SPLK-1002 Splunk Basics and Interface Navigation Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. A user reports they cannot log in to Splunk Web and sees this error in the logs. What is the most likely cause?

Accepted Answer

The user's session has expired or the CSRF token is invalid.. Option A is correct because CSRF token failures indicate a session or security token issue, often due to an expired or invalid session. Option B is wrong because authentication failed would show a different error. Option C is wrong because too many search jobs would not cause a CSRF error. Option D is wrong because indexer connectivity issues show different errors.

Answer

The user typed an incorrect username or password.

Answer

The Splunk indexer is not responding.

Answer

The user ran too many searches and hit a limit.

Question 2

A user runs a search that returns many results. Which action in the Timeline histogram allows the user to narrow the result set to a specific time range?

Accepted Answer

Click and drag across the timeline. Clicking and dragging across the timeline highlights a time range and automatically adjusts the search time bounds. Double-clicking only selects a single bucket, zoom to selection button appears after drag, right-click filter is not available.

Answer

Double-click on the timeline bar

Answer

Right-click and choose 'Filter by time'

Answer

Click the 'Zoom to selection' button

Question 3

An analyst has created a search that they want to run regularly. What is the most efficient way to save this search for future use?

Accepted Answer

Save as a report. Saving as a report allows scheduling and easy reuse. Alerts are for triggering actions, dashboards combine multiple panels, and export is only for current results.

Answer

Export to CSV

Answer

Save as an alert

Answer

Save as a dashboard panel

Question 4

A user wants to search only data from the 'security' index. Which search syntax should they use?

Accepted Answer

index=security. Option D is correct because in Splunk, the `index` field specifies which index to search, and data is organized into indexes. To restrict a search to data from a specific index, you use `index=<index_name>`. Here, `index=security` tells Splunk to only search events stored in the 'security' index, which is the precise syntax required.

Answer

source=security

Answer

sourcetype=security

Answer

host=security

Question 5

After running a search, the Fields sidebar shows several fields but the analyst wants to see all fields. Which button should they click?

Accepted Answer

The gear icon next to 'Selected Fields'. The gear icon next to 'Selected Fields' opens a dialog to add/remove fields from the sidebar.

Answer

'Add field' button

Answer

'All fields' button

Answer

'Show all fields' checkbox

Question 6

An administrator needs to find events from hosts that have reported a critical error in the last hour. Which search uses a subsearch correctly?

Accepted Answer

index=main [search index=main error="critical" | table host]. Option D is correct because it uses a subsearch that returns a list of hosts (via `table host`) and passes that list to the outer search, which then filters events from those hosts. The outer search `index=main` combined with the subsearch result effectively becomes `index=main host= OR host= ...`, correctly retrieving events from hosts that reported a critical error in the last hour. The subsearch runs first, and its output is used as a condition in the main search.

Answer

index=main host IN [search error="critical" | fields host]

Answer

index=main | where host=[search index=main error="critical" | fields host]

Answer

index=main AND [search error="critical" | table host]

Question 7

An analyst needs to count the number of distinct IP addresses that accessed a server. Which approach is most efficient?

Accepted Answer

| stats dc(src_ip). `stats dc(src_ip)` directly computes distinct count of src_ip, avoiding unnecessary sorting or dedup.

Answer

| stats count by src_ip

Answer

| dedup src_ip | stats count

Answer

| fields src_ip | sort | uniq

Question 8

A security team wants to add department info from an external CSV file to events containing user IDs. The CSV has columns 'userid' and 'department'. What is the correct configuration?

Accepted Answer

Define a lookup definition with userid as input field and department as output field, then use | lookup department_lookup userid OUTPUT department. The correct Splunk approach is to define a lookup definition (via Settings > Lookups), then use the lookup command with the definition name and matching fields.

Answer

Define a lookup definition, then use | inputlookup department.csv

Answer

Define a lookup table, then use | lookup department.csv userid OUTPUT department

Answer

Use | join userid with department.csv

Question 9

A user selects 'Last 24 hours' from the time picker but their search returns events from only the last hour. What is the most likely cause?

Accepted Answer

The search includes a constraint like `earliest=-1h`. If the search includes an explicit earliest or latest override, that takes precedence over the time picker. Other options would affect data availability or visibility.

Answer

The user's role restricts time ranges

Answer

The indexer is down, preventing older events from being retrieved

Answer

The timezone is misconfigured, shifting the time range

Question 10

An administrator wants to group all events from a single web session identified by session_id, where the session starts with a 'login' event and ends with a 'logout' event. Which search is correct?

Accepted Answer

index=web | transaction session_id startswith="login" endswith="logout". The transaction command with startswith and endswith parameters groups events based on field values. The session_id field ties events together.

Answer

index=web | transaction session_id

Answer

index=web | transaction session_id keepevicted=true

Answer

index=web | transaction session_id maxevents=2

Question 11

Which TWO of the following are knowledge objects in Splunk?

Accepted Answer

Field extraction. Field extractions and alerts are considered knowledge objects that enrich data or trigger actions. Dashboards are saved objects but not knowledge objects per se; indexes and sourcetypes are core data definitions.

Answer

Dashboard

Answer

Source type

Answer

Index

Question 12

Which THREE of the following are valid ways to narrow search results?

Accepted Answer

Using the time range picker. Option A is correct because the time range picker in Splunk restricts the search to events within a specified time window, reducing the dataset before the search executes. This is a fundamental way to narrow results by limiting the scope of indexed data that the search head retrieves from indexers.

Answer

Deleting events

Answer

Changing the source type

Question 13

Which THREE of the following are steps in the process of creating a dashboard from a search?

Accepted Answer

Run a search and save as a report. Option A is correct because in Splunk, the standard workflow for creating a dashboard from a search involves first running a search, then saving it as a report. This report serves as a reusable data source that can be added as a panel to a dashboard. Without saving the search as a report, you cannot directly add it to a dashboard panel.

Answer

Add data inputs

Answer

Schedule an alert

Question 14

Refer to the exhibit. What is the primary purpose of this search?

Accepted Answer

Identify top URI paths by 404 count. The search filters for 404 errors, counts them by URI path, then sorts descending to show the most frequent error paths at the top. This identifies top error URIs.

Answer

Count all events

Answer

List all URIs with 404 errors

Answer

Count 404 errors by URI path

Question 15

Refer to the exhibit. What does this configuration do?

Accepted Answer

It sets the host field based on IP using a transform. This props.conf stanza applies a transform named 'set_host_from_ip' to all events of sourcetype 'my_sourcetype'. Transforms typically modify field values; this one sets the host field based on the source IP.

Answer

It creates a new sourcetype

Answer

It clears the host field

Answer

It enables SSL for the sourcetype

SPLK-1002 Splunk Basics and Interface Navigation Practice Test 5 — 15 Questions

Exhibit

SPLK-1002 Splunk Basics and Interface Navigation Practice Test 5 — 15 Questions

Exhibit