoDB-based key-value store. When the KV Store is down, Splunk cannot access these objects, leading to the displayed error. Restarting the KV Store or ensuring it is enabled in the server.conf file resolves the issue.

Answer

The firewall is blocking port 8191

Answer

The search head is overloaded

Answer

The indexer is out of disk space

Question 3

A medium-sized enterprise uses Splunk Enterprise with a single indexer and one search head. They have 50 universal forwarders sending data from web servers, application servers, and database logs. Recently, the indexer crashed during peak hours. The administrator restarted the indexer and it came back up. After analyzing the crash log, they found that the indexer ran out of memory. The indexer has 16 GB RAM and the default memory settings. The daily indexing volume is about 20 GB. The administrator is concerned about stability. They want to prevent future crashes without adding hardware. What should they do?

Accepted Answer

Reduce the max memory for the indexer process in limits.conf. The indexer crashed due to running out of memory with 16 GB RAM and default settings. Reducing the max memory for the indexer process in limits.conf (specifically the maxMemMB parameter) limits the heap size used by Splunk, preventing out-of-memory (OOM) kills during peak indexing loads. This is a software-level tuning that avoids hardware upgrades by capping memory consumption to a safe level below the physical RAM.

Answer

Reduce the number of forwarders sending data

Answer

Switch universal forwarders to heavy forwarders

Answer

Increase the max memory for the indexer process in limits.conf

Question 4

A user at a large organization runs a search that returns 50,000 events. They need to export these events to a CSV file for further analysis in Excel. However, when they click the Export button and select CSV, only 10,000 events are exported. What is the most likely reason and how should they export all 50,000 events?

Accepted Answer

The export function has a default limit of 10,000 events; use the 'Export Results' feature with output_mode=csv. The Splunk export function has a default limit of 10,000 events when exporting via the UI. To export all 50,000 events, the user must use the 'Export Results' feature with the `output_mode=csv` parameter, which bypasses the UI limit and allows exporting the full result set.

Answer

The user does not have permissions to export more than 10,000 events

Answer

The report view limits export to 10,000 events; create a dashboard panel instead

Answer

The search itself is limited to 10,000 events by default

Question 5

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

Accepted Answer

Search bar in the Search & Reporting app. The Search bar in the Search & Reporting app is the primary interface for running ad-hoc searches across all indexed data. By entering the suspicious IP address directly into the search bar, the analyst can quickly retrieve all events containing that IP from any log source, leveraging Splunk's search-time field extraction and index-time data ingestion.

Answer

Data Summary

Answer

Dashboard panel

Answer

Alert action

Question 6

A Splunk administrator notices that a new user cannot see any data in the Search & Reporting app, even though the user has the 'user' role. What is the most likely cause?

Accepted Answer

The user has not been granted access to any indexes.. The 'user' role in Splunk includes the 'search' capability by default, which allows users to run searches. However, even with the search capability, a user cannot see any data unless they have explicit read access to one or more indexes. Index-level access is controlled via roles, and the default 'user' role does not grant access to any indexes; it only provides the ability to search indexes that the user has been granted access to. Therefore, the most likely cause is that the new user has not been assigned to a role that includes index access.

Answer

The user does not have the 'search' capability.

Answer

The user is limited to viewing only saved searches.

Answer

The user is not using the correct time range.

Question 7

Which TWO of the following are valid ways to add data to Splunk?

Accepted Answer

Deploying a universal forwarder to monitor a log file.. A universal forwarder is a dedicated Splunk component designed to collect and forward log data to a Splunk indexer. It monitors specified log files, sends data over a secure TCP connection (default port 9997), and is the standard method for scalable, production-grade data ingestion.

Answer

Creating an alert that writes results to a summary index.

Answer

Using the 'Add Data' button in Splunk Web.

Answer

Typing data directly into the search bar.

Question 8

Refer to the exhibit. After running the search, the user wants to see only events where the HTTP status is 404. Which change to the search is correct?

Accepted Answer

Change the search to: index=main sourcetype=access_combined status=404 | stats count. Adding `status=404` directly in the base search filters events at the index level before any processing, which is the most efficient approach. The `stats count` command then aggregates the filtered results, ensuring only events with HTTP status 404 are included. This leverages Splunk's index-time filtering to reduce data volume early in the pipeline.

Answer

Add | where status=404 after the sort command.

Answer

Add | rename status as status_code and search for status_code=404.

Answer

Replace stats with top limit=1 status.

Question 9

You are a Splunk administrator at a mid-sized company that uses Splunk Enterprise to monitor application logs from a web server cluster. The cluster has five servers, each sending logs via a universal forwarder to a single indexer. The indexer has ample resources. Recently, users have complained that searches for the last 24 hours are slow, but searches for the last hour are fast. The data volume is about 50 GB per day. You suspect the issue is related to how data is stored or indexed. Which action should you take first to improve search performance for the 24-hour time range?

Accepted Answer

Exclude internal Splunk logs (splunkd.log) from being indexed by setting up appropriate input configurations on forwarders.. Internal Splunk logs (splunkd.log) can generate significant volume and are indexed by default, consuming resources and slowing searches over longer time ranges. Excluding them on the forwarders reduces the total indexed data, improving search performance for the 24-hour window without affecting application log searches.

Answer

Increase the number of parallel search processes in the indexes.conf settings.

Answer

Add a second indexer and distribute incoming data using load balancing.

Answer

Reduce the retention period for the index from 90 days to 30 days.

Question 10

A new Splunk user wants to see all events from the last 30 minutes, but the search returns no results. The user knows data is being indexed. Which is the most likely cause?

Accepted Answer

The time range picker is set to 'All time' but the user expects 'Last 30 minutes'.. The most common reason a search returns no results when data is known to be indexed is an incorrect time range picker setting. If the picker is set to 'All time', it will only show events from the beginning of the index, but if the user expects events from the last 30 minutes, they must select 'Last 30 minutes' or a custom relative time. The time range picker overrides any time modifiers in the search string, so even a correct search string will fail if the picker is set to a non-overlapping range.

Answer

Data is not yet indexed.

Answer

The search is restricted to index=_internal.

Answer

The search string has a typo in the time modifier.

Question 11

A user runs a search and sees the results in the Statistics tab, but the events are not appearing. What is the most likely reason?

Accepted Answer

The search includes a transforming command like stats.. When a search includes a transforming command like `stats`, `chart`, or `timechart`, Splunk automatically converts the search results into a statistical table. This means the raw events are no longer displayed in the Statistics tab; instead, aggregated data is shown. The Events tab will be empty because the transforming command consumes the raw events to produce the statistical output.

Answer

The search is a scheduled search.

Answer

The user does not have permission to view raw events.

Answer

The time range is too narrow.

Question 12

A user wants to save a search for later use but not schedule it. Which action should the user take?

Accepted Answer

Click Save As > Search.. Clicking Save As > Search saves the search string and properties (time range, mode) as a reusable search without any scheduling or alerting. This allows the user to run the search manually later from the 'Searches & Reports' page without it executing on a schedule.

Answer

Click Save As > Report and schedule it.

Answer

Click Save As > Alert.

Answer

Click Save As > Dashboard Panel.

Question 13

An administrator notices that a user's search is timing out after 60 seconds. The search needs up to 5 minutes to complete. What should the administrator do?

Accepted Answer

Increase the 'Search Timeout' setting in system settings.. The 'Search Timeout' setting under Settings > System settings controls the maximum time a search job can run before being terminated. By default it is 60 seconds; increasing it to 5 minutes allows the search to complete. Option B is incorrect because 'Search Results Retention' in account preferences controls how long completed results are saved, not the timeout for running searches.

Answer

Reduce the time range of the search to run faster.

Answer

Adjust the 'Search Results Retention' in the user's account preferences.

Answer

Change the search to a real-time search to avoid timeout.

Question 14

Which three of the following are valid ways to navigate and interact with data in the Splunk Web interface? (Choose three.)

Accepted Answer

Using the Search & Reporting app to run search queries and view results. The Search & Reporting app is the primary interface for running searches and viewing results, making it a valid way to interact with data. Configuring data inputs via the Settings menu is a standard method for bringing data into Splunk. The Dashboards feature allows users to create visualizations from saved searches, which is a core navigation and interaction capability in the Splunk Web interface.

Answer

Installing new Splunk licenses through the Splunk Home page

Answer

Editing Splunk configuration files directly from the web interface without command line access

Answer

Creating a new indexer via the Settings menu to store incoming data

Question 15

Which three options describe features or components of the Splunk default interface that are available to a Core Certified User? (Choose three.)

Accepted Answer

The Search bar allows users to enter SPL queries and use time range pickers to filter results. The Search bar, Data Summary button, and Jobs page are all core features of the Splunk default interface available to any user, including a Core Certified User. The Search bar allows entering SPL queries and selecting time ranges to filter results. The Data Summary button provides a list of all sourcetypes, hosts, and indexes accessible to the user. The Jobs page displays all currently running and completed searches initiated by the user, enabling monitoring and management of search jobs.

Answer

The Alerts menu allows direct modification of alert actions without saving a search

Answer

The Distributed Management Console (DMC) is accessible from the Splunk Home page for all users

Answer

The Settings menu includes options to manage users, roles, and authentication methods