SPLK-1002 Macros, Saved Searches and CIM Practice Question
After upgrading Splunk to a new version, the Security team notices that the CIM Authentication dashboard is showing a much lower number of events than before. They verify that the data is still being indexed and that the sourcetype mappings to the Authentication data model are unchanged. The admin runs a search against the data model and sees some fields are missing. What is the most likely cause of the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The data model acceleration needed to be rebuilt after the upgrade.
After an upgrade, data model acceleration may become stale and needs to be rebuilt. The acceleration caches field values, and if not rebuilt, it can lead to missing fields and lower event counts. Options B, C, and D are less likely because field definitions rarely change between minor upgrades, permissions affect visibility but not data content, and index configuration changes would affect all searches, not just the data model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The data model acceleration needed to be rebuilt after the upgrade.
Why this is correct
Correct: Acceleration may become stale after an upgrade; rebuilding it can restore full data.
- ✗
The upgrade changed the CIM field definitions, causing some extractions to fail.
Why it's wrong here
CIM field definitions are stable across minor upgrades.
- ✗
The permissions on the data model were reset during the upgrade.
Why it's wrong here
Permissions affect who sees the model, not the data within.
- ✗
The index configuration changed, and the data is now in a different index.
Why it's wrong here
If data moved to a different index, raw searches would also be affected, but the admin confirmed indexing unchanged.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.