SPLK-1004 Practice Questions

Question 1

You want to extend a data model object to include new fields. Which object type allows you to add child objects that inherit base constraints?

Accepted Answer

Child object. A child object in a data model is the object type specifically designed to inherit constraints from a parent (base) object and add new fields or constraints. Child objects extend the base event or search object, inheriting its constraints while allowing additional field definitions. This is the mechanism Splunk provides for building hierarchical data models without duplicating base constraints.

Answer

Lookup object

Answer

Event object

Answer

Pivot object

Question 2

A dashboard has multiple inputs. When a user changes one, you want the others to reset. How can you achieve this using Simple XML?

Accepted Answer

Define a 'change' block with for the other tokens.. In Simple XML, a block attached to an input fires whenever that input's token value changes, and the element inside it removes the values of other tokens. By placing inside the change handler, the dependent inputs lose their current selection and revert to their default state, effectively resetting them. This is the documented Splunk pattern for cascading input resets.

Answer

Use an 'on_load' script.

Answer

Use a 'global' scope for all tokens.

Answer

Use the 'reset' attribute on the input.

Question 3

You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?

Accepted Answer

The source fields required for the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time and depend on the source fields they reference being present in the events. If the fields used in the regex extraction or math calculation are not extracted (either via props.conf/transforms.conf or field extractions), the calculated field cannot compute a value and will not appear in results. The calculation itself does not require indexing of the extracted fields, only that the source fields exist at search time.

Answer

The underlying extracted fields are not indexed.

Answer

The lookup table is not defined.

Answer

The user lacks the 'can_run_calculated_fields' capability.

Question 4

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. Option B is correct because the Field Extractor UI tool in Splunk (accessible via Settings > Fields > Field Extractions or from the search results) provides a guided, interactive way to define regex-based or delimiter-based field extractions and automatically writes the resulting configuration to props.conf and transforms.conf. Option E is correct because editing props.conf and transforms.conf directly is the underlying, supported configuration method for creating field extractions: props.conf defines the stanza (sourcetype/host/source) and references a transform via REPORT or EXTRACT, while transforms.conf defines the regex or delimiter-based extraction logic. Option A is incorrect because indexes.conf controls index-level settings such as storage paths, retention, and sizing, not field extraction definitions. Option C is incorrect because modifying raw log files on disk alters the source data itself and does not create any Splunk extraction configuration. Option D is incorrect because there is no 'index' search command that creates field extractions; the search bar is used for querying and testing extractions, not for defining them.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 5

A security team wants every event tagged with the sourcetype 'cisco:asa' to also carry the tag 'firewall' so analysts can search 'tag=firewall' without typing the sourcetype. A power user opens Settings > Tags and sees no existing tags for that sourcetype. What is the most efficient way to apply the tag to ALL current and future cisco:asa events?

Accepted Answer

Create a tag named 'firewall' and apply it directly to the 'cisco:asa' sourcetype field value in the Tags settings page. Tags in Splunk are knowledge objects attached to specific field/value pairs, and tagging a sourcetype value applies that tag to every event with that sourcetype. This is the only listed method that persists the tag for both existing and future events without altering raw data or creating a parallel dataset.

Answer

Run a search that adds 'tag=firewall' to each event and save the results to a summary index

Answer

Create a calculated field named 'firewall' with the eval expression 'if(sourcetype=="cisco:asa", "true", "false")'

Answer

Edit each event's raw text with the 'replace' command to append the string 'firewall'

Question 6

A security analyst needs to correlate failed login attempts with subsequent successful logins for the same user within 10 minutes. The relevant events are in the 'auth' index with fields 'user', 'action' (failed or success), and '_time'. Which command should be used to achieve this correlation?

Accepted Answer

transaction user maxspan=10m startswith=action="failed" endswith=action="success". The transaction command is designed to group related events into a single transaction based on a common field and time constraints. By specifying startswith and endswith, it ensures that only sequences beginning with a failed login and ending with a successful login within 10 minutes are grouped. This precisely matches the analyst's need to correlate failed attempts with subsequent successful logins for the same user.

Answer

stats count by user, action | where action="failed" AND action="success"

Answer

join user [ search index=auth action=success ]

Answer

eventstats values(action) as actions by user | where mvcount(actions)>1

Question 7

What is the purpose of the 'CIM Validator' tool?

Accepted Answer

To verify data model CIM compliance. The CIM Validator tool is designed to verify that indexed data conforms to the Common Information Model — checking whether the fields, tags, and eventtypes required by a given CIM data model are correctly present and populated. It runs validation searches against your data and reports which CIM-required fields are missing or malformed. This helps ensure that data model acceleration and CIM-based apps work correctly.

Answer

To check for syntax errors in SPL

Answer

To update lookup files

Answer

To monitor indexer health

Question 8

Which TWO of the following are benefits of using the CIM?

Accepted Answer

Simplified correlation across disparate sources. The Common Information Model (CIM) in Splunk provides a normalized, schema-based layer on top of indexed data, so option B is correct: by mapping fields from many different sourcetypes to common field names and tags, CIM enables simplified correlation across disparate sources (e.g., joining firewall, proxy, and authentication events on a shared src/dest/user model). Option E is also correct because CIM defines a standardized set of field names and data models, giving analysts a consistent search syntax and field vocabulary for common data regardless of the original source format. The unmarked options do not belong: CIM does not automatically generate raw log files (A), does not automatically delete sensitive data (C), and does not increase disk space for indexes (D) — it is a knowledge-layer normalization scheme, not a data-collection, retention, or storage-expansion mechanism.

Answer

Automatic generation of raw log files

Answer

Automatic deletion of sensitive data

Answer

Increased disk space for indexes

Question 9

You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?

Accepted Answer

props.conf. Automatic lookups that run for every search on a specific sourcetype are configured in props.conf using the `LOOKUP-<name>` setting. This setting associates a lookup definition (defined in transforms.conf) with a sourcetype, and the lookup is applied automatically at search time. This is the most appropriate place because props.conf controls sourcetype-specific configurations.

Answer

indexes.conf

Answer

lookups.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 10

Which THREE of the following are valid sources of information for a Workflow Action link?

Accepted Answer

Values from fields in the search result. Option A is correct because a Workflow Action link can dynamically pull values from fields in the search result, allowing the URI to be constructed based on the specific event or record returned. Option C is correct because fixed text in the URI string is a valid static source, enabling the link to include constant portions such as a base URL or static path. Option E is correct because values from the search query parameters can be referenced, letting the action link incorporate the user's original search terms or filters. Option B is not valid because user passwords are never exposed as a source for constructing action links, as that would be a severe security risk. Option D is not valid because system time is not a supported dynamic source for Workflow Action links in this context.

Answer

User password

Answer

System time

Question 11

Which of the following best describes the difference between an event type and a tag?

Accepted Answer

Event types group events by search criteria, while tags label field values.. An event type is a saved search that categorizes events based on search criteria, effectively grouping events that match a certain pattern. A tag, on the other hand, is a label applied to specific field-value pairs, allowing you to search for events with that tag. This distinction — event types group events by search criteria, tags label field values — is the fundamental difference.

Answer

Event types are only for reports, while tags are for dashboard panels.

Answer

Event types only work in the search bar.

Answer

Tags are faster than event types for searching.

Question 12

How do you handle case-insensitive filtering in a 'where' clause?

Accepted Answer

where lower(field) = "value". Splunk's where command uses eval-style expressions, and the correct way to perform case-insensitive comparison is to normalize the field with lower() (or upper()) and compare against a lowercase literal. The syntax where lower(field) = "value" is valid eval expression syntax and reliably matches regardless of case.

Answer

where field == /value/i

Answer

where field = '(?i)value'

Answer

where field.case = "ignore"

Question 13

How do you handle a field that exists in your data but is not explicitly defined in a CIM data model?

Accepted Answer

Add a new field definition to the object. In Splunk CIM, if a field exists in your data but is not defined in a data model object, you can add a new field definition to that object. This is done by editing the data model in the Data Model Editor, where you can add fields, set their type, and map them to CIM fields. This allows the field to be used in Pivot and other CIM-based searches. Renaming the raw log field is not necessary and would not integrate it into the CIM. Deleting the CIM model is destructive and unnecessary. You can add custom fields to CIM models, so option D is false.

Answer

Rename the raw log field

Answer

Delete the CIM model and start over

Answer

You cannot add custom fields to CIM models

Question 14

A Splunk administrator is configuring a workflow action that will appear when a user clicks on a field value in search results. The action should open a new browser tab to an external threat intelligence website, passing the field value as a query parameter. The administrator sets the action type to `link` and configures the URI as `https://threatintel.example.com/search?q=$value$`. However, when testing, the link opens in the same tab, replacing the Splunk UI. Which setting must be adjusted to ensure the link opens in a new tab?

Accepted Answer

Set `target` to `_blank` in the workflow action configuration.. For workflow actions of type `link`, the `target` setting determines where the link opens. The default is `_self`, which replaces the current page. To open in a new tab, set `target` to `_blank`. This setting is separate from the URI and must be configured explicitly. Changing the action type or embedding HTML attributes in the URI will not achieve the desired behavior.

Answer

Enable `popup` in the workflow action configuration.

Answer

Set `link.uri` to include `target="_blank"` as an HTML attribute.

Answer

Change the action type from `link` to `search`.

Question 15

In a data model, what is the impact of setting the 'Max Time' for an accelerated model?

Accepted Answer

It sets the age limit for the summary index. The 'Max Time' setting for an accelerated data model specifies the maximum age of events that are summarized in the acceleration summary index. Events older than this limit are not included in the acceleration, effectively setting an age limit for the summary index data.

Answer

It determines the refresh rate

Answer

It limits the number of events indexed

Answer

It restricts search execution time

Splunk Core Certified Advanced Power User SPLK-1004 practice test

Three ways to study

Study SPLK-1004 by domain

Study SPLK-1004 by topic

Lookups And Alerts practice questions

Data Models And CIM practice questions

Field Management And Calculated Fields practice questions

Transforming Commands And Formatting practice questions

Macros And Workflow Actions practice questions

Search Tuning Performance And Dashboards practice questions

SPLK-1004 fundamentals practice questions

SPLK-1004 scenario practice questions

SPLK-1004 troubleshooting practice questions

Splunk Core Certified Advanced Power User (SPLK-1004) (SPLK-1004) practice questions