SPLK-1002 Splunk Basics and Interface Navigation Practice Test 3 — 15 Questions

Question 1

Match each search command to its category.

Question 2

A user runs a search and sees "No results found". The time range is set to "All time". Data exists in the index "main" and sourcetype "access_combined". Which is the most likely cause?

Accepted Answer

The search string contains a typo.. Option B is correct because the most common cause of 'No results found' when data is confirmed to exist in the index and sourcetype is a typo in the search string. Splunk's search engine performs exact string matching against indexed tokens, so even a minor misspelling (e.g., 'acces_combined' instead of 'access_combined') will return zero results. The user has already verified data exists, so the issue is likely in the search syntax itself.

Answer

The index is disabled.

Answer

The user lacks read permissions on the index.

Answer

The time range is too narrow.

Question 3

A user wants to see a list of all sourcetypes in the index "main". Which search command should be used?

Accepted Answer

| stats count by sourcetype. The `stats count by sourcetype` command groups events by sourcetype and returns a table listing each unique sourcetype along with its event count, effectively showing all sourcetypes present in the index. This is the correct approach because it uses aggregation to enumerate distinct values of the sourcetype field across the entire result set.

Answer

| fields sourcetype

Answer

| data sourcetype

Answer

| top sourcetype

Question 4

A user notices that a search returns results only from the last 15 minutes, even though the time range picker is set to "All time". The search string is: error | timechart count. Which is the most likely cause?

Accepted Answer

The search includes an implicit time range like earliest=-15m@m in a saved search or settings.. Option B is correct because the search includes an implicit time range, such as `earliest=-15m@m`, which overrides the global time range picker set to 'All time'. This can occur in saved search settings or search macros, forcing the search to only look at the last 15 minutes regardless of the picker selection. The `timechart` command does not impose a time window itself; it only aggregates results within the time range provided by the search.

Answer

The user selected All time but applied a subsearch.

Answer

The indexer is only returning recent data due to performance.

Answer

The timechart command defaults to a 15-minute window.

Question 5

Which tab in the Search app should be used to view the raw events in their original format?

Accepted Answer

Events. The Events tab in the Search app displays raw events in their original format, showing the complete log line as indexed by Splunk. This tab is the default view when running a search and provides the full event data without any aggregation or transformation.

Answer

Patterns

Answer

Statistics

Answer

Visualization

Question 6

To create a real-time dashboard panel showing errors in the last 30 minutes, which time range setting should be used?

Accepted Answer

Real-time (30 minutes). Option C is correct because a real-time dashboard panel that shows errors in the last 30 minutes requires a 'Real-time' time range with a specific window of 30 minutes. In Splunk, the 'Real-time (30 minutes)' setting continuously updates the panel to show events from the current time back 30 minutes, which is exactly what is needed for monitoring recent errors as they occur.

Answer

Real-time

Answer

Last 30 minutes

Answer

All time

Question 7

A user needs to export search results to a CSV file for further analysis. Which method is the most straightforward?

Accepted Answer

Click the Export button and select CSV.. Option A is correct because clicking the Export button and selecting CSV is the most straightforward method for exporting search results to a CSV file in Splunk. This GUI-based approach requires no knowledge of specific commands and is accessible directly from the Search & Reporting app's results page, making it ideal for quick data extraction without altering the search logic.

Answer

Use the | outputcsv command.

Answer

Use the | csv command.

Answer

Use the | append command.

Question 8

From the Splunk Home page, which of the following can be accessed directly?

Accepted Answer

All of the above. The Splunk Home page provides direct access to the Search app, Settings, and Dashboards via its navigation bar and default landing page tiles. Option A is correct because all listed items are accessible from the Home page without requiring additional navigation steps.

Answer

Settings

Answer

Search app

Answer

Dashboards

Question 9

A search using index=security sourcetype=windows_security returns events with EventCode=4625. The user wants to find the top 10 source IP addresses. Which search will accomplish this?

Accepted Answer

index=security sourcetype=windows_security EventCode=4625 | rex field=Account "from (\d+\.\d+\.\d+\.\d+)" | top 10 ip. Option A is correct because it first filters for EventCode=4625 (failed logon events), then uses a regular expression with `rex` to extract the source IP address from the `Account` field (which in Windows security logs for event 4625 contains the source IP in the format 'from x.x.x.x'), and finally uses `top 10` to display the ten most frequent IP addresses. This directly answers the user's requirement to find the top 10 source IP addresses from the failed logon events.

Answer

index=security sourcetype=windows_security EventCode=4625 | top 10 Account

Answer

index=security sourcetype=windows_security | top 10 src_ip

Answer

index=security sourcetype=windows_security EventCode=4625 | table Account | top 10

Question 10

A user wants to view only specific fields in the search results. Which interface element can be used to select which fields to show?

Accepted Answer

Fields sidebar. Option B is correct. The Fields sidebar allows selecting fields to show. Option A shows events but not field selection. Option C is for statistics. Option D is for patterns.

Answer

Statistics tab

Answer

Events tab

Answer

Patterns tab

Question 11

Which two tabs are always present in the search results page? (Select TWO)

Accepted Answer

Events. The Events and Statistics tabs are always present on the search results page because they represent the two fundamental views of search results: the raw event data (Events) and the tabular summary of statistical calculations (Statistics). Even if a search does not produce events or statistics, these tabs remain visible as placeholders, ensuring consistent navigation.

Answer

Visualization

Answer

Patterns

Answer

Fields

Question 12

Which two of the following search commands can be used to rename a field? (Select TWO)

Accepted Answer

rename. Options A and C are correct. The rename command explicitly renames a field. The eval command can rename by assigning a new name to the same value. The fields command selects fields but does not rename. The table command renames only as column headers. The spath command extracts fields from structured data.

Answer

table

Answer

fields

Answer

spath

Question 13

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Accepted Answer

Save as alert. The 'Save As' menu in the Search app provides direct options to persist search results as an alert, a report, or a dashboard panel. 'Save as alert' (A) creates a scheduled search that triggers actions when conditions are met, which is a core feature for proactive monitoring.

Answer

Save as event type

Answer

Save as search macro

Question 14

What is the purpose of this search?

Accepted Answer

To find the top 10 most accessed web pages that returned a 404 status.. Option A is correct. The search filters for 404 status codes from the web access logs and then finds the top 10 most accessed URI paths. Option B lists all 404 errors, not just top 10. Option C counts unique URLs but does not use top. Option D shows IP addresses, not URI paths.

Answer

To show the top 10 IP addresses causing 404 errors.

Answer

To list all 404 errors from the web index.

Answer

To count the number of unique URLs with 404 errors.

Question 15

This is a props.conf configuration snippet. What does it configure?

Accepted Answer

Global default values for host, index, and sourcetype.. Option A is correct because the `[default]` stanza in props.conf sets global default values for host, index, and sourcetype that apply to all data inputs unless overridden by a more specific stanza. This stanza is processed first and provides fallback values for any event that does not match a source, sourcetype, or host-specific configuration.

Answer

Settings for the host server1.

Answer

Settings for the syslog sourcetype.

Answer

Default values for all inputs.