SPLK-1001 Splunk Basics and Interface Navigation Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A user reports they cannot log in to Splunk Web and sees this error in the logs. What is the most likely cause?

Accepted Answer

The user's session has expired or the CSRF token is invalid.. The error message indicates an invalid CSRF token or expired session, which is a security mechanism in Splunk Web that prevents cross-site request forgery. When a session expires or the CSRF token is invalid, the user cannot authenticate or maintain their session, leading to a login failure. This is distinct from incorrect credentials, which would produce a different error.

Answer

The user typed an incorrect username or password.

Answer

The Splunk indexer is not responding.

Answer

The user ran too many searches and hit a limit.

Question 2

An analyst has created a search that they want to run regularly. What is the most efficient way to save this search for future use?

Accepted Answer

Save as a report. Saving a search as a report in Splunk stores both the search string and its metadata (such as time range and permissions) in the knowledge object system, making it reusable for future ad-hoc runs, dashboard panels, or alerts without re-entering the search. Reports are the most efficient way to preserve a search for regular manual or scheduled execution, as they can be directly accessed from the Reports listing and used as the foundation for other objects like alerts or dashboards.

Answer

Export to CSV

Answer

Save as an alert

Answer

Save as a dashboard panel

Question 3

An administrator needs to find events from hosts that have reported a critical error in the last hour. Which search uses a subsearch correctly?

Accepted Answer

index=main [search index=main error="critical" | table host]. It uses a subsearch that returns a list of hosts (via `table host`) and passes that list to the outer search, which then filters events from those hosts. The outer search `index=main` combined with the subsearch result effectively becomes `index=main host= OR host= ...`, correctly retrieving events from hosts that reported a critical error in the last hour. The subsearch runs first, and its output is used as a condition in the main search.

Answer

index=main host IN [search error="critical" | fields host]

Answer

index=main | where host=[search index=main error="critical" | fields host]

Answer

index=main AND [search error="critical" | table host]

Question 4

An administrator wants to group all events from a single web session identified by session_id, where the session starts with a 'login' event and ends with a 'logout' event. Which search is correct?

Accepted Answer

index=web | transaction session_id startswith="login" endswith="logout". The `transaction` command with `startswith` and `endswith` arguments explicitly defines the boundaries of a session: it groups events that share the same `session_id` field, starting from a 'login' event and ending with a 'logout' event. This ensures that only complete sessions are returned, matching the requirement exactly.

Answer

index=web | transaction session_id

Answer

index=web | transaction session_id keepevicted=true

Answer

index=web | transaction session_id maxevents=2

Question 5

Which TWO of the following are knowledge objects in Splunk?

Accepted Answer

Field extraction. In Splunk, knowledge objects are user-created configurations that enrich and organize machine data, and both A (Field extraction) and B (Alert) qualify: field extractions define how Splunk derives fields from raw events (via props.conf/transforms.conf or the UI), and alerts are saved searches that trigger actions based on results, both being reusable knowledge artifacts. Field extraction is a classic knowledge object because it adds structure and meaning to indexed data, while an alert is a saved search with a triggering condition and is stored as a knowledge object in the Splunk knowledge manager. By contrast, C (Dashboard) is a visualization/presentation artifact rather than a knowledge object in the strict sense, D (Source type) is a data classification setting assigned at index time (not a user-created knowledge object), and E (Index) is a data storage container, not a knowledge object.

Answer

Dashboard

Answer

Source type

Answer

Index

Question 6

Which THREE of the following are steps in the process of creating a dashboard from a search?

Accepted Answer

Run a search and save as a report. Option A is correct because creating a dashboard from a search begins by running the search and saving it as a report, which becomes the reusable base for the dashboard panel. Option E is correct because the saved report must then be added as a panel to a dashboard (or a new dashboard created and the report added to it), which is the core step that turns the report into a dashboard visualization. Option C is correct because after the dashboard is built, editing permissions is a required step to allow sharing it with other users or roles. Option B is not part of this process, since data inputs are an optional enhancement added to dashboards rather than a required step in creating one from a search. Option D is not part of this process either, because scheduling an alert is a separate monitoring action performed on a saved search or report, not a step in dashboard creation.

Answer

Add data inputs

Answer

Schedule an alert

Question 7

Refer to the exhibit. What is the primary purpose of this search?

Accepted Answer

Identify top URI paths by 404 count. The search uses `top` to find the most frequent URI paths among events with a 404 status code, then displays them in descending order of count. This directly identifies the top URI paths by 404 count, making option C correct.

Answer

Count all events

Answer

List all URIs with 404 errors

Answer

Count 404 errors by URI path

Question 8

Refer to the exhibit. What does this configuration do?

Accepted Answer

It sets the host field based on IP using a transform. The configuration sets the host field based on IP using a transform, which is a common Splunk pattern for deriving host values from event data. A transform referenced in props.conf (e.g., via TRANSFORMS or a host override) uses regex to extract the IP and assign it to the host field. This is the correct interpretation of a host-setting transform.

Answer

It creates a new sourcetype

Answer

It clears the host field

Answer

It enables SSL for the sourcetype

Question 9

Refer to the exhibit. What is the effect of this command?

Accepted Answer

Configures a data output to the specified server. The command `splunk add forward-server :` configures a forwarder to send data to a specified receiving indexer or heavy forwarder. This is the standard way to set up data output from a universal forwarder to a Splunk indexer, making option A correct.

Answer

Restarts Splunk

Answer

Enables SSL for forwarding

Answer

Adds a forwarder to receive data

Question 10

A new Splunk user logs in and sees the Home page. What is the most direct way to start searching data?

Accepted Answer

Click on 'Search & Reporting' in the App bar.. The 'Search & Reporting' app is the primary interface for running searches in Splunk. When a new user logs in, they see the Home page, but the most direct way to start searching is to click on 'Search & Reporting' in the App bar, which opens the search view with the search bar and time range picker ready for input.

Answer

Click on the 'Home' button on the top left.

Answer

Go to 'Settings' and select 'Search'.

Answer

Type a search query directly into the Home page search bar.

Question 11

A dashboard developer wants to add a table that only shows the top 5 values of a field. Which dashboard editor component should they use?

Accepted Answer

Filter input. None of the listed components directly adds a table. The Filter input is an input control used to filter data, not a visualization that displays a table. To add a table, you would use a Table visualization (or Statistics Table), which is not among the options. Therefore, there is no correct answer among A–D.

Answer

Radio button input

Answer

Dropdown input

Answer

Single Value visualization

Question 12

Which TWO of the following are features available in the Splunk Web interface under the 'Settings' menu?

Accepted Answer

Knowledge. Option B (Knowledge) is correct because the Settings menu in Splunk Web contains a Knowledge section that groups object management pages such as Fields, Field extractions, Lookups, Tags, Event types, and other knowledge objects. Option C (Data Inputs) is correct because Settings includes a Data section with Data Inputs, where administrators configure and manage inputs like Files & Directories, Forwarders, HTTP Event Collector, and Scripts. Options A (Reports) and D (Dashboards) are not under Settings; they are accessed from the top-level Searches, Reports, and Alerts and Dashboards menus (or the app navigation bar). Option E (Search Center) is not a Settings item either; searching is performed via the Search & Reporting app, not through a Settings menu entry.

Answer

Reports

Answer

Dashboards

Answer

Search Center

Question 13

Which THREE of the following are elements of the Splunk search interface?

Accepted Answer

Time Range Picker. The Time Range Picker (A) is a core element of the Splunk search interface, allowing users to constrain results to a specific time window (e.g., Last 24 hours, All time) before or after running a search. The Mode Selector (D) is also part of the search interface, letting users choose between Fast, Smart, and Verbose modes to control how much field extraction and event processing Splunk performs. The Search Bar (E) is the primary input element where users type SPL (Search Processing Language) queries and press Enter to execute searches. The Visualization Tab (B) is not a standard element of the search interface itself — visualizations are accessed via the Visualization tab within the Search & Reporting app's results area, but it is not counted among the three core interface elements tested here. The Save Button (C) is likewise not a defining element of the Splunk search interface; saving searches is done through the Save As menu, not a dedicated interface element.

Answer

Visualization Tab

Answer

Save Button

Question 14

The exhibit shows log output from a Splunk search head. What is the most likely performance issue indicated?

Accepted Answer

The 'error_count' search is inefficient, consuming high CPU for few results.. The 'error_count' search is inefficient because it likely uses a large, unoptimized search over many events to produce a small count, consuming high CPU. This is a classic case of a search that scans too much data for minimal output, often due to missing index-time optimizations or using inefficient commands like 'search error_count' without narrowing the time range or using indexed fields.

Answer

The 'login_failures' search is scanning too many events.

Answer

The search head is overloaded due to multiple simultaneous searches.

Answer

There are duplicate search job IDs (SIDs) conflicting.

Question 15

A new user accidentally closed the search bar while in the Search & Reporting app and can no longer see it. What is the most direct way to restore the search bar?

Accepted Answer

Click on the 'Search & Reporting' app link in the top menu bar.. The search bar is part of the Search & Reporting app interface. Clicking the 'Search & Reporting' app link in the top menu bar reloads the app and restores its default view, including the search bar. This is the most direct method because it reinitializes the app's UI components without requiring a full page refresh or server restart.

Answer

Refresh the browser page.

Answer

Go to Settings > Search bar and re-enable it.

Answer

Restart the Splunk server.