Courseiva

Splunk Core Certified User SPLK-1002 (SPLK-1002) — Questions 76–150

510 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 7

Page 3
76
MCQhard

Refer to the exhibit. The search returns a count for only a subset of user_ids, even though all user_ids exist in the lookup. What could explain this?

A.The stats command is grouping by user_id, which combines multiple events into one count per user.
B.The lookup definition must also include the OUTPUT fields in the definition for them to be used.
C.The lookup definition has max_matches=1, but some user_ids have multiple matches in the lookup file.
D.The events that are missing have different user_id representations (e.g., leading/trailing spaces) causing lookup failure, so first_name is null and they are filtered out.
AnswerD

If lookup fails, first_name is null, then where removes them, so they don't appear in stats.

Why this answer

Option D is correct because the lookup command matches user_id values exactly. If some events have user_id values with leading/trailing spaces or other subtle differences (e.g., case sensitivity), the lookup fails to match those events, resulting in null first_name values. The subsequent `stats count by first_name` then filters out those null values, so only the subset of user_ids that successfully matched appear in the results.

Exam trap

Splunk often tests the subtlety that lookup failures due to data quality issues (like whitespace or case) cause null output fields, which are then silently dropped by subsequent commands like `stats`, leading to incomplete results.

How to eliminate wrong answers

Option A is wrong because the stats command grouping by user_id would still count all user_ids, not just a subset; the issue is that some user_ids are missing entirely from the results. Option B is wrong because the lookup definition does not require OUTPUT fields to be listed in the definition for them to be used; OUTPUT fields can be specified inline in the search command. Option C is wrong because max_matches=1 controls how many matches are returned per input, not whether a match occurs; if multiple matches exist, the first match is still returned, so it would not cause some user_ids to be completely absent.

Full explanation →
77
MCQmedium

A user wants to see a list of all sourcetypes in the index "main". Which search command should be used?

A.| fields sourcetype
B.| data sourcetype
C.| stats count by sourcetype
D.| top sourcetype
AnswerC

This groups by sourcetype and shows each unique sourcetype present.

Why this answer

The `stats count by sourcetype` command groups events by sourcetype and returns a table listing each unique sourcetype along with its event count, effectively showing all sourcetypes present in the index. This is the correct approach because it uses aggregation to enumerate distinct values of the sourcetype field across the entire result set.

Exam trap

Splunk often tests the distinction between commands that return raw field values versus commands that aggregate or summarize, so candidates mistakenly choose `fields` thinking it lists unique values when it actually preserves all events.

How to eliminate wrong answers

Option A is wrong because `fields sourcetype` only removes all fields except sourcetype from the search results, but it does not list unique sourcetypes — it retains every event with its sourcetype value, so duplicates remain and no distinct list is produced. Option B is wrong because `data` is not a valid Splunk search command; there is no `data` command in SPL, so this would generate a syntax error. Option D is wrong because `top sourcetype` returns the most frequent sourcetypes sorted by count, but it limits output to a default of 10 results and does not guarantee a complete list of all sourcetypes in the index.

Full explanation →
78
MCQhard

A report uses `| timechart count by action`. The user wants to show only the top 3 actions and combine all others into a single 'Other' column. Which argument should be added?

A.`limit=3 useother=t`
B.`limit=3`
C.`useother=t`
D.`other=t`
AnswerA

This limits to top 3 and groups remaining as 'Other'.

Why this answer

The `timechart` command in Splunk uses the `limit` argument to control the number of distinct series (columns) displayed. Adding `limit=3` restricts the output to the top 3 values by count, and `useother=t` automatically groups all remaining values into a single 'Other' column. Without `useother=t`, the extra values are simply dropped, not aggregated.

Exam trap

Splunk often tests the distinction between `limit` (which truncates data) and `useother` (which aggregates leftovers), and candidates mistakenly think `limit` alone will create an 'Other' column.

How to eliminate wrong answers

Option B is wrong because `limit=3` alone only shows the top 3 actions and discards all others without combining them into an 'Other' column. Option C is wrong because `useother=t` without a `limit` argument defaults to showing all series (up to 10 by default) and does not restrict to the top 3. Option D is wrong because `other=t` is not a valid argument for `timechart`; the correct parameter is `useother`.

Full explanation →
79
MCQmedium

Refer to the exhibit. The search returns no results for the 'country' field even though the lookup file exists and contains IP-to-country mappings. Which is the most likely issue?

A.The lookup command should be placed before the rex command.
B.The country field already exists in the events.
C.The lookup file is in the wrong directory.
D.The IP field extracted by rex is in a different format than the lookup key.
AnswerD

Format mismatch prevents matches.

Why this answer

The most likely issue is that the IP field extracted by the `rex` command is in a different format than the lookup key (e.g., the lookup expects an integer representation of the IP, or a different subnet notation, or the extracted field contains extra characters like whitespace or quotes). Lookups match based on exact string equality, so any mismatch in format (e.g., '192.168.1.1' vs '192.168.001.001' or '3232235521') will cause zero results, even if the lookup file is correctly configured and contains the mapping.

Exam trap

Splunk often tests the subtlety that a lookup can silently return zero results when the field format (e.g., IP as string vs integer, or with/without leading zeros) does not exactly match the lookup key, leading candidates to mistakenly blame file location or command order.

How to eliminate wrong answers

Option A is wrong because the `rex` command extracts the IP field from raw event data, and the `lookup` command must come after extraction to use that field; placing lookup before rex would mean the IP field does not yet exist. Option B is wrong because if the country field already existed in the events, the lookup would either overwrite it (depending on `output` parameters) or cause a field conflict, but it would not prevent the lookup from returning results—the issue is no results at all. Option C is wrong because if the lookup file were in the wrong directory, Splunk would generate a 'lookup table not found' error in the search job inspector, not simply return zero results without error.

Full explanation →
80
Matchingmedium

Match each search command to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Filtering command

Filtering command

Reporting command

Reporting command

Reporting command

Why these pairings

Commands are grouped into categories like filtering and reporting.

Full explanation →
81
MCQhard

A search uses a lookup that returns a field 'priority'. The admin wants to use the lookup only for events where the 'source' is 'firewall'. Which command should be used?

A.source=firewall | lookup priority_lookup source OUTPUT priority
B.| lookup priority_lookup source OUTPUT priority
C.| lookup priority_lookup source OUTPUT priority | where source="firewall"
D.| lookup priority_lookup source OUTPUT priority WHERE source="firewall"
AnswerA

Filters first, then lookup only on those events.

Why this answer

Option A is correct because it first filters events with `source=firewall` using a search-time field filter, then applies the `lookup` command only to those events. This ensures the lookup is performed exclusively on firewall events, minimizing resource usage and avoiding unnecessary lookups on other sources.

Exam trap

Splunk often tests the order of operations in the Splunk search pipeline, where candidates mistakenly think a `WHERE` clause inside the lookup command or a post-lookup filter achieves the same result as pre-filtering with a leading search term.

How to eliminate wrong answers

Option B is wrong because it applies the lookup to all events regardless of source, which does not restrict the lookup to firewall events as required. Option C is wrong because it applies the lookup to all events first and then filters with `where source="firewall"`, which wastes processing on non-firewall events and may cause incorrect results if the lookup modifies the source field. Option D is wrong because the `WHERE` clause in a lookup command is not a valid syntax for filtering events before the lookup; it is used to specify lookup file conditions, not to filter the base search results.

Full explanation →
82
MCQeasy

A user wants to see the list of all fields that are extracted from a specific sourcetype. Which command should they use?

A.| rex field=_raw ...
B.| fields *
C.| eval fields=...
D.| fieldsummary
AnswerD

fieldsummary provides a summary of fields, including names.

Why this answer

The `fieldsummary` command provides a summary of all fields extracted from the events in the search results, including their count, distinct count, and percentage of events containing each field. When applied to a specific sourcetype, it lists every field that has been extracted from that sourcetype, making it the correct tool for this task.

Exam trap

Splunk often tests the distinction between commands that list fields (`fieldsummary`) versus commands that extract or manipulate fields (`rex`, `eval`, `fields`), leading candidates to confuse the purpose of `fields *` (which removes fields) with listing them.

How to eliminate wrong answers

Option A is wrong because `rex field=_raw ...` is used to extract new fields from raw event data using regular expressions, not to list existing fields. Option B is wrong because `fields *` removes all fields from the search results except those explicitly listed, which would hide the fields rather than show them. Option C is wrong because `eval fields=...` creates or modifies a single field named 'fields', not a list of all extracted fields.

Full explanation →
83
MCQeasy

A user wants to create a dashboard panel that shows a single number representing the total number of errors in the last 24 hours. Which visualization type should be used?

A.Single value
B.Pie chart
C.Bar chart
D.Line chart
AnswerA

Single value visualization displays one number, fitting the requirement.

Why this answer

A Single Value visualization is designed to display a single numeric metric prominently, making it the ideal choice for showing the total number of errors in the last 24 hours. It directly answers the user's requirement for a single number without any additional chart elements or time-series context.

Exam trap

The trap here is that candidates may confuse a Single Value with a Line chart or Bar chart because they think 'errors over time' requires a trend, but the question explicitly asks for a single number representing the total, not a trend.

How to eliminate wrong answers

Option B (Pie chart) is wrong because pie charts are used to show proportions or percentages of a whole across categories, not a single aggregated count. Option C (Bar chart) is wrong because bar charts compare values across multiple categories or time periods, whereas the requirement is for a single total number. Option D (Line chart) is wrong because line charts display trends over time, which would be unnecessary and misleading for a single aggregated value like total errors in the last 24 hours.

Full explanation →
84
Multi-Selectmedium

Which TWO of the following commands can be used to view the current fields in a search result?

Select 2 answers
A.| outputlookup mylookup.csv
B.| inputlookup mylookup.csv
C.| listfields
D.| fields
E.| fieldsummary
AnswersD, E

Shows all fields present.

Why this answer

The `| fields` command is used to keep or remove specific fields from search results, effectively showing you the current fields that exist in the result set. The `| fieldsummary` command produces a statistical summary of all fields present in the search results, including count, distinct count, and other metrics, thereby also allowing you to view the current fields.

Exam trap

Splunk often tests the distinction between commands that modify or filter fields versus commands that merely display or summarize field metadata, leading candidates to confuse `| outputlookup` or `| inputlookup` with field-viewing commands.

Full explanation →
85
MCQmedium

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

A.Use a time-based lookup to match event time with lookup time
B.Set up an external lookup that calls a REST API
C.Create a KV Store lookup and update it via REST
D.Configure a CSV lookup and use lookup command in search
AnswerD

CSV lookups are efficient for large, periodically updated reference data.

Why this answer

Option D is correct because a CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Exam trap

Splunk often tests the distinction between static CSV lookups and dynamic KV Store lookups, and the trap here is that candidates over-engineer the solution by choosing a KV Store or external lookup when a simple CSV lookup is sufficient for a daily-updated static file.

How to eliminate wrong answers

Option A is wrong because time-based lookups are used for time-series data where the lookup value changes over time (e.g., historical asset ownership), not for a static CSV that maps username to risk_score; the CSV is updated daily as a whole file, not time-stamped per row. Option B is wrong because an external lookup that calls a REST API would introduce unnecessary latency and complexity for a simple static mapping, and it is typically used for real-time data enrichment from external systems, not for a daily CSV file. Option C is wrong because a KV Store lookup is a dynamic, writable store that requires REST API calls to update and is overkill for a static CSV that is replaced daily; it is better suited for frequently changing data that needs to be modified by multiple users or apps.

Full explanation →
86
MCQmedium

A security analyst needs to create a report that shows the count of failed login attempts by user over the last 24 hours, updated every hour. The report should be accessible to the SOC team but not to other users. Which sequence of steps should the analyst follow?

A.Run the search, click 'Save As' -> 'Report', set schedule to hourly, then create an alert action to email the report to the SOC team.
B.Run the search, click 'Save As' -> 'Report', set permissions to 'Shared in App' with SOC role, then 'Schedule' hourly.
C.Run the search, click 'Save As' -> 'Dashboard Panel', add to a SOC dashboard, then schedule the dashboard.
D.Run the search, click 'Save As' -> 'Alert', set permissions to private, then schedule the alert to trigger hourly.
AnswerB

Correct workflow for a scheduled report with restricted access.

Why this answer

Option A is correct because saving as a report and scheduling it with appropriate permissions ensures the SOC team can access it without exposing it to others. Option B is wrong because saving as a dashboard panel does not create a scheduled report. Option C is wrong because alerts are not reports.

Option D is wrong because creating an alert action to email defeats the purpose of on-demand access.

Full explanation →
87
MCQeasy

After running a search, an analyst sees a timeline graph at the top of the results. What is the primary purpose of the timeline?

A.To list the fields extracted from the events.
B.To show the distribution of events over time and allow selecting a time range.
C.To indicate which data sources contributed to the results.
D.To display statistical summaries of the search results.
AnswerB

The timeline is for event distribution and time range selection.

Why this answer

The timeline graph in Splunk displays the count of events over time, allowing analysts to quickly identify patterns, spikes, or gaps in the data. Its primary purpose is to show the distribution of events across the time range and to enable interactive selection of a specific sub-time range for further analysis, which is essential for narrowing down results.

Exam trap

The trap here is that candidates may confuse the timeline with the 'Statistics' tab or think it shows field extractions, but the timeline is strictly a temporal distribution and selection tool, not a data summary or field listing.

How to eliminate wrong answers

Option A is wrong because the timeline does not list fields; fields are shown in the 'Selected Fields' sidebar or via the 'Fields' sidebar. Option C is wrong because the timeline does not indicate which data sources contributed; source information is available in the 'source' field or via the 'Data Summary' page. Option D is wrong because the timeline does not display statistical summaries; statistics like counts, averages, or percentiles are shown in the 'Statistics' tab or via the 'stats' command.

Full explanation →
88
Multi-Selecthard

Which THREE of the following are steps in the process of creating a dashboard from a search?

Select 3 answers
A.Run a search and save as a report
B.Add data inputs
C.Edit permissions to allow sharing
D.Schedule an alert
E.Create a dashboard and add panel from the report
AnswersA, C, E

Report is the basis for the dashboard panel.

Why this answer

Option A is correct because in Splunk, the standard workflow for creating a dashboard from a search involves first running a search, then saving it as a report. This report serves as a reusable data source that can be added as a panel to a dashboard. Without saving the search as a report, you cannot directly add it to a dashboard panel.

Exam trap

Splunk often tests the misconception that scheduling an alert is a necessary step in dashboard creation, but alerts are for notifications, not for populating dashboard panels.

Full explanation →
89
Multi-Selecthard

Which TWO of the following are common pitfalls when using data models that can lead to inaccurate pivot results? (Choose two.)

Select 2 answers
A.Using calculated fields that reference other calculated fields.
B.Adding too many child datasets to a root event.
C.Using acceleration with a short summary range.
D.Not including a constraint on the root event that filters out irrelevant data.
E.Defining a field with an incorrect type (e.g., number as string).
AnswersD, E

Missing constraints may include unwanted events, skewing pivot results.

Why this answer

Option D is correct because a root event in a data model defines the base dataset for all pivots. Without a constraint that filters out irrelevant events (e.g., sourcetype=access_combined), the pivot will include all indexed data, leading to inaccurate aggregations and counts. This is a common pitfall as it violates the principle of scoping the data model to only the necessary events.

Exam trap

Splunk often tests the misconception that acceleration settings or dataset count are the primary causes of pivot inaccuracy, when in fact the root cause is usually missing or incorrect constraints on the root event.

Full explanation →
90
Drag & Dropmedium

Drag and drop the steps to create a new Splunk index into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Creating a new index in Splunk involves accessing the Indexes settings page, specifying index parameters, and saving the configuration.

Full explanation →
91
Multi-Selecteasy

Which TWO of the following are default Splunk roles?

Select 2 answers
A.admin
B.power
C.manager
D.operator
E.user
AnswersA, E

Default role.

Why this answer

The 'admin' role is one of the default Splunk roles, providing full administrative access to all Splunk capabilities, including user management, knowledge object management, and system configuration. The 'user' role is also a default role, granting basic search and data access permissions to end users. These two roles are created automatically during Splunk installation and cannot be deleted.

Exam trap

Splunk often tests candidates by listing plausible-sounding role names like 'power', 'manager', or 'operator' that are not actual default Splunk roles, exploiting the common misconception that these generic IT role names exist in Splunk's built-in role hierarchy.

Full explanation →
92
Multi-Selecteasy

Which TWO of the following must be true for the lookup to return results?

Select 2 answers
A.The events must contain a field named 'county'.
B.The events must contain a field named 'zip_code'.
C.The lookup must be configured with `inputlookup` instead of `lookup`.
D.The lookup file must contain a field named 'city'.
E.The lookup file must contain a field named 'zip_code'.
AnswersB, E

The events must have the input field for the lookup to match.

Why this answer

The lookup command matches events to the lookup file based on the input field (zip_code) and outputs additional fields (city, state). For the lookup to work, the events must contain a field named 'zip_code' (option B) and the lookup file must contain a field named 'zip_code' (option A). The other options are not requirements: county is not involved, the lookup file can have any fields, and `inputlookup` is a different command.

Full explanation →
93
Multi-Selecthard

A dashboard panel uses a search that returns time-series data. Which TWO chart options are available in the 'Format' tab of the chart editor to modify the appearance of a line chart? (Choose two.)

Select 2 answers
A.Connect missing data
B.Line style (solid, dashed, dotted)
C.Pie area
D.Stack mode
E.Gauge style
AnswersA, B

This option controls whether to interpolate missing data points.

Why this answer

Option A is correct because the 'Connect missing data' setting in the Format tab of the chart editor allows you to bridge gaps in time-series data by drawing a line across null or missing values. This is useful when your search returns sparse data points and you want a continuous visual line, rather than breaks in the chart.

Exam trap

Splunk often tests the distinction between formatting options that are specific to a chart type (e.g., line chart) versus those that belong to other chart types (e.g., area, gauge), leading candidates to mistakenly select 'Stack mode' or 'Gauge style' because they are common formatting terms in other contexts.

Full explanation →
94
MCQeasy

A developer wants to display server CPU usage that updates every second on a dashboard. Which panel configuration is appropriate?

A.Add a chart panel with time range set to 'Real-time' and refresh set to 'Real-time'
B.Add a statistics table with real-time search
C.Add a chart panel with refresh set to 1 second and time range -1m
D.Add a single value panel with refresh set to 1s
AnswerA

This creates a real-time chart that continuously updates.

Why this answer

Option D is correct: a chart panel with time range set to 'Real-time' and refresh set to 'Real-time' provides a continuously updating visualization. Option A (single value) can be real-time but is not the standard for time-series; Option B uses a statistics table which is less visual; Option C has a refresh interval but not real-time.

Full explanation →
95
MCQhard

A Splunk administrator configured an automatic lookup as shown. When searching index=main source=/var/log/auth.log, the department field is not populated. What is the most likely cause?

A.The LOOKUP- stanza requires a numeric priority.
B.The transforms.conf file is not in the correct directory.
C.The user_lookup.csv file does not exist in the lookups directory.
D.The match_type syntax is incorrect and the field mapping is mismatched.
AnswerD

WILDCARD expects quotes and the field names must match.

Why this answer

Option D is correct because the most common cause for a lookup not populating a field is a mismatch between the field mapping in the transforms.conf stanza and the actual field names in the lookup table. If the match_type syntax is incorrect (e.g., using WILDCARD instead of EXACT or specifying the wrong field name), Splunk will fail to match events to lookup entries, leaving the department field empty.

Exam trap

The trap here is that candidates often assume the lookup file is missing or misconfigured (options A, B, or C) when the real issue is a subtle mismatch in field names or match_type syntax, which Splunk does not flag with an obvious error but simply returns no results.

How to eliminate wrong answers

Option A is wrong because the LOOKUP- stanza does not require a numeric priority; the priority is optional and only used when multiple lookups are defined for the same field to control evaluation order, not for basic functionality. Option B is wrong because the transforms.conf file must be in the correct directory (e.g., $SPLUNK_HOME/etc/system/local/ or an app's local/ directory), but if it were missing or misplaced, Splunk would not load the lookup definition at all, which would typically cause a different error (e.g., 'lookup table not found') rather than just an empty field. Option C is wrong because if the user_lookup.csv file did not exist in the lookups directory, Splunk would generate an error in the search log or the lookup would fail entirely, not silently leave the department field empty.

Full explanation →
96
MCQhard

When viewing search results, what is the difference between the 'Events' tab and the 'Statistics' tab?

A.Events tab can only filter by time; Statistics can filter by any field.
B.Events tab shows data per index; Statistics shows data per sourcetype.
C.Events tab shows only the first 100 events, Statistics shows all.
D.Events tab displays raw event data; Statistics tab displays transformed output (statistical tables, charts).
AnswerD

Correct distinction.

Why this answer

Option B is correct because Events shows raw events, Statistics shows summarized data. Option A is wrong because both tabs can display fields. Option C is wrong because both tabs support time range filters.

Option D is wrong because Statistics may also show fields, but not raw events.

Full explanation →
97
MCQeasy

An analyst wants to find all events where the field 'status' is not 200. Which search is correct?

A.status != 200
B.NOT status=200
C.status!=200
D.status -neq 200
AnswerC

Correct syntax for not equal.

Why this answer

Option C is correct because in SPL (Search Processing Language), the `!=` operator is used directly after the field name without a space to denote 'not equal to'. The syntax `status!=200` correctly filters events where the status field does not equal 200, and it is the standard way to express inequality in field-value comparisons.

Exam trap

The trap here is that candidates often confuse the syntax of inequality operators in SPL with other query languages or assume that spaces around operators are allowed, leading them to choose Option A or D, or they may overthink and select Option B as a valid alternative despite the question asking for the correct search among the given options.

How to eliminate wrong answers

Option A is wrong because `status != 200` uses a space between the field name and the `!=` operator, which SPL interprets as a comparison between the literal string 'status' and the value '200', not as a field-value inequality. Option B is wrong because `NOT status=200` is logically correct but uses the `NOT` keyword with a space before the field, which is valid syntax for excluding events where status equals 200; however, the question asks for the correct search among the given options, and `NOT status=200` is not the standard or most direct way to express inequality in SPL, and it can be ambiguous in complex searches. Option D is wrong because `-neq` is not a valid SPL operator; the correct operator for 'not equal to' is `!=`.

Full explanation →
98
MCQeasy

You are a Splunk administrator for a large e-commerce company. The security team frequently runs searches against the web access logs (sourcetype=access_combined) to investigate suspicious activity. These searches often take 5-10 minutes to complete, and the team is frustrated. You decide to implement a data model to accelerate these searches. After creating a data model based on the CIM Web model and enabling acceleration for the 'Web' dataset, you notice that the acceleration summary size grows to over 50 GB and the rebuild process takes more than an hour every night, causing some searches to time out during the rebuild window. What is the most effective way to address this issue?

A.Increase the bucket size in the acceleration settings to reduce the number of buckets being rebuilt.
B.Create a custom data model that includes only the fields needed for security investigations and enable acceleration.
C.Reduce the acceleration time range from 'All time' to 'Last 7 days' to limit the summary size and rebuild duration.
D.Disable acceleration and instead rely on the security team to use more focused time ranges.
AnswerC

Correct: Limiting the acceleration range reduces both storage and rebuild time, still covering recent data.

Why this answer

Option C is correct because reducing the acceleration time range from 'All time' to a shorter window like 'Last 7 days' directly limits the amount of data the acceleration summary must cover. This shrinks the summary size (under 50 GB) and shortens the nightly rebuild time, preventing search timeouts during the rebuild window while still accelerating the most relevant recent data for security investigations.

Exam trap

The trap here is that candidates often think customizing fields (Option B) is the best fix, but they overlook that the time range is the primary driver of summary size and rebuild time in high-volume environments.

How to eliminate wrong answers

Option A is wrong because increasing the bucket size in acceleration settings does not reduce the number of buckets being rebuilt; it actually increases the granularity of data per bucket, which can worsen rebuild times and summary size. Option B is wrong because creating a custom data model with only needed fields would reduce the summary size, but the question states the acceleration summary is already over 50 GB and rebuild takes over an hour; a custom model still requires a full rebuild of all time unless the time range is also constrained, making it less effective than directly limiting the time range. Option D is wrong because disabling acceleration entirely would remove the performance benefit for security searches, forcing them to run against raw data without acceleration, which would likely increase search times rather than solve the frustration.

Full explanation →
99
MCQmedium

A security analyst creates a report that shows the count of failed login attempts by user over the last 7 days. The report uses the `top` command. However, the report only shows the top 10 users, but the analyst wants to see all users. What should the analyst do?

A.Add the `limit=0` argument to the `top` command.
B.Use the `rare` command instead.
C.Change the time range to include more data.
D.Use the `stats count by user` command and sort descending.
AnswerA

Adding `limit=0` removes the default 10-row limit, showing all users.

Why this answer

The `top` command in Splunk defaults to showing the top 10 results. Adding `limit=0` removes this limit, displaying all users with failed login attempts. This is the correct approach because `top` already counts occurrences and sorts them, so the analyst only needs to override the default limit.

Exam trap

The trap here is that candidates may think `limit=0` is invalid or that changing the time range will show more results, but the default limit of 10 is the core issue, and `limit=0` is the correct way to remove it.

How to eliminate wrong answers

Option B is wrong because the `rare` command shows the least common values, not all values, and would not display all users. Option C is wrong because the time range does not affect the number of results shown by `top`; it only affects the data being searched. Option D is wrong because while `stats count by user` and sorting descending would show all users, it is a different approach that requires additional syntax; the question specifically asks what to do with the existing `top` command, not how to rewrite the search.

Full explanation →
100
MCQhard

An analyst wants to automatically look up a field 'user_id' in a lookup file every time a search is run, without having to type the lookup command manually. Which approach is best?

A.Configure a lookup definition and set it as a default lookup for the index.
B.Add the lookup to the search command.
C.Create a regex extraction for user_id.
D.Use an alias to rename the field.
AnswerA

Automatically applied to all searches on the index.

Why this answer

Option A is correct because configuring a lookup definition and setting it as a default lookup for the index ensures that the lookup is automatically applied to every search run against that index, without requiring the user to manually include the `lookup` command. This is achieved by defining the lookup in the Lookups settings and then associating it with the index via the 'Default Lookup' setting in the Indexes configuration, which Splunk automatically appends to all searches on that index.

Exam trap

The trap here is that candidates often confuse 'default lookup' with 'automatic field extraction' or 'alias', thinking that extracting the field or renaming it will somehow trigger the lookup automatically, when in fact only a properly configured default lookup definition achieves this behavior.

How to eliminate wrong answers

Option B is wrong because adding the lookup to the search command requires the analyst to manually type the `lookup` command each time, which contradicts the requirement of automatic application without manual intervention. Option C is wrong because creating a regex extraction for user_id would only extract the field from raw events, but it would not perform a lookup to enrich the data with additional fields from an external file; regex extractions are for field extraction, not for lookups. Option D is wrong because using an alias to rename a field only changes the field name in the search results, but it does not perform a lookup or automatically enrich data with values from a lookup file.

Full explanation →
101
MCQmedium

A media company uses Splunk to analyze user engagement across their website. They have a data model named 'User_Actions' with two child objects: 'Page_Views' and 'Clicks'. The data model is accelerated. The marketing team creates a report that uses |tstats to count the number of 'Page_Views' per user_id. The results seem low compared to an equivalent search using |search. Upon investigation, you find that the 'Page_Views' object has a constraint that filters events where 'event_type=page_view'. The base search returns many events with 'event_type=Page View' (note the space). What is the issue and the correct fix?

A.The constraint is case-sensitive and the actual event uses 'Page View' with a space; modify the constraint to be case-insensitive or use a regex.
B.The tstats command cannot filter on event type; use |datamodel instead.
C.The field name is 'event_type', but the events have 'Event_Type'; correct the field name.
D.The acceleration summary is not updated; rebuild the summary.
AnswerA

Constraint should match the data precisely.

Why this answer

The issue is that the data model constraint for 'Page_Views' uses an exact match on 'event_type=page_view', but the actual events contain 'event_type=Page View' (with a space and different casing). Splunk data model constraints are case-sensitive by default, so the constraint does not match those events, causing |tstats to count only a subset. The correct fix is to modify the constraint to be case-insensitive (e.g., using a regex like 'event_type=page_view' with the `(?i)` flag) or to adjust the constraint to match the actual event value.

Exam trap

Splunk often tests the nuance that data model constraints are case-sensitive by default, leading candidates to overlook the mismatch in value formatting (space vs. underscore) and instead blame the command, field name, or acceleration status.

How to eliminate wrong answers

Option B is wrong because |tstats can filter on any field that exists in the accelerated data model, including 'event_type'; the issue is not a limitation of |tstats but a mismatch in the constraint. Option C is wrong because the field name 'event_type' is correct in both the constraint and the events; the problem is the value, not the field name. Option D is wrong because the acceleration summary is already built and up-to-date; rebuilding it would not fix the constraint mismatch — the constraint itself needs to be corrected.

Full explanation →
102
MCQeasy

Refer to the exhibit. After running the search, the user wants to see only events where the HTTP status is 404. Which change to the search is correct?

A.Add | where status=404 after the sort command.
B.Change the search to: index=main sourcetype=access_combined status=404 | stats count
C.Add | rename status as status_code and search for status_code=404.
D.Replace stats with top limit=1 status.
AnswerB

Filters events before stats, so only 404 events are counted.

Why this answer

Option B is correct because adding `status=404` directly in the base search filters events at the index level before any processing, which is the most efficient approach. The `stats count` command then aggregates the filtered results, ensuring only events with HTTP status 404 are included. This leverages Splunk's index-time filtering to reduce data volume early in the pipeline.

Exam trap

The trap here is that candidates often think they need to use a `where` command or rename fields to filter, but the most efficient method is to include the filter directly in the base search before any pipe commands.

How to eliminate wrong answers

Option A is wrong because placing `| where status=404` after the `sort` command would filter events after sorting, which is inefficient and could miss events if the sort command alters the event order; also, `where` is a streaming command but sorting is not, so the filter should ideally be applied earlier. Option C is wrong because `rename` does not change the field value; it only renames the field, so searching for `status_code=404` after renaming would still require a filter, and the original `status` field would no longer exist, causing the search to fail unless a new filter is added. Option D is wrong because `top limit=1 status` returns the most common status code, not all events with status 404; it aggregates and limits output to a single value, which does not produce the desired event list.

Full explanation →
103
MCQmedium

An administrator needs to find events from hosts that have reported a critical error in the last hour. Which search uses a subsearch correctly?

A.index=main host IN [search error="critical" | fields host]
B.index=main | where host=[search index=main error="critical" | fields host]
C.index=main AND [search error="critical" | table host]
D.index=main [search index=main error="critical" | table host]
AnswerD

Correct subsearch syntax; outer search uses returned hosts as filter.

Why this answer

Option D is correct because it uses a subsearch that returns a list of hosts (via `table host`) and passes that list to the outer search, which then filters events from those hosts. The outer search `index=main` combined with the subsearch result effectively becomes `index=main host=<host1> OR host=<host2> ...`, correctly retrieving events from hosts that reported a critical error in the last hour. The subsearch runs first, and its output is used as a condition in the main search.

Exam trap

Splunk often tests the subtle difference between `fields` and `table` in subsearches, where `fields` retains the column header and can cause the outer search to misinterpret the result, while `table` produces a clean list that Splink can use correctly.

How to eliminate wrong answers

Option A is wrong because `host IN [search error="critical" | fields host]` is syntactically invalid; `IN` is not a valid operator in Splunk's search language, and `fields host` returns a table with a header, not a list of values suitable for an `IN` clause. Option B is wrong because `| where host=[search ...]` attempts to compare a field to a subsearch result, but `where` expects a boolean expression, and a subsearch returns a table, not a single value; this will cause a parsing error. Option C is wrong because `index=main AND [search error="critical" | table host]` uses `AND` incorrectly; a subsearch cannot be combined with `AND` directly—it must be placed after the main search terms without `AND`, and `table host` returns a table with a header, which may cause unexpected behavior or errors.

Full explanation →
104
Multi-Selecteasy

Which TWO of the following commands will return exactly one result row when there is at least one event?

Select 2 answers
A.sort - count
B.chart count by user
C.eventstats count by user
D.top limit=1 user
E.stats count
AnswersD, E

Returns the top user, one row.

Why this answer

Option D is correct because `top limit=1 user` returns the single most frequent value of the `user` field, producing exactly one result row (the top user) when at least one event exists. Option E is correct because `stats count` without a `by` clause aggregates all events into a single row showing the total event count, always returning exactly one row as long as there is at least one event.

Exam trap

Splunk often tests the distinction between transforming commands that reduce results to one row per group (like `stats count by user`) and those that produce a single global row (like `stats count`), leading candidates to mistakenly choose `chart count by user` or `eventstats count by user` when the question explicitly requires exactly one result row.

Full explanation →
105
MCQhard

A search includes a lookup that returns multiple values per event. The admin wants to see each matched value as a separate event. Which command should be used after the lookup?

A.mvexpand
B.untable
C.stats
D.makemv
AnswerA

mvexpand creates separate events for each multivalue entry.

Why this answer

The `mvexpand` command is correct because it takes a multivalue field (such as one created by a lookup returning multiple matches) and expands it into separate events, one for each value. This allows the admin to see each matched value as an individual event, which is exactly the requirement.

Exam trap

The trap here is that candidates often confuse `makemv` (which only creates a multivalue field) with `mvexpand` (which actually splits that field into separate events), leading them to choose `makemv` when the requirement is to see each value as a distinct event.

How to eliminate wrong answers

Option B is wrong because `untable` is used to transform data from a tabular format into a key-value pair format, not to expand multivalue fields into separate events. Option C is wrong because `stats` aggregates data (e.g., count, sum) and does not expand multivalue fields; it would collapse events rather than create new ones. Option D is wrong because `makemv` creates a multivalue field from a string (e.g., splitting by a delimiter), but it does not expand the values into separate events—it only changes the field's internal representation.

Full explanation →
106
Multi-Selecteasy

Which TWO of the following are valid ways to extract fields in Splunk? (Choose two.)

Select 2 answers
A.Using a lookup to extract fields from raw data
B.Using the Extract New Fields dialog in the UI
C.Using the rex command in a search
D.Using the fields command
E.Using the regex command in a search
AnswersB, C

The UI's field extractor uses regex or delimiters.

Why this answer

Option B is correct because the 'Extract New Fields' dialog in the Splunk UI provides a graphical interface to define field extractions using regex patterns, which are then saved as inline or custom field extractions. Option C is correct because the 'rex' command is a dedicated search-time command that extracts fields from raw event data using named capturing groups in a regular expression.

Exam trap

The trap here is that candidates often confuse the 'fields' command (which filters existing fields) with field extraction commands, or mistakenly think 'regex' is a valid Splunk command when only 'rex' exists.

Full explanation →
107
Multi-Selecthard

Which two of the following search commands can be used to rename a field? (Select TWO)

Select 2 answers
A.rename
B.table
C.fields
D.spath
E.eval
AnswersA, E

Directly renames a field, e.g., rename old as new.

Why this answer

Options A and C are correct. The rename command explicitly renames a field. The eval command can rename by assigning a new name to the same value.

The fields command selects fields but does not rename. The table command renames only as column headers. The spath command extracts fields from structured data.

Full explanation →
108
MCQmedium

What is the purpose of this search?

A.To find the top 10 most accessed web pages that returned a 404 status.
B.To show the top 10 IP addresses causing 404 errors.
C.To list all 404 errors from the web index.
D.To count the number of unique URLs with 404 errors.
AnswerA

Correctly interprets the search.

Why this answer

Option A is correct. The search filters for 404 status codes from the web access logs and then finds the top 10 most accessed URI paths. Option B lists all 404 errors, not just top 10.

Option C counts unique URLs but does not use top. Option D shows IP addresses, not URI paths.

Full explanation →
109
MCQmedium

An analyst wants to create a data model that includes fields from both web server logs and database logs. The two sourcetypes have different timestamp formats. Which best practice should the analyst follow when designing the data model?

A.Use the data model to define new timestamp fields based on indexed data.
B.Normalize the timestamp fields using eval expressions in the data model definition.
C.Use the same timestamp field name but ignore the format differences.
D.Create two separate data models, one for each sourcetype.
AnswerB

Normalizing timestamps ensures consistent time-based acceleration and queries.

Why this answer

Option B is correct because the best practice for handling different timestamp formats in a data model is to normalize them using eval expressions within the data model definition. This ensures that all events share a common, consistent timestamp field, which is essential for accurate time-based searches and pivot operations across multiple sourcetypes.

Exam trap

Splunk often tests the misconception that data models can alter indexed data or that timestamp normalization should be handled at index time, when in fact eval expressions in the data model are the correct post-index approach.

How to eliminate wrong answers

Option A is wrong because data models cannot define new timestamp fields based on indexed data; timestamp extraction occurs at index time, and data models work with already-indexed fields. Option C is wrong because using the same timestamp field name while ignoring format differences would cause incorrect time parsing and unreliable search results. Option D is wrong because creating separate data models for each sourcetype defeats the purpose of a unified data model, which is designed to combine and normalize data from multiple sources into a single, consistent schema.

Full explanation →
110
Multi-Selectmedium

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Select 4 answers
.The `top` command returns the most common values of a field based on count.
.The `rare` command returns the least common values of a field based on count.
.Both `top` and `rare` can include a `by` clause to group results by another field.
.The `top` command automatically removes events with null or empty values for the specified field from the count.
.The `rare` command can only be used on fields that have been extracted using regex.
.Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Why this answer

The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. By default, `top` and `rare` exclude events where the specified field is null or empty from the count, which is a key behavior to understand for accurate analysis.

Exam trap

Splunk often tests the misconception that `top` and `rare` require explicit `limit` arguments to function, when in fact they have default limits of 10, and the trap also includes the false idea that `rare` is restricted to regex-extracted fields, which is not true.

Full explanation →
111
MCQhard

An administrator reports that a data model acceleration job is consistently failing for a root event with a large dataset. What is the most likely cause?

A.The data model has a calculated field with an incorrect type.
B.The root event constraint is too restrictive.
C.The acceleration summary range is too short.
D.The acceleration summary range is set to 'All time' and the dataset is very large.
AnswerD

Summarizing 'All time' for a large dataset can exceed memory limits and cause the job to fail.

Why this answer

Option D is correct because if the time range for acceleration is too broad, the summarization job may run out of memory or time. Option A is wrong because disk space would cause a different error. Option B is wrong because constraints would affect registration, not acceleration.

Option C is wrong because field types are flexible and do not cause acceleration failure.

Full explanation →
112
MCQmedium

A data model is set to accelerate with a summary range of 90 days. After some time, the administrator notices that the acceleration is using significant disk space. Which strategy would best reduce disk usage without losing the ability to quickly query the last 30 days of data?

A.Set the acceleration to use a shorter time window for complete summarization.
B.Reduce the summary range to 30 days.
C.Increase the summary range to 180 days.
D.Disable acceleration for the data model.
AnswerB

This reduces the amount of accelerated data, saving space while preserving fast queries on recent data.

Why this answer

Option C is correct. Reducing the summary range to 30 days directly reduces the amount of data summarized, saving disk space while still allowing fast queries on recent data. Option A disables acceleration entirely, losing query performance.

Option B increases range, worsening space. Option D is not a valid setting.

Full explanation →
113
MCQeasy

When creating a dashboard panel that displays a line chart of CPU usage over time, which visualization option should be used to show multiple series (each CPU core) with different colors?

A.Overlay
B.Line mode
C.Stacking
D.Markers
AnswerA

Overlay enables multiple series with distinct colors.

Why this answer

Option A is correct because the 'Overlay' visualization option in Splunk allows you to display multiple data series (e.g., each CPU core) as separate lines on the same chart, each with a distinct color. This is essential for comparing CPU usage across cores over time without merging or stacking the values, which would obscure individual core behavior.

Exam trap

Splunk often tests the confusion between 'Overlay' and 'Stacking', where candidates mistakenly choose 'Stacking' thinking it will show multiple series, but it actually aggregates them into a single cumulative area, losing individual core visibility.

How to eliminate wrong answers

Option B (Line mode) is wrong because it controls whether the chart displays lines, markers, or both, but does not enable multiple series with different colors; it only affects the rendering style of a single series. Option C (Stacking) is wrong because it aggregates multiple series by stacking their values on top of each other, which would show cumulative CPU usage rather than individual core performance, making it impossible to distinguish each core's trend. Option D (Markers) is wrong because it adds data point indicators (e.g., dots) to the line chart but does not introduce multiple series or color differentiation; it only enhances the visibility of individual data points.

Full explanation →
114
MCQhard

Refer to the exhibit. The dashboard panel is not displaying data when the input changes. What is the most likely cause?

A.The input uses `searchWhenChanged="true"` which prevents dashboard loading.
B.The search uses `timechart` which requires a time field.
C.The chart type is not specified.
D.The token name in the search is "$token$" but the input token is "source".
AnswerD

Token names must match; the search uses the wrong token name.

Why this answer

Option A is correct because the token in the search is `$token$` but the input defines the token as `source`. Token names must match.

Option B is incorrect because `searchWhenChanged="true"` triggers a search when the input changes, which is correct.

Option C is incorrect because a chart type is not required; it defaults to a column chart.

Option D is incorrect because `timechart` uses `_time` by default, so a time field is not missing.

Full explanation →
115
MCQmedium

A Splunk administrator receives a complaint that a saved search is slow. The search uses a lookup to enrich events with a CSV file that has 500,000 rows. Which optimization is most effective?

A.Sort events by the lookup key field before the lookup command.
B.Convert the CSV lookup to a KV store lookup for faster access.
C.Increase the search time range to process more events at once.
D.Filter events early using eval or where before applying the lookup.
AnswerD

Reducing the number of events that need to be looked up improves performance.

Why this answer

Option D is correct because filtering events early with `eval` or `where` reduces the volume of data that must be processed by the lookup command. Since lookups perform a row-by-row match against a 500,000-row CSV, minimizing the number of events before the lookup drastically cuts I/O and CPU overhead, making the search faster.

Exam trap

The trap here is that candidates often think sorting or converting to KV store will speed up lookups, but Splunk’s CSV lookups are not indexed and the KV store is designed for writes, not read-heavy static data, so early filtering is the only optimization that reduces the actual workload.

How to eliminate wrong answers

Option A is wrong because sorting events by the lookup key field does not reduce the number of events or improve lookup performance; Splunk’s lookup command does not require sorted input and sorting adds overhead. Option B is wrong because converting a CSV lookup to a KV store lookup does not inherently speed up access for a static, read-only dataset; KV store is optimized for dynamic, transactional updates, not bulk read performance, and the conversion adds complexity without guaranteed speed gains. Option C is wrong because increasing the search time range processes more events, which would slow the search further, not optimize it.

Full explanation →
116
Multi-Selectmedium

Which TWO of the following are valid ways to share a Splunk dashboard?

Select 2 answers
A.Send via email
B.Share via URL
C.Export as PDF
D.Embed as iframe
E.Clone dashboard
AnswersB, D

Valid sharing method.

Why this answer

Option B is correct because Splunk dashboards can be shared via a direct URL, which allows other users with appropriate permissions to access the dashboard in their own Splunk instance. This method leverages Splunk's role-based access control to ensure only authorized users can view the shared content.

Exam trap

Splunk often tests the distinction between sharing a live, interactive dashboard (via URL or iframe) versus exporting a static representation (PDF) or duplicating it locally (clone), leading candidates to mistakenly select PDF or clone as valid sharing methods.

Full explanation →
117
Multi-Selecteasy

Which THREE are essential components of a Splunk dashboard?

Select 3 answers
A.Panels (e.g., charts, tables)
B.Inputs (e.g., dropdowns, time pickers)
C.Reports (saved searches)
D.Alerts (scheduled actions)
E.Searches (embedded or referenced)
AnswersA, B, E

Core visual elements.

Why this answer

Panels are the fundamental visual building blocks of a Splunk dashboard. Each panel displays data using a visualization type such as a chart, table, single value, or map, and is powered by either an inline search or a referenced saved search. Without panels, a dashboard would have no content to present to the user.

Exam trap

Splunk often tests the distinction between 'essential dashboard components' and 'optional dashboard features' — the trap here is that candidates confuse saved searches (reports) and alerts as being part of the dashboard structure, when in fact they are separate Splunk knowledge objects that can be used by dashboards but are not required.

Full explanation →
118
MCQhard

A search `index=main | top limit=10 user | fields - percent` is running slowly on a large dataset. Which change would likely improve performance the most?

A.Add a rex command before top
B.Use stats count by user instead of top
C.Remove the fields command
D.Add a time range early in the search
AnswerB

stats count is more efficient than top for counting.

Why this answer

The `top` command is a transforming command that internally performs a `sort` and `limit` after counting events. On large datasets, `top` can be slower than `stats count by user` because `top` includes additional overhead for calculating percentages and sorting all results before limiting. Using `stats count by user` followed by `sort 10 -count` achieves the same result with less processing overhead, as `stats` is more efficient for simple aggregation.

Exam trap

Splunk often tests the misconception that `top` is the only or best way to get top values, when in reality `stats count by user` with `sort` and `head` is more performant for large datasets, and candidates may overlook that `top` includes hidden overhead for percentage calculation.

How to eliminate wrong answers

Option A is wrong because adding a `rex` command before `top` would extract new fields via regex, increasing processing time and potentially slowing the search further, not improving performance. Option C is wrong because removing the `fields` command would keep the `percent` field in the results, but the `fields` command only affects output, not the underlying data processing; the performance bottleneck is the `top` command itself, not the field removal. Option D is wrong because adding a time range early in the search is already a best practice for limiting data volume, but the question states the search is running slowly on a large dataset, implying a time range is likely already applied; the core issue is the inefficiency of `top` compared to `stats`.

Full explanation →
119
MCQhard

A report is scheduled to run every hour but sometimes returns incomplete data because the search is too slow and times out. Which action should be taken to improve reliability without losing data?

A.Use a summary index to pre-aggregate data
B.Add the 'lazy' command to defer computation
C.Reduce the time range to the last 30 minutes
D.Increase the search auto-finalization time
AnswerA

Pre-aggregating data into a summary index makes searches much faster and avoids timeouts.

Why this answer

A summary index pre-aggregates data at search time, storing the results in a separate index. When the report runs, it queries the summary index instead of the raw data, which is much faster and avoids timeouts. This ensures all data is captured because the summary is built incrementally from the full data set, not by sampling or truncating.

Exam trap

Splunk often tests the misconception that extending timeouts or reducing data scope is a valid fix for performance issues, but the correct approach is to pre-aggregate data to avoid scanning raw events entirely.

How to eliminate wrong answers

Option B is wrong because there is no 'lazy' command in SPL; this is a fabricated option that does not exist. Option C is wrong because reducing the time range to the last 30 minutes would cause data loss—the report would only cover a subset of the intended hour, not improve reliability. Option D is wrong because increasing the search auto-finalization time only extends the timeout window; it does not address the root cause of slow search performance and may still result in incomplete data if the search cannot complete within the new limit.

Full explanation →
120
MCQmedium

A team uses a lookup to map IP addresses to geographic locations. The lookup is large and updated weekly. Which lookup type is best suited?

A.File-based CSV lookup
B.External lookup
C.Scripted lookup
D.KV store lookup
AnswerA

CSV lookups are simple, efficient for static data, and easy to update by replacing the file.

Why this answer

Option A is correct because file-based CSV lookups are ideal for static, regularly updated data. Option B is wrong because KV store is for real-time updates and dynamic data. Option C is wrong because external lookups require external scripts.

Option D is wrong because scripted lookups are for custom logic, not necessary here.

Full explanation →
121
MCQmedium

Refer to the exhibit. A user runs the search shown. The search returns results, but the user wants to use a data model to make future searches faster and more consistent. Which data model should the user select and what is the correct acceleration setting?

A.Use the CIM Web data model and accelerate the 'Web' dataset.
B.Use the CIM Web data model and select 'Accelerate All Datasets' from the settings.
C.Create a new data model called 'Access' and enable acceleration on root events.
D.Use the built-in 'Searches' data model to pre-compute the count and status fields.
AnswerA

Correct: CIM Web data model covers web traffic and acceleration is set on datasets.

Why this answer

Option A is correct because the search shown uses fields like `status`, `action`, `uri`, and `method`, which are standard fields in the CIM Web data model. Accelerating the 'Web' dataset pre-computes the relevant field extractions and aggregations, making future searches faster and more consistent without requiring the user to manually define field extractions or transformations.

Exam trap

Splunk often tests the misconception that 'Accelerate All Datasets' is a valid global setting, when in fact acceleration must be enabled individually on each dataset within a data model.

How to eliminate wrong answers

Option B is wrong because 'Accelerate All Datasets' is not a valid setting in Splunk; acceleration is configured per dataset within a data model, not globally. Option C is wrong because creating a new data model called 'Access' would require manual field mapping and does not leverage the pre-built, tested CIM Web data model, which already contains the necessary fields like `status` and `action`. Option D is wrong because the 'Searches' data model is not a built-in data model in Splunk; it does not exist, and pre-computing count and status fields is not how data model acceleration works.

Full explanation →
122
MCQhard

Refer to the exhibit. The search runs but the user field is not modified. What is the most likely cause?

A.The eval command does not modify existing fields.
B.The function name is misspelled (should be lower).
C.The search must be run over a time range.
D.The field must be referenced as 'user'.
AnswerB

The correct function is 'lower', not 'lowercase'.

Why this answer

The `lower()` function in Splunk's `eval` command is case-sensitive and must be written in lowercase. The exhibit shows `Lower(user)` with a capital 'L', which Splunk does not recognize as a valid function, so the `eval` command fails silently and the `user` field remains unmodified.

Exam trap

Splunk often tests the case sensitivity of Splunk functions, knowing that candidates may assume functions are case-insensitive like many programming languages, leading them to overlook the capital 'L' in `Lower()`.

How to eliminate wrong answers

Option A is wrong because the `eval` command can modify existing fields by overwriting them with a new value; the issue here is not a limitation of `eval` but a syntax error. Option C is wrong because the search runs without a time range requirement for modifying a field with `eval`; time ranges affect data retrieval, not the execution of `eval` on existing results. Option D is wrong because referencing the field as `user` is correct syntax; the problem is the function name, not the field reference.

Full explanation →
123
Multi-Selecteasy

Which TWO commands can be used to bring lookup data into a search?

Select 2 answers
A.outputlookup
B.inputlookup
C.csvlookup
D.filelookup
E.lookup
AnswersB, E

Loads lookup file as events.

Why this answer

The `inputlookup` command is used to load the contents of a static lookup table (CSV or KV store) into the search pipeline as events, making it available for further processing. The `lookup` command enriches search results by adding fields from a lookup table based on a field match, effectively bringing lookup data into the search context. Both commands allow lookup data to be used within a search, but in different ways: `inputlookup` loads the entire table as events, while `lookup` appends fields to existing events.

Exam trap

The trap here is that candidates confuse `outputlookup` (which exports data) with `inputlookup` (which imports data), and they may invent commands like `csvlookup` or `filelookup` that sound plausible but do not exist in Splunk's command set.

Full explanation →
124
MCQhard

A large e-commerce company ingests 10 TB/day of web access logs into Splunk. They have enabled the CIM-compliant Web data model and created data model acceleration with a 90-day range. Users run reports using pivot to analyze HTTP status codes, client IPs, and URIs. Recently, two issues arose: (1) Pivot reports are returning incomplete or outdated results, sometimes missing data from the last few hours. (2) Acceleration summary size has ballooned to over 500 GB, causing search head performance degradation. The Splunk admin suspects that data model acceleration is not configured optimally. Upon inspection, the Web data model's root search contains a complex filter with multiple eval commands and lookups, and the acceleration time range is set to the same 90 days as the summary range. The admin also notices that the data model is defined as non-time-based, even though the events have timestamps and the pivot often uses time ranges. What is the best course of action to resolve both issues while maintaining accuracy and performance?

A.Change the data model to time-based, narrow acceleration range to 7 days, and simplify the root search by removing expensive eval/ lookups and using search-time field extractions instead.
B.Change the data model to time-based and set acceleration to 180 days to cover all data.
C.Keep the data model as non-time-based but reduce acceleration range to 30 days and add a constraint to filter out irrelevant events.
D.Disable acceleration for the Web data model and instead create an accelerated search report for each common pivot query.
AnswerA

Time-based allows efficient time bucketing and fresh summaries. A shorter acceleration range reduces size and rebuild time. Simplifying root search improves acceleration performance.

Why this answer

Option A is correct because making the data model time-based allows acceleration to use time-bucketed summaries, which ensures recent data is included in pivot results and prevents incomplete results. Narrowing the acceleration range to 7 days reduces the summary size drastically (from 500+ GB to a manageable size), and simplifying the root search by removing expensive eval/lookups improves acceleration build performance and reduces overhead. This directly addresses both issues: incomplete recent data and excessive summary size.

Exam trap

The trap here is that candidates may think keeping a non-time-based data model is acceptable for time-based pivots, but Splunk's acceleration engine requires a time-based model to correctly partition summaries for time-range queries, and they may also overlook that a 90-day acceleration range on high-volume data causes summary bloat.

How to eliminate wrong answers

Option B is wrong because increasing the acceleration range to 180 days would make the summary size even larger, worsening the performance degradation and not fixing the incomplete recent data issue. Option C is wrong because keeping the data model non-time-based means acceleration does not use time-bucketed summaries, so pivot queries with time ranges will still miss recent data and the summary will remain large and inefficient. Option D is wrong because disabling acceleration entirely and using accelerated search reports for each pivot query would require manual maintenance of multiple reports, lose the benefits of data model acceleration (like automatic summary updates), and could still cause performance issues if many reports are accelerated independently.

Full explanation →
125
Drag & Dropmedium

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Full explanation →
126
MCQhard

A search using `| datamodel All_Web data=Web search` returns a large number of results quickly, but the analyst notices the results are inconsistent with a manual search over the same time range. What is the most likely issue?

A.The data model has a constraint that excludes certain events.
B.The data model uses a calculated field that is not properly defined.
C.The data model is accelerated and the summary is stale.
D.The search head is not properly configured to query the indexers.
AnswerC

Stale summaries can cause discrepancies between accelerated and non-accelerated searches.

Why this answer

Option C is correct because when a data model is accelerated, Splunk pre-computes and stores summary data in a TSIDX file. If the acceleration summary becomes stale (i.e., not refreshed within the acceleration time range), the search returns results from the cached summary rather than the raw events, leading to inconsistencies with a manual search over the same time range. This is a common issue when the acceleration summary has not been updated to reflect recent data.

Exam trap

Splunk often tests the concept that accelerated data models can return stale results, and candidates mistakenly think the issue is a constraint or field definition error because they overlook the caching behavior of acceleration summaries.

How to eliminate wrong answers

Option A is wrong because a data model constraint is a static filter defined at design time; it would consistently exclude the same events, not cause intermittent inconsistency between an accelerated search and a manual search. Option B is wrong because a misdefined calculated field would cause errors or incorrect values in both the accelerated and manual searches, not a discrepancy between them. Option D is wrong because an improperly configured search head would affect all searches uniformly, not specifically cause inconsistency only when using the accelerated data model versus a manual search.

Full explanation →
127
MCQmedium

A large e-commerce company uses Splunk Enterprise to analyze sales data. The marketing team requests a real-time dashboard showing total revenue per product category, updated every 5 seconds. A new Splunk user creates a dashboard panel with the search `index=sales | stats sum(price) by category | sort - sum(price)`. The dashboard works initially, but after 30 minutes, it stops updating and displays the error 'Search failed: too many results'. The user is concerned about the impact on system performance. The data volume is approximately 1 TB per day. Which of the following should the user do to create a reliable dashboard that updates frequently without causing performance issues?

A.Create a scheduled summary search that aggregates sales data by category every 5 minutes, and use the 'loadjob' command in the dashboard to load the summary results.
B.Use the 'streamstats' command to incrementally calculate revenue and limit the time range to the last 5 minutes to reduce the result set.
C.Reduce the search to only show the top 5 categories by using 'head 5' and set a 5-second auto-refresh on the dashboard.
D.Change the search to use the 'timechart' command with 'span=5s' and set the search to real-time mode.
AnswerA

Summary indexing pre-computes the aggregation, reducing the load on indexers and allowing the dashboard to refresh quickly without heavy searches.

Why this answer

Creating a scheduled summary search that pre-aggregates data every 5 minutes and then using 'loadjob' in the dashboard is the most efficient approach. It reduces the load on the indexers and allows the dashboard to refresh frequently with minimal performance impact. Option A would exacerbate the problem because real-time searches are resource-intensive.

Option B still runs a large search every refresh. Option D uses incremental computation but still requires scanning the full data set.

Full explanation →
128
MCQmedium

A dashboard panel using a bar chart shows a large number of values on the x-axis, making the chart unreadable. Which dashboard option should be used to limit the number of bars shown?

A.Overlay in the chart options
B.Color by field in the chart options
C.Stack mode in the chart options
D.Limit in the chart options
AnswerD

Limit property restricts the number of data points displayed.

Why this answer

Option D is correct because the 'Limit' option in the chart configuration allows you to specify the maximum number of data points (bars) displayed on the x-axis. By setting a limit, you reduce the number of bars shown, preventing overcrowding and making the chart readable. This is a direct control over the cardinality of the x-axis values in Splunk's visualization settings.

Exam trap

The trap here is that candidates often confuse 'Limit' with visual formatting options like 'Overlay' or 'Stack mode', thinking they can fix overcrowding by changing chart style rather than reducing the data volume.

How to eliminate wrong answers

Option A is wrong because 'Overlay' is used to superimpose another data series (e.g., a line chart) on top of the existing chart, not to control the number of bars. Option B is wrong because 'Color by field' assigns different colors to data points based on a field value, which can add visual distinction but does not limit the number of bars. Option C is wrong because 'Stack mode' controls how multiple series are stacked (e.g., stacked, grouped, or overlaid) in a bar chart, not the count of bars displayed.

Full explanation →
129
MCQmedium

A team is designing a data model for IT operations. They have fields like `src_ip`, `dest_ip`, `user`, and `action`. Which best practice should they follow when naming the root event dataset?

A.Use camelCase, e.g., 'itOperations'.
B.Use underscores and numbers for clarity.
C.Use a short abbreviation like 'ITOps'.
D.Use a generic name like 'events'.
AnswerA

CamelCase is the standard for data model root event names in Splunk.

Why this answer

Option A is correct because Splunk data model root event dataset names must follow camelCase naming conventions to ensure compatibility with the Splunk search language and to avoid parsing issues. CamelCase prevents spaces and special characters that could break field references in searches and data model acceleration.

Exam trap

The trap here is that candidates often assume descriptive or abbreviated names are acceptable, but Splunk specifically enforces camelCase for root event dataset names to maintain consistency with its internal naming conventions and avoid search-time errors.

How to eliminate wrong answers

Option B is wrong because using underscores and numbers in root event dataset names violates Splunk's naming best practices, which require camelCase to avoid conflicts with field extraction and search syntax. Option C is wrong because short abbreviations like 'ITOps' are not recommended; Splunk requires descriptive camelCase names to maintain clarity and avoid ambiguity in data model hierarchies. Option D is wrong because a generic name like 'events' does not follow the camelCase convention and is too vague, making it difficult to distinguish root event datasets in complex data models.

Full explanation →
130
Multi-Selectmedium

Which of the following are true statements about using fields and lookups in Splunk? Choose all that apply. (There are four correct answers.)

Select 4 answers
.A lookup table can be used to add fields to events based on a match between a field in the event and a field in the lookup file.
.The `| lookup` command can be used to join a lookup table with search results, and it supports both CSV files and KV store collections.
.Extracted fields using the `| rex` command are automatically added to the field sidebar and can be used in searches without any additional configuration.
.Geospatial lookups require the lookup file to contain latitude and longitude coordinates and are typically used with the `| geom` command to visualize data on a map.
.The `| inputlookup` command is used to load the entire contents of a lookup file into search results, allowing you to inspect or aggregate on the lookup data directly.
.Field aliases defined in props.conf can rename a field in search results without altering the raw data, but they are not applied retroactively to events indexed in the past.

Why this answer

The first option is correct because lookup tables in Splunk allow you to add fields to events by matching a field in the event with a field in the lookup file, enriching the data. The second option is correct because the `| lookup` command supports both CSV files and KV store collections, enabling flexible data enrichment. The fourth option is correct because geospatial lookups require latitude and longitude coordinates and are used with the `| geom` command for map visualizations.

The fifth option is correct because `| inputlookup` loads the entire lookup file into search results, allowing direct inspection or aggregation of lookup data.

Exam trap

Splunk often tests the misconception that `| rex` extracted fields are automatically added to the field sidebar and searchable without additional configuration, but in reality they are transient within the search pipeline unless explicitly persisted.

Full explanation →
131
MCQhard

A security analyst uses Splunk Web daily to investigate incidents. Recently, the analyst noticed that when running a search, the search results are displayed correctly, but the 'Field sidebar' on the left shows the message 'No fields found. Your search may not have generated any fields.' The analyst knows that the data has fields because the same search used to show fields. The analyst has not changed any settings. The analyst is using the same Splunk instance and same data. What is the most likely reason for this issue?

A.The analyst changed the search string to exclude all fields.
B.The search mode is set to 'Raw' instead of 'Smart' or 'Verbose'.
C.The data has been moved to a different index.
D.The analyst's role no longer has permission to view fields.
AnswerB

Correct: 'Raw' mode does not extract fields automatically.

Why this answer

Option B is correct because if the search does not use a transforming command and returns raw events, the field sidebar may initially prompt for a field extraction; but the message 'No fields found' indicates that no fields were extracted from the events. This can happen if the 'Interesting fields' extraction is disabled or if the search returns events that did not have fields extracted due to a sourcetype issue. But the most common cause is that the search is returning events in a mode where fields are not automatically extracted, such as when using 'raw' mode or if the search is not in 'Smart' mode.

Actually, the field sidebar should show fields from the interesting fields. Option A is incorrect because the user said they have permission. Option B is plausible: the analyst might have accidentally switched the search mode to 'Raw' which does not extract fields.

Option C is incorrect because the index exists. Option D is incorrect because the search string is the same.

Full explanation →
132
MCQeasy

A small business uses Splunk to monitor their web server. They have a dashboard that shows daily page views. After a system update, the dashboard loads very slowly, often timing out. The dashboard uses a search that takes only 2 seconds when run manually. The dashboard has a time range picker set to 'Today'. The update changed some default settings. What is the most likely cause?

A.The index was renamed
B.The dashboard now uses real-time search
C.The search command changed to 'timechart'
D.The time range picker default was reset to 'All Time'
AnswerD

‘All Time’ searches across all data, causing slow load; the manual search likely used a limited range.

Why this answer

The dashboard was configured with a time range picker set to 'Today', but the system update reset the default to 'All Time'. This causes the search to scan all indexed data, dramatically increasing the data volume and search time, leading to timeouts. A manual search taking 2 seconds on a small time range becomes extremely slow when applied to the entire dataset, which is why the dashboard fails while the manual search still works.

Exam trap

Splunk often tests the misconception that a slow dashboard is caused by a heavy search command like 'timechart' or a real-time search, when the real culprit is an expanded time range that increases data volume exponentially.

How to eliminate wrong answers

Option A is wrong because renaming an index would cause the search to return no results or an error, not a slow-loading dashboard that times out. Option B is wrong because real-time search would continuously update the dashboard, but the manual search still completes in 2 seconds, indicating the issue is not with real-time vs historical search mode. Option C is wrong because changing to 'timechart' would alter the visualization but not inherently cause a timeout; the timechart command itself is not slow unless operating on a large dataset, which points back to the time range issue.

Full explanation →
133
Multi-Selecteasy

Which TWO actions should be taken to optimize data model acceleration?

Select 2 answers
A.Disable field filtering in Pivot.
B.Use data model acceleration only for root datasets.
C.Set the acceleration time range to cover the most common reporting period.
D.Add constraints to each dataset to limit events.
E.Enable acceleration on the data model.
AnswersC, E

This ensures the summary data covers the needed time range.

Why this answer

Option C is correct because setting the acceleration time range to cover the most common reporting period ensures that the data model's acceleration summary only builds and stores data for the time window users query most frequently. This reduces storage overhead and speeds up acceleration builds, as Splunk does not waste resources pre-computing summaries for rarely accessed older data. The acceleration time range is configured in the data model's acceleration settings and directly controls the scope of the tsidx files created.

Exam trap

Splunk often tests the misconception that acceleration should be applied only to root datasets (Option B), but in reality, acceleration can be enabled on any dataset within a data model, and doing so on frequently queried child datasets is a key optimization strategy.

Full explanation →
134
MCQeasy

Where does a user click to view all fields extracted from search results?

A.On the 'Statistics' tab
B.On the 'Search' bar
C.On the 'Fields' sidebar
D.On the 'Timeline' chart
AnswerC

The Fields sidebar displays interesting fields, selected fields, and allows adding fields.

Why this answer

Option D is correct because the Fields sidebar on the left shows selected fields and allows adding field extractions. Option A is wrong because the Search bar is for queries. Option B is wrong because the Timeline shows event distribution over time.

Option C is wrong because the Statistics tab shows statistical tables.

Full explanation →
135
Multi-Selectmedium

Which THREE of the following are true about lookups in Splunk? (Choose three.)

Select 3 answers
A.A lookup can be defined using a CSV file
B.Lookups are case-insensitive by default
C.Lookups can only return a single field
D.Lookups can be used to add fields from external sources
E.Lookups support time-based matching
AnswersA, D, E

CSV is a common lookup source.

Why this answer

Option A is correct because Splunk allows you to define a lookup using a static CSV file stored in the lookups directory of an app. This CSV file acts as a lookup table that maps fields in your events to additional fields, enabling field enrichment without modifying the original data.

Exam trap

The trap here is that candidates often assume lookups are case-insensitive by default, but Splunk actually treats them as case-sensitive unless explicitly configured otherwise, and they may also mistakenly think lookups can only return one field, overlooking the ability to return multiple columns from the lookup table.

Full explanation →
136
Multi-Selectmedium

Which THREE statements about the 'rex' command are correct? (Choose three.)

Select 3 answers
A.rex can be used to extract fields from any string field
B.rex can extract fields using named capturing groups
C.rex can only extract one field per command
D.rex automatically converts extracted values to numeric
E.rex can be used to modify existing field values
AnswersA, B, E

Default field is _raw, but others can be specified.

Why this answer

Option A is correct because the 'rex' command can extract fields from any string field, not just the default `_raw` field. By specifying the `field` argument, you can target any field containing string data, such as `field=uri_path` or `field=host`, and use a regular expression to extract new fields from its value.

Exam trap

Splunk often tests the misconception that 'rex' can only extract one field per command, when in reality multiple named capturing groups in a single regex extract multiple fields simultaneously.

Full explanation →
137
MCQeasy

A security analyst wants to create a report that shows the count of failed login attempts per user over the last 24 hours, but only for users with more than 5 failures. Which Splunk command sequence should be used?

A.index=main action=failure | top limit=5 user
B.index=main | stats count by user | where count > 5
C.index=main action=failure | stats count by user | search count > 5
D.index=main action=failure | stats count by user | where count > 5
AnswerD

Correctly filters failures, counts by user, and applies the threshold.

Why this answer

Option D is correct because it first filters events to only failed login attempts using `index=main action=failure`, then uses `stats count by user` to count failures per user, and finally applies `where count > 5` to keep only users with more than 5 failures. This sequence ensures the count is calculated only on the relevant subset of events and the filter is applied after aggregation.

Exam trap

The trap here is that candidates often confuse the `where` and `search` commands, thinking `search` is always required for filtering, or they forget to filter for `action=failure` before aggregating, leading to incorrect counts of all events instead of only failed logins.

How to eliminate wrong answers

Option A is wrong because `top limit=5 user` returns the top 5 users by count, not all users with more than 5 failures, and it does not filter by a threshold. Option B is wrong because it does not filter for `action=failure` first, so it counts all events per user, not just failed logins. Option C is wrong because `search count > 5` after `stats` is a suboptimal approach that works but is less efficient than `where`; however, the primary issue is that it uses `search` instead of `where` for post-stats filtering, which can be slower and is not the recommended Splunk best practice for this scenario.

Full explanation →
138
MCQhard

You are a Splunk administrator for a large e-commerce company. The operations team uses a dashboard to monitor server health, which includes a single-value panel showing the current number of active users, a bar chart of error counts by service, and a table of recent critical log entries. Recently, users have reported that the dashboard loads very slowly, sometimes taking over 30 seconds to display all panels. The dashboard uses base search and post-process searches to reduce duplication. The base search retrieves all logs from the last 24 hours, and each panel runs a post-process search to filter and aggregate data. The dashboard is scheduled to refresh every 60 seconds. There are approximately 10 million events per day. After investigating, you notice that the base search returns a large amount of data, and each post-process search still processes a significant subset. Which approach would most effectively improve dashboard performance without significantly altering the dashboard's functionality?

A.Remove the table of critical log entries to reduce the number of post-process searches.
B.Change the base search to a real-time search so that the data is streamed continuously.
C.Increase the dashboard refresh interval to 300 seconds to reduce the frequency of searches.
D.Create a summary index that pre-aggregates logs by hour and service, then modify the base search to use the summary index and adjust post-process searches accordingly.
AnswerD

This significantly reduces the data volume processed by the dashboard, leading to faster load times while preserving the dashboard's functionality.

Why this answer

Option D is correct because creating a summary index that pre-aggregates logs by hour and service drastically reduces the volume of data the base search must process. Instead of scanning 10 million raw events per 60-second refresh, the base search queries pre-computed hourly summaries, and each post-process search operates on a much smaller, aggregated dataset. This approach preserves all dashboard panels and their functionality while addressing the root cause of slow performance: excessive data volume in the base search.

Exam trap

The trap here is that candidates often choose Option C (increasing the refresh interval) because it seems to reduce load, but they overlook that it does not fix the slow loading time per refresh; Splunk tests the understanding that performance improvements must address data volume, not just frequency.

How to eliminate wrong answers

Option A is wrong because removing the table of critical log entries reduces functionality and only eliminates one post-process search, leaving the underlying issue of a large base search and other post-process searches unchanged. Option B is wrong because real-time searches do not reduce data volume; they stream all incoming events continuously, which would likely increase load and slow the dashboard further. Option C is wrong because increasing the refresh interval to 300 seconds only reduces the frequency of searches, not the time each search takes; the dashboard will still load slowly on each refresh, and users will experience even longer delays between updates.

Full explanation →
139
MCQhard

Refer to the exhibit. The search results show city and country fields from the GeoIP lookup. What does the automatic lookup use as the input field to match against the lookup table?

A.ip
B.All fields in the event
C.No input field, it directly appends all lookup fields
D.clientip
AnswerA

The automatic lookup uses the field name from the lookup table as the input field by default.

Why this answer

The automatic GeoIP lookup in Splunk uses the `ip` field as the default input field to match against the lookup table. This is because the GeoIP lookup is designed to map IP addresses to geographic locations, and the lookup table expects an IP address as the key. When you configure an automatic lookup, you specify the input field (e.g., `ip`) that corresponds to the lookup table's key field, allowing Splunk to enrich events with location data.

Exam trap

Splunk often tests the misconception that automatic lookups automatically use any IP-related field (like `clientip`) or that they append fields without a match, when in fact the default input field for GeoIP lookups is `ip` and must be explicitly configured if the IP data resides in a different field.

How to eliminate wrong answers

Option B is wrong because automatic lookups do not use all fields in the event; they require a specific input field defined in the lookup configuration to match against the lookup table. Option C is wrong because automatic lookups always require an input field to match against the lookup table; they do not directly append all lookup fields without a match condition. Option D is wrong because `clientip` is not the default input field for GeoIP lookups; while it could be used if explicitly configured, the standard GeoIP lookup uses the `ip` field as the input, and the exhibit shows the `ip` field being used in the search results.

Full explanation →
140
MCQeasy

A new Splunk user wants to view the raw event data for the last hour. Which interface should they use?

A.Search History
B.Settings
C.Data Summary
D.Search & Reporting
AnswerD

Main interface for searching raw events.

Why this answer

The Search & Reporting interface (D) is the primary Splunk app for running searches and viewing raw event data. By default, it shows events from the last 24 hours, but the user can easily set the time range picker to 'Last hour' to see raw events for that period. This interface provides the search bar, timeline, and event listing necessary to inspect raw data.

Exam trap

The trap here is that candidates may confuse Data Summary (C) with raw event viewing because it lists data sources, but it does not display the actual event content or allow time-based filtering.

How to eliminate wrong answers

Option A is wrong because Search History shows a list of previously executed searches, not the raw event data itself. Option B is wrong because Settings is used for administrative configuration (e.g., indexes, inputs, roles) and does not display event data. Option C is wrong because Data Summary provides a high-level overview of sourcetypes, hosts, and sources, but does not show the raw event content or allow time-based filtering.

Full explanation →
141
MCQmedium

A user notices that a data model is not updating with recent events. The data model acceleration is enabled and the summary range is set to 30 days. Which action should the admin take to ensure the accelerated data model includes data from the last hour?

A.Run a '| datamodel <name> search' command.
B.Run '| tstats summariesonly=t' against the data model.
C.Rebuild the data model acceleration using '| datamodel rebuild'.
D.Increase the summary range to 60 days.
AnswerC

This rebuilds the summary, ensuring recent data is included.

Why this answer

Option C is correct because rebuilding the data model acceleration using the '| datamodel rebuild' command forces a complete re-index of the acceleration summary, which will include all available data, including events from the last hour. This resolves the issue where the accelerated data model is not updating with recent events, even though acceleration is enabled and the summary range covers 30 days.

Exam trap

Splunk often tests the misconception that simply increasing the summary range or running a search command will fix acceleration update issues, when in fact a full rebuild is required to force inclusion of recent data.

How to eliminate wrong answers

Option A is wrong because '| datamodel <name> search' is used to search a data model, not to rebuild or update its acceleration. Option B is wrong because '| tstats summariesonly=t' only restricts tstats results to accelerated summaries; it does not trigger a rebuild or include recent data. Option D is wrong because increasing the summary range to 60 days does not force the acceleration to include data from the last hour; it only extends the time window for which summaries are kept, but the acceleration may still be stale or not updating.

Full explanation →
142
MCQmedium

A user at a large organization runs a search that returns 50,000 events. They need to export these events to a CSV file for further analysis in Excel. However, when they click the Export button and select CSV, only 10,000 events are exported. What is the most likely reason and how should they export all 50,000 events?

A.The user does not have permissions to export more than 10,000 events
B.The report view limits export to 10,000 events; create a dashboard panel instead
C.The search itself is limited to 10,000 events by default
D.The export function has a default limit of 10,000 events; use the 'Export Results' feature with output_mode=csv
AnswerD

Direct export via search command can bypass limit.

Why this answer

Option D is correct because the Splunk export function has a default limit of 10,000 events when exporting via the UI. To export all 50,000 events, the user must use the 'Export Results' feature with the `output_mode=csv` parameter, which bypasses the UI limit and allows exporting the full result set.

Exam trap

The trap here is that candidates often confuse the default search result display limit (which is 10,000 events in the UI) with the export limit, but the search itself can return more events; the export function has its own separate default limit.

How to eliminate wrong answers

Option A is wrong because Splunk does not enforce a permission-based limit on the number of events that can be exported; permissions control access to data, not export quantity. Option B is wrong because creating a dashboard panel does not change the export limit; dashboards display data but still rely on the same underlying search and export mechanisms. Option C is wrong because the search itself is not limited to 10,000 events by default; the search returns 50,000 events, but the UI export function imposes a separate 10,000-event limit.

Full explanation →
143
MCQhard

In a dashboard, a user wants to click on a bar in a chart and navigate to another dashboard with relevant data for that bar. Which feature should they configure?

A.Drilldown
B.Link to search
C.Custom URL
D.Tokens
AnswerA

Drilldown actions can set tokens and navigate to other dashboards.

Why this answer

Drilldown is the correct feature because it allows a user to click on a data point (e.g., a bar in a chart) and navigate to another dashboard, passing the relevant field values as tokens to filter the target dashboard's data. This is a built-in capability in Splunk dashboards, configurable via the 'Drilldown' editor or XML attributes like `drilldown` on chart elements.

Exam trap

The trap here is that candidates often confuse 'Link to search' with drilldown because both involve clicking, but 'Link to search' opens a search window rather than navigating to a dashboard, which is the specific requirement in the question.

How to eliminate wrong answers

Option B (Link to search) is wrong because it creates a link that opens a new Search & Reporting view with a predefined search string, not a navigation to another dashboard with context-specific data. Option C (Custom URL) is wrong because while it can link to an external URL, it does not inherently pass the clicked bar's field values as tokens to filter another dashboard; that requires manual token handling and is not the standard feature for dashboard-to-dashboard navigation. Option D (Tokens) is wrong because tokens are variables used to pass values within a dashboard or to a search, but they do not by themselves enable click navigation; they are a supporting mechanism for drilldown, not the feature that enables the click-to-navigate behavior.

Full explanation →
144
MCQhard

Refer to the exhibit. A Splunk admin runs a search using the 'Authentication' data model and notices that the search does not use the acceleration summaries. The admin confirms that acceleration is enabled and the summary range is set correctly. What is the most likely reason for the acceleration being ignored?

A.The data model definition is invalid because constraints are required in the JSON.
B.The data model does not include a timestamp field.
C.The constraints are not restrictive enough to reduce the data volume.
D.The maxTime setting is too short for the search time range.
AnswerC

Acceleration is only used when the constraints significantly reduce the dataset; otherwise, Splunk may bypass it.

Why this answer

Option C is correct because the data model does not have a required field constraint on _time; however, for acceleration to be effective, the data model must include a constraint that filters a significant portion of data, typically based on time. In this definition, the only constraint is on 'action', which does not reduce the data enough, causing Splunk to decide not to use acceleration because it would not be efficient. Option A is wrong because there is no missing timestamp; _time is present.

Option B is wrong because maxTime does not affect whether acceleration is used; it sets the maximum retention. Option D is wrong because the data model is correctly defined with constraints in the JSON.

Full explanation →
145
MCQeasy

Refer to the exhibit. The report returns 0 results even though there are error events in the data. What is the most likely issue?

A.The stats command is misspelled
B.The time range is not set
C.The field name is 'error' but the data uses 'ERROR'
D.The CSV file has no header
AnswerC

Splunk searches are case-sensitive by default; 'error=*' will not match 'ERROR'.

Why this answer

Option C is correct because Splunk field names are case-sensitive. The search is looking for a field named 'error', but the CSV data contains a field named 'ERROR'. Since the field name does not match exactly, the `stats` command cannot find any events with the field 'error', resulting in zero results.

Renaming the field in the search using `rename ERROR as error` or adjusting the field name in the data would resolve this.

Exam trap

The trap here is that candidates often assume Splunk field names are case-insensitive, similar to how some databases handle column names, but Splunk treats them as case-sensitive, leading to zero results when the case does not match.

How to eliminate wrong answers

Option A is wrong because the `stats` command is spelled correctly in the search; a misspelling would cause a syntax error, not a zero-result issue. Option B is wrong because the time range is not the issue here; the search is over a CSV file, which is not time-bound, and the time range setting does not affect the field name mismatch. Option D is wrong because if the CSV file had no header, Splunk would assign default field names (e.g., field1, field2), and the search would still not find a field named 'error' unless the data itself contained that exact string in a field value, but the issue is specifically about field name case sensitivity.

Full explanation →
146
Matchingmedium

Match each Splunk license type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Full-featured license for production use

Limited to 500 MB/day, no authentication or distributed search

Free license for forwarders only

Full features for a limited time period

Why these pairings

License types determine available features.

Full explanation →
147
MCQmedium

Which of the following is a best practice when creating custom data models?

A.Define constraints that filter events to include only relevant data.
B.Use flat structure with no child datasets.
C.Avoid using constraints to limit data.
D.Include all available fields for maximum flexibility.
AnswerA

Constraints ensure only relevant events are mapped to the dataset.

Why this answer

Defining constraints in a custom data model is a best practice because they filter events to include only relevant data, which improves search performance and ensures the data model remains focused on specific use cases. Constraints use the same syntax as search-time field filtering (e.g., `eventtype=*` or `sourcetype=access_combined`) to limit the dataset, reducing the volume of events processed during acceleration and search. This aligns with Splunk's recommendation to keep data models lean and targeted for efficient acceleration and accurate reporting.

Exam trap

Splunk often tests the misconception that including more fields or avoiding constraints gives maximum flexibility, but in Splunk, the opposite is true—constraints and selective fields are critical for performance and accuracy in data models.

How to eliminate wrong answers

Option B is wrong because a flat structure with no child datasets violates the hierarchical design of data models, which rely on parent-child relationships (e.g., Root -> Child -> Grandchild) to organize data logically and enable pivot-based reporting. Option C is wrong because avoiding constraints to limit data would include all events in the dataset, leading to slower acceleration, larger storage overhead, and irrelevant data in reports, which contradicts Splunk's best practices for data model optimization. Option D is wrong because including all available fields for maximum flexibility increases the data model's size and complexity, causing slower acceleration and search times, and Splunk recommends only including fields necessary for the specific analysis to maintain performance.

Full explanation →
148
MCQmedium

A user runs a search that returns thousands of results. They need to see only the first 100 events after sorting by time descending. Which command should they use?

A.reverse
B.tail 100
C.head 100
D.sort - _time | head 100
AnswerD

Sorts by time descending, then takes first 100, which are the 100 most recent.

Why this answer

The user needs the first 100 events after sorting by time descending. The `sort - _time` command sorts events in descending order by timestamp, and piping the result to `head 100` returns the first 100 events from that sorted list, which are the most recent 100 events. This is the correct approach because `head` returns events from the top of the result set, and sorting ensures the top events are the newest.

Exam trap

Splunk often tests the distinction between `head` and `tail` in combination with sorting, where candidates mistakenly think `tail` returns the most recent events because it 'ends' the list, but in descending time order, the most recent events are at the top, so `head` is correct.

How to eliminate wrong answers

Option A is wrong because `reverse` simply reverses the order of the current result set; it does not sort by time and would not guarantee the most recent 100 events unless the events were already sorted in ascending time order. Option B is wrong because `tail 100` returns the last 100 events from the result set; if the events are not sorted, this would not give the most recent 100 events, and even if sorted descending, `tail` would return the oldest events. Option C is wrong because `head 100` alone returns the first 100 events from the current result set, but without sorting by time descending, those events are not guaranteed to be the most recent; they are just the first 100 events in whatever order they appear.

Full explanation →
149
MCQmedium

Refer to the exhibit. Which visualization would be most appropriate for this data?

A.Bar chart
B.Line chart
C.Pie chart
D.Single value
AnswerA

Bar chart clearly compares the count for each status code.

Why this answer

A bar chart is the most appropriate visualization for this data because the exhibit shows categorical data (e.g., sourcetypes, hosts, or error codes) with a single numeric value (count or sum). Bar charts excel at comparing discrete categories, and Splunk's default behavior for a `stats count by field` command is to render a bar chart in the visualization tab, making it the natural choice for this structured output.

Exam trap

Splunk often tests the misconception that any numeric data can be plotted on a line chart, but the trap here is that candidates overlook the categorical nature of the x-axis (e.g., sourcetypes or hosts) and assume a line chart is always the default for 'count' data, ignoring that line charts require a time-ordered or continuous dimension.

How to eliminate wrong answers

Option B (Line chart) is wrong because line charts are designed for continuous data over time (e.g., time-series trends), and the exhibit does not show a time-based x-axis; using a line chart here would imply a false relationship between independent categories. Option C (Pie chart) is wrong because pie charts are suitable for showing parts of a whole with a limited number of categories (typically fewer than 5–7), and the exhibit likely contains many categories, making the pie chart cluttered and hard to interpret; Splunk also discourages pie charts for high-cardinality fields. Option D (Single value) is wrong because a single value visualization displays one aggregated metric (e.g., total count), but the exhibit shows multiple rows of data, not a single summary value.

Full explanation →
150
Multi-Selecteasy

Which two of the following search commands are transforming commands? (Choose two.)

Select 2 answers
A.search
B.eval
C.fields
D.chart
E.stats
AnswersD, E

chart is a transforming command.

Why this answer

Transforming commands return a statistics table. chart and stats are transforming; eval, search, and fields are non-transforming.

Full explanation →
Page 1

Page 2 of 7

Page 3

All pages

1234567

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Splunk Basics and Interface NavigationBasic Searching and Transforming CommandsUsing Fields and LookupsCreating Reports, Dashboards and VisualizationsData Models and Best Practices
See all domains with question counts →