SPLK-1002 Advanced Searching and Statistics Practice Question
A large e-commerce company runs Splunk Enterprise on a single indexer cluster with four indexers. They have been experiencing slow search performance during peak hours, especially for searches that cover the last 24 hours. The environment uses a default search time range of 'Last 30 days'. The team has noticed that searches often time out or return partial results. They have also observed high CPU usage on the search head during peak times. The company's data volume is approximately 500 GB per day across various sources. They have implemented some search acceleration for data models, but the issue persists. The security team needs to run ad-hoc searches for threat hunting that cover multiple sourcetypes over the last 7 days. Additionally, the search head has a memory limit that is sometimes reached. The security team's searches are complex and involve joins and subsearches. The existing acceleration only covers a few data models. The team is looking for a quick win that does not require significant infrastructure changes. Which course of action would most effectively improve search performance without compromising data completeness?
⚠ Common exam trap
Splunk often tests the misconception that adding more hardware (indexers or search heads) is the only way to improve performance, when in fact optimizing search time ranges and using acceleration appropriately can provide a quicker and more cost-effective solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reduce the default time range to 'Last 7 days' and encourage users to specify shorter time ranges
Reducing the default time range from 'Last 30 days' to 'Last 7 days' directly reduces the data scanned by searches, which is the most effective quick win without infrastructure changes. Since the environment has high CPU usage on the search head and searches often time out, limiting the default time range reduces the load on the indexers and search head, improving performance for the majority of searches. This change does not compromise data completeness because users can still specify longer time ranges when needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a data model for all sourcetypes and enforce using tstats for all searches
Why it's wrong here
Not a quick win; requires significant setup and may not cover ad-hoc needs.
- ✓
Reduce the default time range to 'Last 7 days' and encourage users to specify shorter time ranges
Why this is correct
Immediately reduces data scanned for most searches, a quick win.
- ✗
Increase the number of indexers to distribute the load
Why it's wrong here
Requires hardware changes and may not address search head CPU bottleneck.
- ✗
Use the search head clustering feature to distribute search load across multiple search heads
Why it's wrong here
Helps with concurrent searches but not individual query speed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.