SPLK-1002 Splunk Basics and Interface Navigation — Timed 50 Questions

Question 1

A new Splunk user wants to view the raw event data for the last hour. Which interface should they use?

Accepted Answer

Search & Reporting. The Search & Reporting interface (D) is the primary Splunk app for running searches and viewing raw event data. By default, it shows events from the last 24 hours, but the user can easily set the time range picker to 'Last hour' to see raw events for that period. This interface provides the search bar, timeline, and event listing necessary to inspect raw data.

Answer

Search History

Answer

Settings

Answer

Data Summary

Question 2

An analyst notices that searches take long to complete. They want to understand how many events are indexed per second. Which tab in the Monitoring Console provides this information?

Accepted Answer

Indexing Performance. The Monitoring Console's 'Indexing Performance' tab provides real-time metrics on indexing throughput, including events per second (EPS) and indexing latency. This directly answers the analyst's need to understand how many events are indexed per second, as it displays the rate at which data is being processed and written to indexes.

Answer

License Usage

Answer

Search Performance

Answer

Forwarder Management

Question 3

A search returns no results. The user has verified that data is being indexed. What is the most likely cause?

Accepted Answer

The time range picker is set incorrectly. The most likely cause is that the time range picker is set incorrectly. Even if data is being indexed and the search terms are correct, Splunk restricts search results to the selected time range. If the time range does not cover the period when the data was indexed, the search will return no results. This is a common issue because the default time range is often set to "Last 24 hours" or "All time" depending on the user's last selection.

Answer

The search term is misspelled

Answer

The search is using incorrect index name

Answer

The user lacks search permissions

Question 4

After running a search, a user wants to save the search for later use. Which button should they click?

Accepted Answer

Save As. Option C is correct because the 'Save As' button in Splunk allows a user to save a completed search as a report, alert, or dashboard panel for later use. This is the standard method for persisting a search definition without executing it immediately, enabling reuse in the future.

Answer

Export

Answer

Share

Answer

Schedule

Question 5

A user wants to see a visual representation of search results over time. Which tab should they use?

Accepted Answer

Visualizations. The Visualizations tab is the correct choice because it provides a graphical representation of search results, such as charts, graphs, and time-series plots, which are essential for visualizing trends over time. In Splunk, after running a search, the user can switch to the Visualizations tab to select from various chart types (e.g., line, column, area) that automatically map the _time field to the x-axis, enabling temporal analysis. This tab is specifically designed for transforming tabular search results into visual formats, making it the appropriate tool for seeing data over time.

Answer

Patterns

Answer

Events

Answer

Statistics

Question 6

During onboarding, a new user can't find any data in Splunk. They see 'No results found' for all searches. The data is being forwarded from a universal forwarder. What should they check first?

Accepted Answer

Check if the forwarder is configured to send to the correct indexer. Option B is correct because the most common reason a universal forwarder sends data that never appears in Splunk is misconfiguration of the outputs.conf file. The forwarder must specify the correct indexer IP address or hostname and the receiving port (default 9997) using the TCP output stanza; if this is wrong, data is sent to the wrong destination or nowhere at all. Checking the forwarder's configuration first isolates whether data is even reaching the indexer tier before investigating other potential issues.

Answer

Check if the user has admin role

Answer

Check if the firewall is blocking ports

Answer

Check if the search is using the correct time range

Question 7

Which of the following is the default time range in a new Splunk search?

Accepted Answer

All time. When you open a new search in Splunk, the default time range is set to 'All time' (no time filter), meaning the search will scan all indexed data unless you explicitly specify a time range. This is because Splunk defaults to showing all available events to avoid inadvertently excluding data, and it is the user's responsibility to narrow the search scope.

Answer

Last 24 hours

Answer

Last 7 days

Answer

Real-time

Question 8

A user wants to view only the fields that appear in the current search results, without seeing all extracted fields. Which option should they use?

Accepted Answer

Selected fields. The 'Selected fields' option in Splunk displays only the fields that appear in the current search results, allowing users to focus on relevant data without being overwhelmed by all extracted fields. This is distinct from the 'All fields' view, which shows every field extracted from the raw data, including those not present in the current results.

Answer

Field picker

Answer

All fields

Answer

Interesting fields

Question 9

Which TWO of the following are valid ways to share a Splunk dashboard?

Accepted Answer

Share via URL. Option B is correct because Splunk dashboards can be shared via a direct URL, which allows other users with appropriate permissions to access the dashboard in their own Splunk instance. This method leverages Splunk's role-based access control to ensure only authorized users can view the shared content.

Answer

Send via email

Answer

Export as PDF

Answer

Clone dashboard

Question 10

Which THREE of the following are features available in the Splunk Settings menu?

Accepted Answer

Indexes. The Splunk Settings menu provides administrative controls for configuring core system components. Indexes (B) are correct because this menu allows you to create, edit, and manage index definitions, including setting retention policies and storage locations. Data inputs (C) is correct as the menu provides access to configure all input types (e.g., monitor, script, syslog, HTTP Event Collector). Roles (E) is correct because the Settings menu includes the Access Controls section where you can define role-based permissions and capabilities.

Answer

Data summary

Answer

Search history

Question 11

Which TWO of the following are default Splunk roles?

Accepted Answer

admin. The 'admin' role is one of the default Splunk roles, providing full administrative access to all Splunk capabilities, including user management, knowledge object management, and system configuration. The 'user' role is also a default role, granting basic search and data access permissions to end users. These two roles are created automatically during Splunk installation and cannot be deleted.

Answer

power

Answer

manager

Answer

operator

Question 12

Refer to the exhibit. What can be determined about the license usage?

Accepted Answer

180 MB of license capacity is available. The pool has a max size of 500 MB and used size of 320 MB, meaning 180 MB is available. The pool is not full. The stack ID indicates it's for enterprise license, but not necessarily all used for search. The pool is not over-allocated.

Answer

320 MB of license is used for search

Answer

The pool is over-allocated

Answer

The license is expired

Question 13

Refer to the exhibit. What is the most likely cause of the error?

Accepted Answer

The KV Store is not running. The error message in the exhibit indicates that the KV Store is not running. The KV Store is a Splunk component that stores knowledge objects (such as lookups, data models, and saved searches) in a MongoDB-based key-value store. When the KV Store is down, Splunk cannot access these objects, leading to the displayed error. Restarting the KV Store or ensuring it is enabled in the server.conf file resolves the issue.

Answer

The firewall is blocking port 8191

Answer

The search head is overloaded

Answer

The indexer is out of disk space

Question 14

A medium-sized enterprise uses Splunk Enterprise with a single indexer and one search head. They have 50 universal forwarders sending data from web servers, application servers, and database logs. Recently, the indexer crashed during peak hours. The administrator restarted the indexer and it came back up. After analyzing the crash log, they found that the indexer ran out of memory. The indexer has 16 GB RAM and the default memory settings. The daily indexing volume is about 20 GB. The administrator is concerned about stability. They want to prevent future crashes without adding hardware. What should they do?

Accepted Answer

Reduce the max memory for the indexer process in limits.conf. Option C is correct because the indexer crashed due to running out of memory with 16 GB RAM and default settings. Reducing the max memory for the indexer process in limits.conf (specifically the maxMemMB parameter) limits the heap size used by Splunk, preventing out-of-memory (OOM) kills during peak indexing loads. This is a software-level tuning that avoids hardware upgrades by capping memory consumption to a safe level below the physical RAM.

Answer

Reduce the number of forwarders sending data

Answer

Switch universal forwarders to heavy forwarders

Answer

Increase the max memory for the indexer process in limits.conf

Question 15

A user at a large organization runs a search that returns 50,000 events. They need to export these events to a CSV file for further analysis in Excel. However, when they click the Export button and select CSV, only 10,000 events are exported. What is the most likely reason and how should they export all 50,000 events?

Accepted Answer

The export function has a default limit of 10,000 events; use the 'Export Results' feature with output_mode=csv. Option D is correct because the Splunk export function has a default limit of 10,000 events when exporting via the UI. To export all 50,000 events, the user must use the 'Export Results' feature with the `output_mode=csv` parameter, which bypasses the UI limit and allows exporting the full result set.

Answer

The user does not have permissions to export more than 10,000 events

Answer

The report view limits export to 10,000 events; create a dashboard panel instead

Answer

The search itself is limited to 10,000 events by default

Question 16

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

Accepted Answer

Search bar in the Search & Reporting app. The Search bar in the Search & Reporting app is the primary interface for running ad-hoc searches across all indexed data. By entering the suspicious IP address directly into the search bar, the analyst can quickly retrieve all events containing that IP from any log source, leveraging Splunk's search-time field extraction and index-time data ingestion.

Answer

Data Summary

Answer

Dashboard panel

Answer

Alert action

Question 17

A Splunk administrator notices that a new user cannot see any data in the Search & Reporting app, even though the user has the 'user' role. What is the most likely cause?

Accepted Answer

The user has not been granted access to any indexes.. The 'user' role in Splunk includes the 'search' capability by default, which allows users to run searches. However, even with the search capability, a user cannot see any data unless they have explicit read access to one or more indexes. Index-level access is controlled via roles, and the default 'user' role does not grant access to any indexes; it only provides the ability to search indexes that the user has been granted access to. Therefore, the most likely cause is that the new user has not been assigned to a role that includes index access.

Answer

The user does not have the 'search' capability.

Answer

The user is limited to viewing only saved searches.

Answer

The user is not using the correct time range.

Question 18

Which TWO of the following are valid ways to add data to Splunk?

Accepted Answer

Deploying a universal forwarder to monitor a log file.. Option A is correct because a universal forwarder is a dedicated Splunk component designed to collect and forward log data to a Splunk indexer. It monitors specified log files, sends data over a secure TCP connection (default port 9997), and is the standard method for scalable, production-grade data ingestion.

Answer

Creating an alert that writes results to a summary index.

Answer

Using the 'Add Data' button in Splunk Web.

Answer

Typing data directly into the search bar.

Question 19

Refer to the exhibit. After running the search, the user wants to see only events where the HTTP status is 404. Which change to the search is correct?

Accepted Answer

Change the search to: index=main sourcetype=access_combined status=404 | stats count. Option B is correct because adding `status=404` directly in the base search filters events at the index level before any processing, which is the most efficient approach. The `stats count` command then aggregates the filtered results, ensuring only events with HTTP status 404 are included. This leverages Splunk's index-time filtering to reduce data volume early in the pipeline.

Answer

Add | where status=404 after the sort command.

Answer

Add | rename status as status_code and search for status_code=404.

Answer

Replace stats with top limit=1 status.

Question 20

You are a Splunk administrator at a mid-sized company that uses Splunk Enterprise to monitor application logs from a web server cluster. The cluster has five servers, each sending logs via a universal forwarder to a single indexer. The indexer has ample resources. Recently, users have complained that searches for the last 24 hours are slow, but searches for the last hour are fast. The data volume is about 50 GB per day. You suspect the issue is related to how data is stored or indexed. Which action should you take first to improve search performance for the 24-hour time range?

Accepted Answer

Exclude internal Splunk logs (splunkd.log) from being indexed by setting up appropriate input configurations on forwarders.. Option C is correct because internal Splunk logs (splunkd.log) can generate significant volume and are indexed by default, consuming resources and slowing searches over longer time ranges. Excluding them on the forwarders reduces the total indexed data, improving search performance for the 24-hour window without affecting application log searches.

Answer

Increase the number of parallel search processes in the indexes.conf settings.

Answer

Add a second indexer and distribute incoming data using load balancing.

Answer

Reduce the retention period for the index from 90 days to 30 days.