SPLK-1002 Timed Practice Test 5 — 10 Questions

Question 1

Which three options describe recommended practices for optimizing and maintaining data model acceleration? (Choose three.)

Accepted Answer

Accelerate only the data models that are used frequently in searches to conserve disk space and system resources.. Accelerating only frequently used data models conserves disk space and system resources by avoiding unnecessary summary builds. Setting the acceleration time range to match the most common search timeframe ensures that the accelerated data aligns with user query patterns, maximizing efficiency. Scheduling the acceleration summary rebuild during off-peak hours minimizes the performance impact on concurrent searches, as the rebuild process consumes significant CPU and I/O resources.

Answer

Use the `| datamodel` command to manually trigger acceleration rebuilds after major data additions.

Answer

Avoid using acceleration on data models that contain calculated fields, as they cannot be accelerated.

Answer

Increase the number of parallel search processes to automatically improve acceleration speed.

Question 2

A user wants to replace a field value 'ERROR' with 'Error' in search results. Which command should be used within a search to achieve this transformation?

Accepted Answer

eval severity=replace(severity, "ERROR", "Error"). Option B is correct because the `replace` function in the `eval` command performs a case-sensitive string replacement on a specific field. In this case, it replaces the exact string 'ERROR' with 'Error' in the `severity` field, which is the precise transformation requested. Unlike `rex`, `replace` does not require regex syntax and directly modifies the field value without affecting other parts of the event.

Answer

rex field=_raw 's/ERROR/Error/g'

Answer

lookup severity_lookup severity OUTPUT new_severity

Answer

convert ctime(_time)

Question 3

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

Accepted Answer

| lookup employee_lookup emp_id OUTPUTNEW employee_name. Option D is correct because the `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.

Answer

| lookup employee_lookup employee_name FROM emp_id

Answer

| lookup employee_lookup emp_id OUTPUTNEW *

Answer

| lookup employee_lookup emp_id OUTPUT employee_name

Question 4

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

Accepted Answer

fillnull value=unknown status. Option C is correct because the `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Answer

eval status=coalesce(status, "unknown")

Answer

default status=unknown

Answer

replace status with "unknown"

Question 5

In Splunk, which of the following is true about fields?

Accepted Answer

Fields are extracted at search time from raw data. In Splunk, fields are extracted at search time from raw data using the Search Processing Language (SPL) and the default field extraction rules. This allows Splunk to dynamically identify and index field-value pairs without requiring predefined schemas, enabling flexible ad-hoc analysis of unstructured or semi-structured data.

Answer

Fields must be manually defined before indexing

Answer

Fields are only available after using the fields command

Answer

All fields are predefined by Splunk

Question 6

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

Accepted Answer

source_ip. The correct answer is A: source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Answer

dest_ip

Answer

host

Answer

user

Question 7

A Splunk admin wants to enrich web server logs with geographic location data based on IP addresses. Which approach should they use?

Accepted Answer

Configure a lookup definition and use lookup command. Option A is correct because Splunk's lookup command, combined with a lookup definition that references a geographic IP-to-location database (such as MaxMind GeoLite2), allows the admin to enrich web server logs with fields like city, country, and coordinates based on the client IP address. This is the standard, efficient approach for IP geolocation enrichment in Splunk, as it leverages pre-built external data without requiring custom parsing or calculations.

Answer

Use rex to extract location from the IP

Answer

Use an eval command to calculate coordinates

Answer

Use fields command to add location

Question 8

Which THREE of the following are true about lookups in Splunk? (Choose three.)

Accepted Answer

A lookup can be defined using a CSV file. Option A is correct because Splunk allows you to define a lookup using a static CSV file stored in the lookups directory of an app. This CSV file acts as a lookup table that maps fields in your events to additional fields, enabling field enrichment without modifying the original data.

Answer

Lookups are case-insensitive by default

Answer

Lookups can only return a single field

Question 9

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

Accepted Answer

The lookup is case-sensitive and the key values have different cases. Option D is correct because lookups in Splunk are case-sensitive by default. If the lookup file contains key values in a different case (e.g., 'ABC') than the event field values (e.g., 'abc'), the lookup will not match, even though the underlying data is logically equivalent. This is a common cause of lookup failures when the data sources have inconsistent casing.

Answer

The lookup field name is different from the event field name

Answer

The lookup is defined with the wrong field order

Answer

The time range of the search is too narrow

Question 10

Which TWO of the following are valid ways to extract fields in Splunk? (Choose two.)

Accepted Answer

Using the Extract New Fields dialog in the UI. Option B is correct because the 'Extract New Fields' dialog in the Splunk UI provides a graphical interface to define field extractions using regex patterns, which are then saved as inline or custom field extractions. Option C is correct because the 'rex' command is a dedicated search-time command that extracts fields from raw event data using named capturing groups in a regular expression.

Answer

Using a lookup to extract fields from raw data

Answer

Using the fields command

Answer

Using the regex command in a search