Splunk Core Certified User SPLK-1002 SPLK-1002 Questions 226–300 | Page 4/7

226

MCQmedium

A Splunk admin wants to enrich web server logs with geographic location data based on IP addresses. Which approach should they use?

A.Configure a lookup definition and use lookup command

B.Use rex to extract location from the IP

C.Use an eval command to calculate coordinates

D.Use fields command to add location

AnswerA

lookup command enriches data with external sources like GeoIP.

Why this answer

Option A is correct because Splunk's lookup command, combined with a lookup definition that references a geographic IP-to-location database (such as MaxMind GeoLite2), allows the admin to enrich web server logs with fields like city, country, and coordinates based on the client IP address. This is the standard, efficient approach for IP geolocation enrichment in Splunk, as it leverages pre-built external data without requiring custom parsing or calculations.

Exam trap

The trap here is that candidates often confuse the purpose of the rex command (extraction) with enrichment, or assume that IP addresses contain embedded geographic data that can be parsed with regex, when in reality IP geolocation requires an external mapping database accessed via a lookup.

How to eliminate wrong answers

Option B is wrong because the rex command is used for extracting data from raw event text using regular expressions, not for performing IP geolocation lookups; IP addresses do not inherently contain geographic information in their string representation. Option C is wrong because the eval command can perform calculations and string manipulations but cannot derive geographic coordinates from an IP address without an external lookup or service, as IP geolocation requires a database mapping IP ranges to locations. Option D is wrong because the fields command is used to include or exclude specific fields from search results, not to add new data from external sources; it cannot enrich events with geographic location data.

Full explanation →

227

MCQhard

A large enterprise is using Splunk Enterprise to monitor web server logs from 200 servers. The logs are forwarded via a heavy forwarder cluster. Recently, a user has reported that when they log into Splunk Web and navigate to the Search & Reporting app, the search bar is empty, and they cannot see any data. The user has confirmed that other users can see data and run searches. The user is part of the 'power' role. The queries for the web server logs use the index 'web_logs'. The user can see the index in the Data Summary. The user has cleared the browser cache and tried a different browser, but the issue persists. What is the most likely cause of this issue?

A.The user's account lacks read permission on the index 'web_logs'.

B.The browser is blocking Splunk Web from communicating with the search heads.

C.The 'power' role is restricted from running searches on the 'web_logs' index.

D.The user's search time range is set to a timeframe before any data was indexed.

AnswerD

Correct: A mis-set time range causes no results even though data exists.

Why this answer

Option B is correct because a time range pre-set to 'All time' or a older range would cause the search to return no results if data exists only recently; the Data Summary shows data exists, so the search should work with correct time range. Option A is incorrect because the index appears in Data Summary, so it exists and is accessible. Option C is incorrect because other users can search, so the role is not blocked.

Option D is incorrect because the user can see Data Summary, so connectivity is fine.

Full explanation →

228

Multi-Selecteasy

Which THREE of the following are valid methods to access the Search & Reporting app in Splunk Web?

Select 3 answers

A.Click the 'Search' button on the Splunk Home page.

B.Type /en-US/app/search/search in the browser's address bar.

C.Click the Splunk logo and select 'Search & Reporting' from the context menu.

D.Click 'Search & Reporting' under the 'Apps' dropdown menu in the toolbar.

E.Use the keyboard shortcut Ctrl+Alt+S.

AnswersA, B, D

The Home page includes a Search button that launches the Search & Reporting app.

Why this answer

The correct methods are typing the URL, clicking the home page Search button, and selecting from the Apps menu. Keyboard shortcuts are not standard and clicking the Splunk logo does not provide a direct link to Search & Reporting.

Full explanation →

229

Multi-Selecthard

Which TWO actions increase the performance of a dashboard in Splunk? (Choose two.)

Select 2 answers

A.Use scheduled reports as base searches

B.Add a large number of drilldowns

C.Use real-time searches

D.Use the tstats command on accelerated data models

E.Add multiple time range pickers to the dashboard

AnswersA, D

Scheduled reports cache results, reducing search load on dashboard load.

Why this answer

Option A is correct because scheduled reports as base searches pre-compute and cache results, reducing the real-time query load on the indexers when the dashboard loads. This shifts expensive computation to off-peak times, improving dashboard rendering speed.

Exam trap

Splunk often tests the misconception that real-time searches are always better for dashboards, but in Splunk, real-time searches are resource-intensive and degrade performance, whereas scheduled reports and accelerated data models are the recommended optimization techniques.

Full explanation →

230

MCQeasy

A user runs a search and sees the results in the Statistics tab, but the events are not appearing. What is the most likely reason?

A.The search is a scheduled search.

B.The user does not have permission to view raw events.

C.The search includes a transforming command like stats.

D.The time range is too narrow.

AnswerC

Transforming commands produce statistical tables, not event lists.

Why this answer

Option C is correct because when a search includes a transforming command like `stats`, `chart`, or `timechart`, Splunk automatically converts the search results into a statistical table. This means the raw events are no longer displayed in the Statistics tab; instead, aggregated data is shown. The Events tab will be empty because the transforming command consumes the raw events to produce the statistical output.

Exam trap

The trap here is that candidates often confuse the Statistics tab with the Events tab, assuming that all searches display raw events, when in fact any search with a transforming command will only show statistical output and hide the underlying events.

How to eliminate wrong answers

Option A is wrong because scheduled searches run in the background and do not affect whether raw events appear in the Statistics tab; the user would still see events if the search is not transforming. Option B is wrong because permission to view raw events is controlled by role-based access, but if the user can run the search and see results in the Statistics tab, they already have permission to access the underlying data; the issue is the search type, not permissions. Option D is wrong because a narrow time range would simply return fewer events, but those events would still appear in the Statistics tab if the search does not include a transforming command.

Full explanation →

231

MCQmedium

A security analyst has created a report that shows the count of failed login attempts by user. The analyst now wants to display this data as a column chart on a dashboard. Which Splunk feature should be used to convert the report into a visualization?

A.Schedule the report to run and then export the results as a PDF.

B.Use the 'Save As Dashboard Panel' option on the report.

C.Convert the report to an alert and then add it to the dashboard.

D.Copy the report's search string and paste it into a new dashboard panel.

AnswerB

This option directly creates a visualization panel on a dashboard from the report.

Why this answer

The 'Save As Dashboard Panel' option on a report directly converts the report's search and visualization settings into a dashboard panel, preserving the column chart configuration. This is the intended workflow in Splunk for turning a saved report into a reusable dashboard visualization without manual reconfiguration.

Exam trap

Splunk often tests the misconception that copying a search string is equivalent to using the report's visualization settings, but Splunk requires the panel to reference the report's saved search ID to inherit chart properties.

How to eliminate wrong answers

Option A is wrong because scheduling a report and exporting as PDF creates a static file, not an interactive dashboard visualization; it does not embed the chart into a live dashboard. Option C is wrong because converting a report to an alert triggers actions based on conditions, not a visualization; alerts are for notifications, not for displaying column charts on dashboards. Option D is wrong because copying the search string into a new dashboard panel requires manually re-creating the visualization settings (e.g., chart type, formatting), which is inefficient and error-prone compared to using the built-in conversion feature.

Full explanation →

232

MCQhard

Refer to the exhibit. An analyst runs this search and expects to see a table of status codes with their counts, filtered to those with count greater than 100. The search returns zero results even though there are many events. What is the most likely reason?

A.The sourcetype should be 'access_combined' instead.

B.The stats command should use 'values(status_code)' instead.

C.The rex command is incorrectly extracting the status_code field.

D.The where command should be placed before the stats command.

AnswerC

If the pattern doesn't match, status_code is not extracted, leading to zero results when grouped.

Why this answer

The rex command is incorrectly extracting the status_code field because the regular expression pattern does not match the actual format of the status codes in the events. If the pattern is wrong or the field is not captured correctly, the stats command will not find any values for status_code, resulting in zero results even though events exist. The where command then filters on a field that doesn't exist or is null, returning no rows.

Exam trap

Splunk often tests the misconception that a stats or where command is misordered, when the actual issue is a failed field extraction due to an incorrect regex pattern in rex.

How to eliminate wrong answers

Option A is wrong because changing the sourcetype to 'access_combined' would not fix the extraction issue; the rex command's regex pattern is the root cause, not the sourcetype. Option B is wrong because 'values(status_code)' would return a multivalue list of status codes per group, not counts, and would not solve the extraction failure. Option D is wrong because the where command must come after stats to filter on the computed count field; placing it before stats would filter on raw events, not aggregated results, and would not address the missing status_code field.

Full explanation →

233

MCQmedium

Refer to the exhibit. The search returns no results from the lookup. What is the most likely issue?

A.The FIELDALIAS syntax is incorrect

B.The lookup table is not defined in transforms.conf

C.The lookup file 'error_codes.csv' does not exist

D.The lookup command references 'error_id' but the alias changed the field to 'error_code'

AnswerD

The alias renames the field, so the lookup should match the new field name.

Why this answer

The correct answer is D because the search uses `lookup error_codes.csv error_id` but the FIELDALIAS in props.conf has renamed the field `error_id` to `error_code`. Since the lookup command references the original field name `error_id`, which no longer exists in the events after alias processing, the lookup cannot match any values and returns no results.

Exam trap

Splunk often tests the interaction between FIELDALIAS and lookup commands, trapping candidates who assume the original field name remains available after aliasing.

How to eliminate wrong answers

Option A is wrong because the FIELDALIAS syntax shown in the exhibit is correct (the format `dest_field = src_field` is valid). Option B is wrong because the lookup is defined in transforms.conf (as shown in the exhibit), and the issue is not about missing definition. Option C is wrong because the error message or exhibit does not indicate a missing file; the lookup file exists but the field name mismatch prevents matches.

Full explanation →

234

MCQeasy

A security analyst needs to find the number of failed login attempts per user. Which command group should be used?

A.top failed_login user

B.stats count by user

C.chart count by user

D.sort - count

AnswerB

stats count by user correctly groups events by user and returns a count for each user.

Why this answer

The `stats count by user` command is correct because it groups events by the `user` field and calculates the count of events (failed login attempts) for each user, producing a table with two columns: `user` and `count`. This directly answers the requirement to find the number of failed login attempts per user using a transforming command that aggregates data.

Exam trap

Splunk often tests the distinction between `stats`, `chart`, and `top` commands, and the trap here is that candidates may confuse `top` (which shows top values) with `stats count by user` (which provides a complete per-user count), or they may incorrectly use `chart` with improper syntax, thinking it is interchangeable with `stats` for simple aggregations.

How to eliminate wrong answers

Option A is wrong because `top` is a command that displays the most common values of a field, but it does not produce a per-user count of failed login attempts; it only shows the top values by frequency, not a breakdown for each user. Option C is wrong because `chart count by user` is syntactically incorrect; the correct syntax for the `chart` command is `chart count by user` (without the word 'by' after count), but even if corrected, `chart` is typically used for time-based or series data and is less straightforward for a simple count per user compared to `stats`. Option D is wrong because `sort - count` is not a complete command; it only sorts results by the `count` field in descending order but does not perform any aggregation or grouping to produce the counts per user.

Full explanation →

235

MCQhard

Refer to the exhibit. The search is expected to produce a count of HTTP status codes grouped into categories. However, the results show a column 'status' instead of 'status_category'. What is the problem?

A.The first 'stats count by status' is unnecessary; the eval should be applied first, then stats.

B.The eval command references a field 'status' that does not exist after the first stats.

C.The second stats command should be 'stats count by status'.

D.The eval command should use 'if' instead of 'case'.

AnswerA

Applying stats before eval loses the original status values for categorization, resulting in incorrect grouping.

Why this answer

Option A is correct because the search pipeline first uses `stats count by status`, which consumes the raw `status` field and outputs only the `status` and `count` fields. The subsequent `eval` command then tries to create `status_category` from `status`, but `status` still exists after the first `stats` (it is the group-by field). The real issue is that the `eval` should be placed before the first `stats` so that the categorization happens on the raw `status` values, and then `stats count by status_category` can aggregate by the new field.

The first `stats` is unnecessary and disrupts the intended flow.

Exam trap

Splunk often tests the order-of-operations pitfall where candidates assume `eval` can create a new field from a field that exists before `stats`, forgetting that `stats` transforms the data structure and only retains specified fields.

How to eliminate wrong answers

Option B is wrong because the `status` field does exist after the first `stats`; it is retained as the group-by field in the stats output. Option C is wrong because changing the second `stats` to `count by status` would still not create a `status_category` field; the `eval` would still be applied after the first `stats`, and the result would still show `status` instead of `status_category`. Option D is wrong because the `case` function is perfectly valid for mapping multiple status codes to categories; using `if` would require nested conditions and is less efficient, but the core problem is the order of operations, not the choice of conditional function.

Full explanation →

236

MCQeasy

A small business uses Splunk to monitor their point-of-sale (POS) system. They have a data model named 'POS_Transactions' that is not accelerated. The owner wants to create a simple dashboard showing daily sales totals. They write a search using |tstats against the data model, but it returns 'No events found'. A plain search over the same index returns expected results. What should the owner do to resolve this?

A.Modify the search to use |tstats summariesonly=t or switch to using |datamodel or |search.

B.Enable acceleration on the data model and wait for the summary to build.

C.Add a constraint to the root event to match POS logs.

D.Change the time range to include the current day only.

AnswerA

Immediately allows tstats to work without acceleration.

Why this answer

The `|tstats` command requires an accelerated data model by default; without acceleration, it returns no results because it queries the summary database, not the raw events. Option A correctly resolves this by either using `summariesonly=t` to force `|tstats` to search raw data or switching to `|datamodel` or `|search` which operate directly on the index. This aligns with Splunk's behavior where `|tstats` is optimized for accelerated summaries but can be overridden to access raw events.

Exam trap

The trap here is that candidates assume `|tstats` always works with any data model, but Splunk explicitly requires acceleration or the `summariesonly=t` flag to avoid 'No events found' errors.

How to eliminate wrong answers

Option B is wrong because enabling acceleration and waiting for the summary to build is unnecessary and time-consuming; the immediate fix is to adjust the search command, not change the data model configuration. Option C is wrong because adding a constraint to the root event does not address the core issue—`|tstats` without acceleration still returns no events regardless of constraints. Option D is wrong because changing the time range to include the current day only does not affect `|tstats` behavior; the command fails due to missing acceleration, not time range selection.

Full explanation →

237

MCQmedium

You are a Splunk administrator for a large e-commerce company. The marketing team has a dashboard that displays daily sales metrics, including revenue, number of transactions, and average order value. The dashboard is built using a single search that runs a 'timechart' command across all events. Recently, the dashboard has been timing out and failing to load during peak hours (10 AM - 2 PM) when traffic is highest. The team needs the dashboard to be available with minimal latency. You have the following options: A. Reduce the time range on the dashboard to the last hour instead of the default last 24 hours. B. Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index. C. Increase the search time limit in the Splunk settings to allow the search to run longer. D. Split the single search into multiple smaller searches, each for a different metric, and run them concurrently on separate panels. Which option best addresses the performance issue while maintaining data accuracy?

A.Split the single search into multiple smaller searches.

B.Reduce the time range on the dashboard to the last hour.

C.Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.

D.Increase the search time limit in Splunk settings.

AnswerC

This reduces the data volume to search, improving performance without losing accuracy.

Why this answer

Option C is correct because creating a summary index that pre-aggregates sales metrics every hour offloads the heavy computation from real-time searches. The dashboard then queries this smaller, pre-computed dataset, drastically reducing search time and avoiding timeouts during peak hours, while maintaining data accuracy since the aggregation is done on the raw data.

Exam trap

The trap here is that candidates often choose splitting the search (Option B) thinking it improves parallelism, but Splunk's architecture means multiple concurrent searches on the same data can increase I/O and CPU contention, whereas summary indexing directly reduces the data volume scanned.

How to eliminate wrong answers

Option A is wrong because reducing the time range to the last hour only shifts the problem—it does not address the root cause of high query load during peak traffic, and the team needs the full 24-hour view for daily metrics. Option B is wrong because splitting the single search into multiple smaller searches increases the number of concurrent searches, which can actually worsen performance by consuming more system resources and potentially causing additional contention. Option D is wrong because increasing the search time limit merely allows the slow search to run longer without fixing the underlying performance bottleneck; it does not reduce the computational load and may lead to resource exhaustion.

Full explanation →

238

MCQeasy

A user wants to add a drilldown to a dashboard panel so that clicking a value opens a related search in a new tab. Which Simple XML attribute is used?

A.link

B.target

C.drilldown

D.href

AnswerC

The 'drilldown' attribute enables click actions, often set to 'row' or 'cell'.

Why this answer

In Simple XML, the `drilldown` attribute is used to enable or disable click interactions on dashboard panels. When set to `drilldown`, clicking a value triggers a drilldown action, which by default opens a related search in the same tab. To open the search in a new tab, you must combine `drilldown` with the `target` attribute set to `_blank`.

The `drilldown` attribute itself is the correct answer because it is the primary attribute that enables the drilldown behavior.

Exam trap

Splunk often tests the distinction between the attribute that enables drilldown (`drilldown`) and the attribute that controls where the result opens (`target`), leading candidates to mistakenly choose `target` as the answer.

How to eliminate wrong answers

Option A is wrong because `link` is not a valid Simple XML attribute for drilldown; it is used in HTML for hyperlinks but not in Splunk dashboard XML. Option B is wrong because `target` is a separate attribute that specifies where to open the drilldown result (e.g., `_blank` for a new tab), but it does not enable drilldown by itself; it must be used alongside `drilldown`. Option D is wrong because `href` is an HTML attribute for specifying a URL in an anchor tag, not a Simple XML attribute for drilldown behavior.

Full explanation →

239

MCQmedium

A Splunk admin is tasked with creating a dashboard that shows the top 10 error codes from application logs. The logs contain a field 'error_code' which is extracted automatically. The admin writes the search: index=app sourcetype=app_log | top limit=10 error_code. The dashboard shows the correct data, but the admin wants to add a drilldown that passes the selected error code to another search. The admin considers using the 'fields' command to keep only error_code, the 'table' command to display the data, the 'eval' command to create a new field, or the 'stats' command to count. Which change should the admin make to the search to enable the drilldown functionality?

A.Add a stats count by error_code

B.Replace top with fields to keep only error_code

C.Replace top with table error_code, count

D.Add an eval command to create a clickable link

AnswerC

table creates a table that can be used for drilldown.

Why this answer

Option C is correct because the `table` command produces a tabular output that inherently supports drilldown in Splunk dashboards by preserving the raw event data and field values. When you use `table error_code, count`, the dashboard can pass the selected `error_code` value to another search via a token. The original `top` command aggregates data into a statistical summary that does not retain the raw event structure required for standard drilldown behavior.

Exam trap

The trap here is that candidates assume `top` already displays a table and thus supports drilldown, but they miss that `top` produces a statistical summary that does not retain the raw event context required for standard token-based drilldown in Splunk dashboards.

How to eliminate wrong answers

Option A is wrong because `stats count by error_code` produces a statistical summary similar to `top`, which does not preserve the raw event structure needed for drilldown; it also lacks the automatic `count` and `percent` fields that `top` provides, but the core issue is that aggregated results do not support token-based drilldown without additional configuration. Option B is wrong because `fields` only retains specified fields in the search results but does not format the output into a table; drilldown requires a structured display command like `table` to create clickable rows. Option D is wrong because `eval` creates a new field but does not change the output format; a clickable link would require additional dashboard XML or JavaScript, not just an `eval` command in the search string.

Full explanation →

240

MCQeasy

An administrator needs to extract a field from log data where the value appears between two square brackets, for example [error_code: 404]. Which search command should they use to create a custom field extraction without modifying the original data?

A.eval

B.fields

C.extract

D.rex

AnswerD

rex extracts fields using regex patterns without modifying the original data.

Why this answer

The `rex` command is used to extract fields using regular expressions without modifying the raw event data. In this scenario, `rex` can parse the pattern `\[error_code: (?<field>\d+)\]` to capture the value between square brackets into a new field, leaving the original log intact.

Exam trap

Splunk often tests the distinction between `extract` (for key-value pairs) and `rex` (for regex-based extraction), and the trap here is that candidates confuse `extract` with general field extraction, not realizing it requires a specific `field=value` format to work.

How to eliminate wrong answers

Option A is wrong because `eval` creates or modifies fields using expressions and functions, but it does not perform regex-based extraction from raw text without additional string parsing. Option B is wrong because `fields` is used to include or exclude fields from search results, not to extract new fields from raw data. Option C is wrong because `extract` is a command for pulling key-value pairs from structured data (e.g., `field=value`), not for regex-based extraction of values between delimiters like square brackets.

Full explanation →

241

MCQeasy

An analyst creates a pivot from the `Authentication` data model. Which of the following is a valid reason to use a pivot instead of a search?

A.Pivots provide a graphical interface for non-technical users.

B.Pivots can be created without a data model.

C.Pivots can be used to create real-time alerts.

D.Pivots are faster than any search.

AnswerA

Pivots are designed to be used by users who may not know SPL.

Why this answer

Option A is correct because pivots in Splunk provide a graphical, drag-and-drop interface that allows non-technical users to create reports and visualizations without needing to write SPL queries. This is a key advantage of pivots, as they abstract away the complexity of search syntax by leveraging the structure of a data model.

Exam trap

Splunk often tests the misconception that pivots are faster than any search, but the correct understanding is that pivots are a user-friendly abstraction, not a performance guarantee, and they depend on data model acceleration for speed gains.

How to eliminate wrong answers

Option B is wrong because pivots require a data model to be defined; they cannot be created without one, as they rely on the data model's fields and constraints. Option C is wrong because pivots are designed for ad-hoc reporting and analysis, not for real-time alerting; alerts must be created using searches or scheduled reports. Option D is wrong because pivots are not inherently faster than any search; performance depends on the data model design and the underlying data, and some optimized searches can outperform pivots.

Full explanation →

242

MCQmedium

A search uses the rex command to extract fields from a log line. The field extraction is working correctly, but some events are missing the extracted field. What is a possible reason?

A.The rex command does not support named groups.

B.The events that are missing the field do not contain the pattern.

C.The regex pattern is too complex.

D.The rex command must be used with eval.

AnswerB

If the pattern is not present, no field is extracted.

Why this answer

The rex command extracts fields by matching a regex pattern against the raw event text. If an event does not contain the substring that matches the pattern, no field is extracted. This is the most direct and common reason for missing fields — the pattern simply isn't present in those events.

Exam trap

Splunk often tests the misconception that rex always extracts a field for every event, when in reality it only extracts if the pattern matches — candidates may overlook the fundamental requirement of pattern presence in the raw data.

How to eliminate wrong answers

Option A is wrong because the rex command fully supports named capturing groups (e.g., (?<field_name>pattern)), which is the standard way to extract fields. Option C is wrong because regex complexity does not cause fields to be missing; it may affect performance or accuracy, but if the pattern matches, the field is extracted. Option D is wrong because rex is a standalone command that does not require eval; it can be used in a pipeline without eval.

Full explanation →

243

Multi-Selecthard

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Select 3 answers

A.Use the `eval` command to set a field and then `where` before the transforming command.

B.Use the `fields` command to remove unwanted fields.

C.Use the `where` command after the transforming command.

D.Use a search term in the initial search string.

E.Use the `search` command before the transforming command.

AnswersA, D, E

eval and where together filter before.

Why this answer

Option A is correct because the `eval` command can create or modify fields, and the `where` command can then filter events based on those computed fields. Placing `where` before a transforming command (like `stats` or `timechart`) filters events before aggregation, which is essential for accurate results. This is a common pattern for conditional filtering in Splunk.

Exam trap

Splunk often tests the distinction between filtering events (removing entire events) versus filtering fields (removing parts of events), and the trap here is that candidates may confuse the `fields` command (which only removes fields) with event filtering, or incorrectly think that filtering after a transforming command is equivalent to filtering before.

Full explanation →

244

MCQmedium

An analyst wants to save a search so that they can run it again with a single click in the future. Which action should they take?

A.Click 'Save As' and choose 'Report'.

B.Click the 'Share' button and copy the search URL.

C.Click the 'History' button to see past search strings.

D.Click 'Save As' and choose 'Alert'.

AnswerA

Report saves the search and makes it accessible from the Reports menu.

Why this answer

Option A is correct because saving a search as a Report in Splunk creates a persistent, reusable search that can be executed with a single click from the Reports listing or dashboard. Reports store the search string, time range, and view format, allowing the analyst to run the exact same search without re-entering the query. This directly meets the requirement of running the search again with a single click in the future.

Exam trap

Splunk often tests the distinction between saving a search as a Report (for manual re-run) versus saving as an Alert (for automated, scheduled execution), and candidates confuse the two because both appear under 'Save As'.

How to eliminate wrong answers

Option B is wrong because clicking 'Share' and copying the search URL only provides a link to the current search results or job, not a saved search definition; the URL may expire or require re-running the search manually. Option C is wrong because clicking 'History' shows past search strings from the current session, but these are not saved persistently and cannot be run with a single click after the session ends. Option D is wrong because saving as an Alert creates a scheduled search that triggers actions based on conditions, not a simple one-click manual execution; alerts are designed for automated notifications, not ad-hoc re-runs.

Full explanation →

245

MCQeasy

Which command is used to import an external CSV file into a Splunk lookup table for the first time?

A.`| lookup`

B.`| inputlookup`

C.`| fields`

D.`| outputlookup`

AnswerD

Creates or appends to a lookup.

Why this answer

The `| outputlookup` command is used to create or overwrite a lookup table file in Splunk from search results. When importing an external CSV file into a Splunk lookup table for the first time, you would first ingest the CSV data (e.g., via `| inputcsv` or by uploading the file), then use `| outputlookup` to write that data into a lookup definition that Splunk can reference.

Exam trap

Splunk often tests the distinction between `| inputlookup` (reading from a lookup) and `| outputlookup` (writing to a lookup), and candidates frequently confuse them because both involve lookup tables but serve opposite purposes.

How to eliminate wrong answers

Option A is wrong because `| lookup` is used to enrich search results by matching fields against an existing lookup table, not to import or create a lookup table. Option B is wrong because `| inputlookup` loads the contents of an existing lookup table into a search, it does not import or create a new lookup table. Option C is wrong because `| fields` is used to include or exclude fields from search results, it has no role in importing or creating lookup tables.

Full explanation →

246

MCQhard

You are a Splunk administrator at a mid-sized company that uses Splunk Enterprise to monitor application logs from a web server cluster. The cluster has five servers, each sending logs via a universal forwarder to a single indexer. The indexer has ample resources. Recently, users have complained that searches for the last 24 hours are slow, but searches for the last hour are fast. The data volume is about 50 GB per day. You suspect the issue is related to how data is stored or indexed. Which action should you take first to improve search performance for the 24-hour time range?

A.Increase the number of parallel search processes in the indexes.conf settings.

B.Add a second indexer and distribute incoming data using load balancing.

C.Exclude internal Splunk logs (splunkd.log) from being indexed by setting up appropriate input configurations on forwarders.

D.Reduce the retention period for the index from 90 days to 30 days.

AnswerC

Internal logs can significantly increase volume; excluding them reduces index size and improves search performance.

Why this answer

Option C is correct because internal Splunk logs (splunkd.log) can generate significant volume and are indexed by default, consuming resources and slowing searches over longer time ranges. Excluding them on the forwarders reduces the total indexed data, improving search performance for the 24-hour window without affecting application log searches.

Exam trap

The trap here is that candidates often focus on scaling infrastructure (adding indexers or increasing parallelism) rather than reducing unnecessary data volume, which is the most direct and cost-effective fix for slow searches over longer time ranges.

How to eliminate wrong answers

Option A is wrong because increasing parallel search processes in indexes.conf affects search execution parallelism, not the underlying data volume or storage efficiency; it would not address the root cause of slow searches due to excessive indexed data. Option B is wrong because adding a second indexer with load balancing distributes incoming data across multiple indexers, which can improve indexing throughput but does not reduce the total data volume or speed up searches on a single indexer if the bottleneck is data size. Option D is wrong because reducing the retention period from 90 to 30 days only affects how long data is kept, not the volume of data indexed per day; searches for the last 24 hours would still be slow if the daily data volume remains unchanged.

Full explanation →

247

MCQhard

During onboarding, a new user can't find any data in Splunk. They see 'No results found' for all searches. The data is being forwarded from a universal forwarder. What should they check first?

A.Check if the user has admin role

B.Check if the forwarder is configured to send to the correct indexer

C.Check if the firewall is blocking ports

D.Check if the search is using the correct time range

AnswerB

Common misconfiguration.

Why this answer

Option B is correct because the most common reason a universal forwarder sends data that never appears in Splunk is misconfiguration of the outputs.conf file. The forwarder must specify the correct indexer IP address or hostname and the receiving port (default 9997) using the TCP output stanza; if this is wrong, data is sent to the wrong destination or nowhere at all. Checking the forwarder's configuration first isolates whether data is even reaching the indexer tier before investigating other potential issues.

Exam trap

The trap here is that candidates often jump to network-level issues (firewall) or user permissions first, but Splunk's onboarding flow requires verifying the forwarder-to-indexer data path as the initial troubleshooting step, since without correct output configuration, no data can ever reach the indexer.

How to eliminate wrong answers

Option A is wrong because the user's role (admin vs. non-admin) affects what data they can see via index-level permissions, but it does not cause 'No results found' for all searches—if data exists in the index, even a non-admin user would see results for indexes they have access to. Option C is wrong because while a firewall blocking port 9997 (or the configured receiving port) could prevent data from reaching the indexer, this is a network-level issue that should be checked after verifying the forwarder's configuration, as the forwarder's output target must be correct first. Option D is wrong because using the wrong time range would still show results if data exists in the index for other time periods; 'No results found' for all searches indicates no data at all in the searched indexes, not a time filter issue.

Full explanation →

248

MCQhard

A search using `| lookup user_lookup user_id OUTPUT department_name` returns incorrect department names for some users. The lookup file is correct. What could be the issue?

A.The output field name is misspelled in the search.

B.The field `user_id` in the events has trailing spaces.

C.The lookup file has duplicate entries for the same user_id.

D.The lookup definition uses case-insensitive matching.

AnswerB

Trailing spaces cause mismatch.

Why this answer

Option B is correct because trailing spaces in the `user_id` field within the events will cause the lookup to fail to match the corresponding entry in the lookup file, even though the lookup file itself is correct. Splunk performs exact string matching for lookups by default, so any leading or trailing whitespace in the event data will prevent a match, leading to incorrect or missing output. Using the `trim` function or a `| rex` command to strip whitespace before the lookup resolves this issue.

Exam trap

Splunk often tests the subtlety that whitespace in event fields can break lookups, leading candidates to incorrectly blame the lookup file or definition when the actual issue is data cleanliness.

How to eliminate wrong answers

Option A is wrong because the search explicitly specifies `OUTPUT department_name`, and the question states the lookup file is correct; if the output field name were misspelled, the search would either fail with an error or return no output, not incorrect department names. Option C is wrong because duplicate entries for the same `user_id` in the lookup file would cause the lookup to return the first matching row, which could still be correct; the question states the lookup file is correct, implying no duplicates or that duplicates are not the root cause. Option D is wrong because case-insensitive matching would actually help match more values, not cause incorrect results; the default behavior is case-sensitive, and if the lookup definition used case-insensitive matching, it would be less likely to produce mismatches.

Full explanation →

249

MCQmedium

A dashboard includes a pie chart showing the distribution of error types. The data comes from a search that uses `top` command. The pie chart is showing a slice labeled 'Other' that is very large. What is the most likely cause?

A.The `top` command is using `limit=0` which shows all values.

B.The search uses `rare` instead of `top`.

C.The pie chart has a maximum number of slices set to 5.

D.The `top` command default limit is 10, grouping remaining into 'Other'.

AnswerD

Default `top` shows top 10; the rest are grouped into 'Other', causing a large slice.

Why this answer

The `top` command in Splunk by default returns the top 10 most common values and groups all remaining values into an 'Other' category. If the pie chart shows a very large 'Other' slice, it indicates that the default limit of 10 is too low for the dataset, causing many distinct error types to be lumped together. Option D correctly identifies this default behavior as the most likely cause.

Exam trap

Splunk often tests the default behavior of the `top` command, specifically that it groups remaining values into 'Other' with a default limit of 10, and candidates may mistakenly think the chart's slice limit or other commands like `rare` are responsible.

How to eliminate wrong answers

Option A is wrong because `limit=0` with the `top` command does not show all values; instead, it returns all results without an 'Other' grouping, which would eliminate the 'Other' slice entirely. Option B is wrong because the `rare` command returns the least common values, not the most common, and would not produce a large 'Other' slice in a pie chart of error types. Option C is wrong because the pie chart's maximum number of slices setting would limit the number of visible slices, but the 'Other' slice is generated by the `top` command, not by the chart configuration; if the chart had a limit of 5, it would still show the top 5 values from the `top` command's output, not create an 'Other' slice.

Full explanation →

250

Multi-Selectmedium

Which THREE of the following are components of a data model in Splunk?

Select 3 answers

A.Constraints

B.Dashboard panel

C.Child object

D.Root event

E.Saved search

AnswersA, C, D

Filters to include relevant events.

Why this answer

Constraints are a core component of a data model in Splunk because they define the filtering criteria that restrict which events are included in the dataset. A constraint is a search expression applied to the root event or child objects to ensure only relevant data populates the data model, making it essential for accurate data model acceleration and pivot reporting.

Exam trap

The trap here is that candidates confuse the components of a data model (root event, child objects, constraints, fields) with Splunk artifacts used to build reports or dashboards, such as saved searches and dashboard panels, which are not part of the data model definition.

Full explanation →

251

MCQmedium

A Splunk admin configured a CSV-based lookup to map device IP addresses to location data. The lookup 'devices.csv' has columns 'ip', 'building', 'floor'. In props.conf, they set: `LOOKUP-1 = devices ip OUTPUT building floor`. In transforms.conf: `[devices] filename = devices.csv`. The search over sourcetype 'network_logs' returns events with the 'ip' field, but 'building' and 'floor' are missing. The admin confirms the CSV file exists and has data. What is the most likely issue?

A.The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.

B.The CSV file is too large and the lookup is not being loaded.

C.The 'ip' field is not properly extracted from the sourcetype.

D.The lookup file is not accessible from the search head because it is stored on a different host.

AnswerA

In props.conf, after LOOKUP-<class> = you just specify the lookup name; field mappings go in transforms.conf under that stanza.

Why this answer

Option A is correct because the `LOOKUP-1` definition in `props.conf` incorrectly includes the match and output fields. The correct syntax is `LOOKUP-1 = devices` only, with the match field (`ip`) and output fields (`building`, `floor`) defined in the `transforms.conf` stanza under `[devices]` using `external_type = csv`, `filename = devices.csv`, `match_type = WILDCARD(ip)`, and `default_match = NONE`. The admin's syntax causes Splunk to ignore the lookup configuration entirely, so no fields are added.

Exam trap

The trap here is that candidates confuse the `props.conf` LOOKUP syntax with the `| lookup` SPL command, mistakenly thinking match and output fields can be specified inline in `props.conf`.

How to eliminate wrong answers

Option B is wrong because CSV file size does not prevent a lookup from being loaded; Splunk can handle large lookups, and the issue is a configuration syntax error, not file size. Option C is wrong because the admin confirmed events have the 'ip' field, so extraction is not the problem; the lookup simply fails to execute due to incorrect syntax. Option D is wrong because lookups are resolved from the search head's local file system or a shared location (like a search peer), and the admin confirmed the file exists and has data; the issue is not about accessibility but about misconfiguration.

Full explanation →

252

MCQeasy

A user wants to create a bar chart showing the count of events by host for the last hour. Which command should be used?

A.`index=* | timechart count by host`

B.`index=* | top host`

C.`index=* | chart count by host`

D.`index=* | stats count by host`

AnswerD

This produces a table of hosts and their counts, suitable for a bar chart.

Why this answer

Option D is correct because `stats count by host` produces a table of hosts and their event counts, which can be directly visualized as a bar chart. The user wants a count of events by host for the last hour, and `stats` with a `by` clause is the appropriate transforming command to aggregate counts per host without time-series splitting.

Exam trap

Splunk often tests the distinction between `stats` and `timechart` — candidates mistakenly choose `timechart` because they think a bar chart requires a time axis, but the question asks for a count by host over the last hour, not a trend over time.

How to eliminate wrong answers

Option A is wrong because `timechart count by host` creates a time-series chart with a separate series for each host, not a single bar chart showing total counts per host over the entire hour. Option B is wrong because `top host` returns the most common hosts with their counts and percentages, but it limits the output to a default of 10 results and is designed for a different visualization (e.g., a table or pie chart), not a bar chart of all hosts. Option C is wrong because `chart count by host` is syntactically invalid; `chart` requires a split-by clause using `over` or `by` in a specific order (e.g., `chart count over host`), and the given syntax would produce an error or unexpected results.

Full explanation →

253

MCQmedium

A user wants to view only the fields that appear in the current search results, without seeing all extracted fields. Which option should they use?

A.Field picker

B.Selected fields

C.All fields

D.Interesting fields

AnswerB

Shows only chosen fields.

Why this answer

The 'Selected fields' option in Splunk displays only the fields that appear in the current search results, allowing users to focus on relevant data without being overwhelmed by all extracted fields. This is distinct from the 'All fields' view, which shows every field extracted from the raw data, including those not present in the current results.

Exam trap

The trap here is that candidates often confuse 'Selected fields' with 'Interesting fields', thinking both show only fields in results, but 'Interesting fields' is a heuristic-based subset that may include fields not present in the current search results.

How to eliminate wrong answers

Option A is wrong because the Field picker is a tool for adding or removing fields from the search results display, not for viewing only fields present in the current results. Option C is wrong because 'All fields' shows every field extracted from the data, regardless of whether they appear in the current search results, which contradicts the user's requirement. Option D is wrong because 'Interesting fields' are a subset of fields automatically identified by Splunk as potentially relevant, but they are not limited to fields that appear in the current search results.

Full explanation →

254

MCQhard

A Splunk admin has a lookup with 10 million rows. The search uses this lookup as a left join and takes too long. Which design change would most improve performance?

A.Filter the main search to only relevant events before the lookup.

B.Use the 'output' clause to limit returned fields.

C.Use an automatic lookup instead of the lookup command.

D.Convert the lookup to a KV store collection.

AnswerA

Reducing the number of events to match drastically improves performance.

Why this answer

Filtering the main search to only relevant events before the lookup reduces the number of rows that need to be matched against the 10-million-row lookup table. This minimizes the computational overhead of the left join operation, as Splunk must compare each event from the main search against every row in the lookup. By narrowing the event set early, you drastically cut the number of comparisons, directly improving search performance.

Exam trap

The trap here is that candidates often assume limiting output fields (Option B) or using an automatic lookup (Option C) will reduce the workload, but they fail to realize that the join itself—not the field count or automation—is the bottleneck, and only reducing the number of input events (Option A) addresses the root cause.

How to eliminate wrong answers

Option B is wrong because using the 'output' clause limits only the fields returned from the lookup, not the number of rows processed; the full 10-million-row lookup still must be scanned and joined. Option C is wrong because an automatic lookup is applied at search time to every event, which would actually increase overhead by performing the join on all events without the ability to filter first. Option D is wrong because converting to a KV store collection does not inherently improve join performance; KV store lookups are optimized for key-value retrieval but still require a full scan or index lookup, and the join operation remains expensive with 10 million rows.

Full explanation →

255

MCQeasy

A Splunk user wants to see the list of fields that are defined in a lookup table named 'assets' without running a search. Which command should they use?

A.| inputlookup assets

B.| lookup assets

C.| stats values(*) as * by *

D.| fields assets

AnswerA

inputlookup displays the contents of the lookup table, including field names.

Why this answer

Option C is correct. The 'inputlookup' command can be used to preview the lookup table contents and fields. Option A (lookup) enriches events.

Option B (fields) shows event fields. Option D (stats) computes statistics.

Full explanation →

256

MCQeasy

A Splunk user wants to see a list of all fields that are extracted from events of sourcetype 'apache_access'. They need to know which fields are available for use in searches and lookups. Which command should they use to discover all fields automatically extracted by Splunk for that sourcetype?

A.Use the search 'sourcetype=apache_access | fields' to list all fields in a few sample events

B.Use the 'extract' command with no arguments to show all extracted fields

C.Use the 'regex' command with a capturing group to identify fields

D.Use the 'inputlookup' command to display field names

AnswerA

Running a search and using 'fields' command shows all fields present in the results.

Why this answer

Option A is correct because the `| fields` command, when used without arguments, lists all fields present in the search results. By searching `sourcetype=apache_access` and piping to `| fields`, Splunk returns a table of all extracted fields (both default and custom) from the events of that sourcetype, allowing the user to see which fields are available for searches and lookups.

Exam trap

The trap here is that candidates often confuse the `extract` command (which re-extracts fields) with the `fields` command (which lists field names), or they mistakenly think `inputlookup` can display event fields instead of lookup table columns.

How to eliminate wrong answers

Option B is wrong because the `extract` command without arguments does not show all extracted fields; it forces Splunk to re-run field extraction (including regex-based extractions) on the events, but it does not list field names. Option C is wrong because the `regex` command is used to filter events based on a regular expression pattern, not to discover or list all extracted fields. Option D is wrong because `inputlookup` is used to load the contents of a lookup table (CSV or KV store) into search results, not to display fields extracted from events of a specific sourcetype.

Full explanation →

257

MCQmedium

How many events will be output by this search?

A.15

B.3

C.5

D.1

AnswerB

stats count by user produces one event per distinct user.

Why this answer

The search uses the `dedup` command with a field name, which removes duplicate events based on that field. With 15 total events but only 3 unique values in the specified field, `dedup` keeps the first occurrence of each unique value, outputting exactly 3 events.

Exam trap

Splunk often tests the misconception that `dedup` counts all events or that it operates on the total event count rather than the number of unique field values, leading candidates to pick the total event count (15) instead of the correct unique count (3).

How to eliminate wrong answers

Option A is wrong because 15 is the total number of events before deduplication, not the output after dedup removes duplicates. Option C is wrong because 5 would be the result if dedup were applied on a different field with 5 unique values, but the actual unique count is 3. Option D is wrong because 1 would only be correct if all events had the same value in the dedup field, which is not the case here.

Full explanation →

258

MCQmedium

A junior administrator at a mid-size company is responsible for onboarding new data sources into Splunk. She has been asked to add a custom application log file, which is generated in a proprietary text format. The log file is located on a Linux server that is not a Splunk universal forwarder. The administrator plans to use the Add Data wizard in Splunk Web to monitor this file. However, when she navigates to Settings > Add Data, she does not see the option to 'Monitor a file' but only sees options for 'Upload' and 'Forward'. She is logged in as admin. What is the most likely reason for this?

A.The administrator is not using the correct role; only 'power' users can monitor files.

B.The Add Data wizard only monitors files on the local machine where Splunk is installed.

C.The 'Monitor' option appears only after purchasing an additional license for inputs.

D.The administrator has exceeded the daily license volume and monitoring is blocked.

AnswerB

Correct: The wizard is for local input; remote files need a forwarder.

Why this answer

Option A is correct because the 'Monitor' option is available only when Splunk is running locally on the same machine as the file; the Add Data wizard is for the local Splunk instance. If the file is on a remote server, the admin must use a forwarder. Option B is incorrect because the license does not affect the options in the wizard.

Option C is incorrect because admin has full capabilities. Option D is incorrect because the license does not add inputs.

Full explanation →

259

MCQhard

Refer to the exhibit. The lookup `usertable` has fields: user, role, department. The search returns an error: "Error in 'where' command: Field 'role' is not defined." What is the most likely cause?

A.The `inputlookup` command does not output fields that can be used with `where`.

B.The field 'role' is not a valid field in the lookup because it is a reserved word.

C.The lookup name 'usertable' is misspelled.

D.The lookup file does not have a column named 'role'.

AnswerD

Field undefined.

Why this answer

Option C is correct because the error indicates 'role' field is missing. Most likely the lookup file does not have a column named 'role'. Option A is wrong because 'role' is not a reserved word.

Option B is wrong because misspelling would cause file not found. Option D is wrong because inputlookup does output fields.

Full explanation →

260

MCQeasy

A data model includes a root event called `Authentication` with a constraint `action=*`. Which of the following is a valid reason to add a child dataset?

A.To enable acceleration for the root event.

B.To define a subset of events with a specific field value, like `action=failure`.

C.To add additional constraints to the root event.

D.To add calculated fields to the root event.

AnswerB

Child datasets are ideal for subsets based on field values.

Why this answer

Option B is correct because a child dataset in a Splunk data model is used to define a subset of events from the root event based on specific field values or additional constraints. In this case, adding a child dataset with `action=failure` filters the `Authentication` root events to only those representing failed authentication attempts, enabling focused analysis without altering the root event's definition.

Exam trap

Splunk often tests the misconception that child datasets are used to modify or extend the root event's definition, when in fact they are used to create subsets of events with additional constraints.

How to eliminate wrong answers

Option A is wrong because acceleration is enabled on the root event or dataset itself, not by adding a child dataset; child datasets inherit acceleration settings from the parent. Option C is wrong because adding constraints to the root event is done by modifying the root event's definition, not by adding a child dataset; child datasets add constraints for their own subset, not for the root. Option D is wrong because calculated fields are added to the root event or dataset via the data model editor, not by creating a child dataset; child datasets can have their own calculated fields, but they do not add them to the root event.

Full explanation →

261

Multi-Selecthard

Which THREE of the following are true about automatic field extraction in Splunk?

Select 3 answers

A.It can extract fields from structured data like JSON and XML.

B.Custom field extractions are not allowed if auto extraction is enabled.

C.It extracts fields from raw data based on default patterns.

D.Fields extracted automatically are available for searching immediately.

E.Auto extraction cannot be disabled for specific sourcetypes.

AnswersA, C, D

Splunk can parse structured formats automatically.

Why this answer

Option A is correct because Splunk's automatic field extraction (also known as 'auto kv' or 'key-value extraction') can parse structured data formats such as JSON and XML. When Splunk indexes data, it automatically identifies key-value pairs in these formats and extracts them as searchable fields without requiring manual configuration.

Exam trap

Splunk often tests the misconception that automatic field extraction is mutually exclusive with custom extractions, but in reality they can be used together, and auto extraction can be selectively disabled per sourcetype.

Full explanation →

262

Multi-Selecthard

Which THREE of the following are features available in the Splunk Settings menu?

Select 3 answers

A.Data summary

B.Indexes

C.Data inputs

D.Search history

E.Roles

AnswersB, C, E

Configured in Settings.

Why this answer

The Splunk Settings menu provides administrative controls for configuring core system components. Indexes (B) are correct because this menu allows you to create, edit, and manage index definitions, including setting retention policies and storage locations. Data inputs (C) is correct as the menu provides access to configure all input types (e.g., monitor, script, syslog, HTTP Event Collector).

Roles (E) is correct because the Settings menu includes the Access Controls section where you can define role-based permissions and capabilities.

Exam trap

Splunk often tests the distinction between navigation elements (like Data summary and Search history, which are user-facing features within the Search app) and administrative configuration menus (Settings), causing candidates to confuse operational views with system settings.

Full explanation →

263

MCQhard

An administrator notices that an automatic lookup is not being applied to events from a certain sourcetype. The lookup file exists and the configuration in props.conf appears correct. What is a possible reason?

A.Splunk needs to be restarted after adding the automatic lookup

B.The lookup file is stored in the wrong directory but referenced correctly

C.The lookup field is case-sensitive and the data doesn't match

D.The lookup table is defined in transforms.conf incorrectly

AnswerD

Both props.conf and transforms.conf must be configured correctly.

Why this answer

Option D is correct because the automatic lookup is defined in props.conf, but the actual lookup table configuration (including the lookup file name, field mappings, and match type) is specified in transforms.conf. If transforms.conf is missing, has a syntax error, or incorrectly defines the lookup (e.g., wrong filename, mismatched field names, or incorrect stanza name), the automatic lookup will fail silently, even if props.conf appears correct.

Exam trap

The trap here is that candidates assume a correctly written props.conf stanza is sufficient, but Splunk requires a corresponding transforms.conf stanza to define the lookup details, and many test-takers overlook this two-step configuration dependency.

How to eliminate wrong answers

Option A is wrong because Splunk does not require a restart after adding an automatic lookup; it only needs a reload of the deployment (e.g., via 'splunk reload deploy-server' or a UI refresh) or a restart of the search head if the lookup is used in distributed search. Option B is wrong because if the lookup file is stored in the wrong directory (e.g., not in $SPLUNK_HOME/etc/system/lookups or an app's lookups folder), Splunk would not find it at all, and the configuration in props.conf would not appear correct—the administrator would see an error in splunkd.log. Option C is wrong because while case sensitivity can cause lookup mismatches, the question states the lookup file exists and props.conf appears correct; case sensitivity is a data-matching issue, not a configuration error, and would not prevent the lookup from being applied—it would just return no matches.

Full explanation →

264

MCQhard

A company uses Splunk to monitor its e-commerce platform. They have a lookup file (user_geo.csv) that maps user_id to city, state, and country. The search `index=ecommerce sourcetype=access_combined | lookup user_geo user_id OUTPUT city, state, country | stats count by country` is used to analyze user locations. Recently, the lookup stopped returning results for many events. The lookup file is updated daily via a script that pulls from an external API. The Splunk administrator checks the lookup definition and finds that the lookup is configured to automatically reload every 24 hours. The last successful load was 23 hours ago. The events still contain the 'user_id' field. Which course of action should the administrator take first?

A.Verify that the events contain the `user_id` field by running `index=ecommerce sourcetype=access_combined | head 10`.

B.Increase the auto-reload interval to 12 hours to ensure more frequent updates.

C.Manually reload the lookup using the `| inputlookup user_geo.csv | outputlookup user_geo.csv` technique or the UI reload button.

D.Modify the search to use `| inputlookup user_geo.csv` instead of the lookup command.

AnswerC

A manual reload forces Splunk to use the latest lookup data, which may have been updated after the last automatic reload.

Why this answer

Option A is correct because a time-based automatic reload may not happen immediately after an update, and manually reloading ensures the lookup is current. Option B is incorrect because the events have the user_id field, so the issue is not missing event stamps. Option C is incorrect because `inputlookup` would not help; it loads the table as events, not for enrichment.

Option D is incorrect because the lookup definition already has auto-reload; the issue is timing.

Full explanation →

265

MCQhard

You are an admin for a large healthcare organization that uses Splunk for compliance monitoring. You have a data model named 'Patient_Access' that tracks access to patient records. The data model includes fields like 'employee_id', 'patient_id', 'access_time', and 'action'. The data model is accelerated with a 30-day summary. Recently, a new compliance report requires filtering on a field named 'department', which is not currently part of the data model. You add 'department' as a new field to the root event of the data model. After this change, reports using the data model become slower. The data model's acceleration summary size has significantly increased. What is the most likely reason for the slowdown?

A.Adding the field required the acceleration summary to be rebuilt, and the new field increased the summary size because it is not constrained.

B.The data model must be re-accelerated manually after adding a field, and the admin did not do so.

C.The 'department' field has a high number of unique values, and the acceleration summary cannot handle high-cardinality fields efficiently.

D.The new field caused the root event constraint to become more inclusive, adding more events.

AnswerA

Adding a field increases the data stored in acceleration summaries.

Why this answer

When a new field is added to the root event of an accelerated data model, the acceleration summary must be rebuilt to include that field. Because the 'department' field is not constrained (i.e., it is not part of a constraint that limits which events are included), the summary now stores values for this field across all events, significantly increasing the summary size. This larger summary takes more time to scan and process, causing queries to become slower.

Exam trap

The trap here is that candidates often assume high cardinality (Option C) is the culprit, but the real issue is the lack of a constraint on the new field, which forces the summary to store data for all events, regardless of cardinality.

How to eliminate wrong answers

Option B is wrong because Splunk automatically re-accelerates the data model after a structural change like adding a field; manual re-acceleration is not required. Option C is wrong because while high-cardinality fields can impact acceleration efficiency, the primary issue here is the unconstrained field causing the summary to store data for all events, not the cardinality itself. Option D is wrong because adding a field to the root event does not change the root event constraint; it only adds a new attribute to events that already match the constraint, so no additional events are included.

Full explanation →

266

MCQeasy

Which of the following is required to use data model acceleration for a Pivot report?

A.Check the 'Accelerate' box on the data model and set a time range

B.Create a data model with only root objects

C.Enable summary indexing

D.Use the `datamodel` command with `acceleration` parameter

AnswerA

This enables acceleration and defines the summary range.

Why this answer

Option C is correct because data model acceleration is enabled by checking the 'Accelerate' box on the data model and setting a time range. Option A is wrong because summary indexing is not required. Option B is wrong because root objects are not the only requirement.

Option D is wrong because acceleration is not configured via the datamodel command.

Full explanation →

267

MCQeasy

Refer to the exhibit. A user runs this search. The results show only Error and Warning, but no Info. What is the most likely reason?

A.The eval command has a syntax error.

B.The stats command omitted the info severity because it has zero count.

C.The sort command filters out Info.

D.The case statement does not evaluate to a string for Info.

AnswerB

Stats by default only shows values present in data; zero-count categories are omitted.

Why this answer

The stats command with count() only returns results for field values that have at least one event. Since no events had severity=Info after the eval, Info has a count of zero and is omitted from the output. This is the expected behavior of stats — it does not include zero-count buckets unless explicitly requested with the `usenull=f` or similar options.

Exam trap

Splunk often tests the misconception that stats returns all possible values of a field, when in fact it only returns values that appear in the events, omitting zero-count buckets.

How to eliminate wrong answers

Option A is wrong because the eval command with case() is syntactically correct — it assigns 'Error', 'Warning', and 'Info' based on the conditions, and there is no syntax error. Option C is wrong because the sort command only reorders results; it does not filter out any rows, so it cannot remove Info from the output. Option D is wrong because the case statement does evaluate to a string for Info — when severity is not 'error' or 'warn', the case() returns 'Info' as a string, so the eval works correctly.

Full explanation →

268

MCQeasy

A user wants to view events from the last 4 hours. Which is the most efficient way to set the time range in Splunk Web?

A.Open the time range picker and select 'Last 4 hours' from the presets.

B.Type `-4h@h` in the search bar in front of the query.

C.Use the date-time range picker to enter start and end times explicitly.

D.Click 'All time' and then refine by zooming the timeline.

AnswerA

The preset is quick and accurate.

Why this answer

Option A is correct because the time range picker's 'Last 4 hours' preset is the most efficient method for setting a relative time range in Splunk Web. It directly applies the search-time constraint without requiring manual syntax or additional processing, leveraging Splunk's optimized preset logic for common ranges.

Exam trap

The trap here is that candidates may confuse the `-4h@h` syntax with a simple 'last 4 hours' range, not realizing that the `@h` qualifier snaps to the start of the hour, altering the time window and potentially missing recent data.

How to eliminate wrong answers

Option B is wrong because typing `-4h@h` in the search bar applies a relative time modifier that snaps to the start of the current hour, which does not represent the last 4 hours from the current time but rather the last 4 hours from the beginning of the current hour, potentially excluding recent events. Option C is wrong because using the date-time range picker to enter explicit start and end times is less efficient for a simple relative range like 'last 4 hours' and introduces unnecessary manual input and risk of error. Option D is wrong because clicking 'All time' and then zooming the timeline is inefficient and resource-intensive, as it first retrieves all events before narrowing the view, which can degrade performance and is not the most direct method for setting a time range.

Full explanation →

269

MCQhard

A user notices that a search returns results only from the last 15 minutes, even though the time range picker is set to "All time". The search string is: error | timechart count. Which is the most likely cause?

A.The user selected All time but applied a subsearch.

B.The search includes an implicit time range like earliest=-15m@m in a saved search or settings.

C.The indexer is only returning recent data due to performance.

D.The timechart command defaults to a 15-minute window.

AnswerB

A time modifier in the search string or saved search settings can restrict the time range, and it overrides the picker.

Why this answer

Option B is correct because the search includes an implicit time range, such as `earliest=-15m@m`, which overrides the global time range picker set to 'All time'. This can occur in saved search settings or search macros, forcing the search to only look at the last 15 minutes regardless of the picker selection. The `timechart` command does not impose a time window itself; it only aggregates results within the time range provided by the search.

Exam trap

The trap here is that candidates assume the time range picker always controls the search window, but Splunk allows explicit time modifiers in the search string to override the picker, and the `timechart` command is often incorrectly blamed for imposing a time limit.

How to eliminate wrong answers

Option A is wrong because applying a subsearch does not inherently restrict the time range to 15 minutes; a subsearch can return any time range based on its own constraints. Option C is wrong because indexers do not selectively return only recent data due to performance; they return all data matching the search time range, and performance issues would not cause a consistent 15-minute window. Option D is wrong because the `timechart` command does not default to a 15-minute window; it uses the time range from the search or the time range picker, and its default span is based on the search duration, not a fixed 15 minutes.

Full explanation →

270

Multi-Selecteasy

Which TWO options are valid ways to add a visualization to a dashboard using Splunk Web? (Choose two.)

Select 2 answers

A.Upload a CSV file directly as a new panel

B.Clone an existing panel and modify its search

C.Add a new panel and select a search from the saved searches list

D.Paste a URL of an external chart

E.Drag a visualization from the search results page onto the dashboard

AnswersB, C

Cloning is a valid way to duplicate and customize panels.

Why this answer

Option B is correct because cloning an existing panel in Splunk Web allows you to duplicate a panel along with its search, then modify the search to create a new visualization without starting from scratch. This is a standard workflow for reusing dashboard configurations efficiently.

Exam trap

The trap here is that candidates may think dragging a visualization from search results onto a dashboard is possible (option E) because of a common misconception about drag-and-drop functionality, but Splunk Web requires explicit panel addition via the dashboard editor or saved searches.

Full explanation →

271

Multi-Selectmedium

Which TWO of the following are best practices for managing lookup files in Splunk?

Select 2 answers

A.Place lookup files in $SPLUNK_HOME/var/run to avoid permission issues.

B.Store the lookup file in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory.

C.Use global lookups to share across all apps.

D.Use Windows-style CRLF line endings for cross-platform compatibility.

E.Always include a header row in CSV lookups.

AnswersB, E

This is the standard location.

Why this answer

Options A and B are correct. Using headers is best practice. Placing in the lookups directory is required.

Option C is wrong because CRLF line endings cause issues. Option D is wrong because $SPLUNK_HOME/etc is not accessible by search peers if distributed. Option E is wrong because app-specific is preferred.

Full explanation →

272

MCQeasy

A user wants to add a trend indicator to a single value visualization showing whether the count increased or decreased compared to the previous period. Which feature should be used?

A.Comparison

B.Trendline

C.Color coding

D.Sparkline

AnswerA

The Comparison feature in Single Value shows the change and trend arrow relative to a previous time period.

Why this answer

The Comparison feature in a single value visualization allows you to show a trend indicator (e.g., an up or down arrow) that compares the current value to a previous time period, such as the previous week or month. This directly answers the user's need to see whether the count increased or decreased compared to the previous period. It is configured in the 'Single Value' visualization options under 'Comparison' settings.

Exam trap

The trap here is that candidates often confuse the sparkline (which shows a trend over time) with the comparison feature (which shows a specific increase/decrease arrow), but the question explicitly asks for a 'trend indicator' comparing to a previous period, which is exactly what the Comparison feature provides.

How to eliminate wrong answers

Option B (Trendline) is wrong because a trendline is used in line or area charts to show the general direction of data over time, not to compare a single value to a previous period. Option C (Color coding) is wrong because color coding changes the color of the visualization based on thresholds or ranges, but it does not provide a directional indicator (up/down arrow) comparing to a previous period. Option D (Sparkline) is wrong because a sparkline is a small inline chart that shows the trend of data over time within a single value visualization, but it does not explicitly show a comparison arrow or percentage change to a previous period.

Full explanation →

273

MCQhard

Refer to the exhibit. A security analyst runs this search to find top failed actions for admin accounts. The search returns no results, but there are failed actions for admin accounts in the data. What is the most likely cause?

A.The windows_security sourcetype does not contain a 'user' field.

B.The eval command uses match which is case-sensitive; the admin usernames may start with lowercase 'admin'.

C.The where clause should use 'search' instead.

D.The stats command should be before eval.

AnswerB

Correct. match is case-sensitive; use lower() or case-insensitive regex.

Why this answer

The where clause filters results after stats, but if the account_type eval does not match any user starting with 'Admin' (case-sensitive), then account_type will be 'user' for all, and the where condition fails. The match function is case-sensitive; users may start with 'admin' lowercase.

Full explanation →

274

MCQmedium

A user wants to see a visual representation of search results over time. Which tab should they use?

A.Visualizations

B.Patterns

C.Events

D.Statistics

AnswerA

Allows creating charts and graphs.

Why this answer

The Visualizations tab is the correct choice because it provides a graphical representation of search results, such as charts, graphs, and time-series plots, which are essential for visualizing trends over time. In Splunk, after running a search, the user can switch to the Visualizations tab to select from various chart types (e.g., line, column, area) that automatically map the _time field to the x-axis, enabling temporal analysis. This tab is specifically designed for transforming tabular search results into visual formats, making it the appropriate tool for seeing data over time.

Exam trap

The trap here is that candidates often confuse the Statistics tab (which shows aggregated data in a table) with the Visualizations tab, mistakenly thinking that numerical tables are sufficient for 'visual representation,' but Splunk specifically requires the Visualizations tab for graphical output like charts and graphs.

How to eliminate wrong answers

Option B (Patterns) is wrong because the Patterns tab is used for identifying common patterns or clusters in raw event data, not for visualizing search results over time; it focuses on structural similarities rather than temporal trends. Option C (Events) is wrong because the Events tab displays raw event data in a chronological list, which is not a visual representation but a text-based view of individual events. Option D (Statistics) is wrong because the Statistics tab shows aggregated numerical data in a table format, such as counts or sums, but does not provide graphical visualizations like charts or graphs for time-based analysis.

Full explanation →

275

MCQmedium

Refer to the exhibit. What is the primary purpose of this search?

A.Count all events

B.List all URIs with 404 errors

C.Identify top URI paths by 404 count

D.Count 404 errors by URI path

AnswerC

The descending sort reveals the highest counts first.

Why this answer

The search filters for 404 errors, counts them by URI path, then sorts descending to show the most frequent error paths at the top. This identifies top error URIs.

Full explanation →

276

MCQmedium

Refer to the exhibit. An analyst runs a search that uses this lookup. The lookup returns multiple matches for some events. Which of the following is true?

A.The default value 'UNKNOWN' is used when there is no match.

B.All matching rows are returned for each event.

C.The lookup file must be sorted.

D.Only the first 5 matching rows are returned.

AnswerD

max_matches=5 limits to 5 matches.

Why this answer

Option D is correct because, by default, Splunk's lookup command returns only the first matching row from the lookup table when multiple matches exist for a single event. This behavior is controlled by the `max_matches` parameter, which defaults to 1, but the question states that the first 5 matching rows are returned, indicating that the `max_matches` setting has been explicitly configured to 5. The lookup command does not automatically return all matches or require a sorted lookup file for this behavior.

Exam trap

The trap here is that candidates often assume Splunk returns all matching rows by default (Option B) or that the lookup file must be sorted (Option C), but the actual default behavior is to return only the first match unless `max_matches` is explicitly increased.

How to eliminate wrong answers

Option A is wrong because the default value 'UNKNOWN' is only used when a lookup field has no match at all, not when there are multiple matches; the `default` parameter in the lookup definition specifies the fallback value for non-matching events. Option B is wrong because Splunk does not return all matching rows by default; the `max_matches` setting limits the number of results, and without explicit configuration, only one match is returned. Option C is wrong because the lookup file does not need to be sorted for the lookup command to work; sorting is only required for certain lookup types like `lookup` with `output` or when using `inputlookup` with a sorted file for performance optimization, but it is not a general requirement for returning multiple matches.

Full explanation →

277

Multi-Selectmedium

Which three of the following are valid approaches for creating a dashboard in Splunk Web? (Choose three.)

Select 3 answers

.Convert an existing report into a dashboard panel.

.Create a new dashboard using the Dashboard Studio editor.

.Import a dashboard definition from a saved XML file.

.Generate a dashboard automatically from a search job's statistics tab.

.Clone a dashboard from the Settings > Knowledge menu.

.Use the REST API to create a dashboard from a CSV lookup file.

Why this answer

These three options are correct because Splunk Web provides direct, supported methods for creating dashboards. Converting an existing report into a dashboard panel is a standard workflow from the report's 'Edit' menu. The Dashboard Studio editor is the modern, built-in interface for creating dashboards from scratch.

Importing a dashboard definition from a saved XML file is supported via the 'Create New Dashboard' dialog, which allows you to upload a dashboard XML definition.

Exam trap

Splunk often tests the distinction between actions available in the UI versus those that require manual or programmatic steps; the trap here is that candidates might think the Statistics tab or Settings menu can create dashboards, but those features are not designed for that purpose.

Full explanation →

278

MCQhard

A large enterprise uses Splunk across 50 indexers and a search head cluster. An analyst reports that a search using a lookup file 'employees.csv' (500 MB, 10 million rows) is extremely slow. The search is: `index=winlogs sourcetype=Security EventCode=4624 | lookup employees.csv account AS User OUTPUT department, manager`. The lookup currently runs on each event, and the entire CSV is loaded into memory on the search head each time. There are about 5 million matching events per day. The company has a separate Identity Management system that updates employee data hourly. The analyst needs the lookup to be fast and up-to-date. Which solution should the Splunk admin implement?

A.Use a static CSV but compress it and use `lookup` command with `| makeresults` approach.

B.Convert the lookup to a KV store collection and use the lookup as a key-value store.

C.Increase the `max_mem_usage` setting for the lookup in limits.conf.

D.Add a time range early in the search to reduce events.

AnswerB

KV store can handle large datasets efficiently and supports incremental updates.

Why this answer

Option B is correct because converting the large, frequently updated CSV lookup to a KV store collection allows Splunk to index the data and perform key-value lookups efficiently without loading the entire file into memory on the search head. The KV store supports real-time updates from the Identity Management system via REST API, ensuring the lookup remains up-to-date while drastically improving search performance for 5 million daily events across 50 indexers.

Exam trap

The trap here is that candidates often assume increasing memory limits (Option C) or reducing data volume (Option D) will fix performance issues, but they overlook that a KV store is the only solution that both scales for large lookups and supports frequent updates without reloading the entire dataset.

How to eliminate wrong answers

Option A is wrong because compressing a static CSV and using `| makeresults` does not solve the fundamental issue of loading a 500 MB file into memory on the search head; it still requires decompression and full in-memory processing, and the data would not be updated hourly. Option C is wrong because increasing `max_mem_usage` in limits.conf only raises the memory threshold for loading the CSV, which may cause out-of-memory errors or performance degradation on the search head without addressing the scalability or update frequency. Option D is wrong because adding a time range early in the search reduces the event count but does not optimize the lookup itself; the lookup still loads the entire CSV into memory for each search, and the analyst needs the lookup to be fast and up-to-date, not just fewer events.

Full explanation →

279

Multi-Selecteasy

Which TWO of the following are best practices when designing data models in Splunk?

Select 2 answers

A.Use fixed field names across datasets to avoid confusion.

B.Use constraint definitions to limit datasets to relevant events.

C.Set acceleration for all data models regardless of usage.

D.Use the 'auto-extract' feature to generate fields dynamically.

E.Create a separate data model for each sourcetype.

AnswersA, B

Consistent field names help users and simplify queries.

Why this answer

Option A is correct because using fixed field names across datasets ensures consistency and predictability when searching and reporting across multiple data sources. This practice simplifies data model design, reduces the need for field aliasing, and prevents confusion when the same logical field (e.g., 'status') is named differently in different sourcetypes. Splunk's data model acceleration and pivot functionality rely on stable field names to function correctly.

Exam trap

Splunk often tests the misconception that 'more acceleration is always better' or that 'each sourcetype needs its own data model,' when in reality acceleration should be selective and data models are designed to unify multiple sourcetypes.

Full explanation →

280

MCQmedium

An analyst wants to count the number of failed login attempts from a specific user using an accelerated data model named 'Authentication'. The data model has a dataset 'Failed_Authentication'. Which SPL query should they use?

A.| tstats count from Authentication.Failed_Authentication where user="jsmith"

B.| search sourcetype=Authentication* user="jsmith" | stats count

C.| datamodel Authentication.Failed_Authentication search | stats count by user | where user="jsmith"

D.| tstats count from datamodel=Authentication.Failed_Authentication where user="jsmith"

AnswerD

Correct syntax for tstats with data model.

Why this answer

Option D is correct because `tstats` is the only command that can directly query an accelerated data model. It uses the `datamodel=` prefix to specify the data model and dataset, and the `where` clause filters for the specific user. This leverages the acceleration summary for fast results.

Exam trap

The trap here is that candidates often confuse `tstats` with `search` or `datamodel` commands, forgetting that `tstats` requires the `datamodel=` prefix to query accelerated data models, not just the dataset name alone.

How to eliminate wrong answers

Option A is wrong because `tstats` requires the `datamodel=` prefix when referencing a data model; without it, the syntax is invalid. Option B is wrong because it uses `search` with `sourcetype=Authentication*`, which bypasses the accelerated data model entirely and does not use `tstats` or `datamodel`; it also does not leverage acceleration. Option C is wrong because `datamodel` command is used to generate a search from a data model, but it does not use `tstats` and thus does not query the acceleration summary; additionally, the syntax is incorrect for counting failed authentications.

Full explanation →

281

MCQmedium

Refer to the exhibit. A user gets an error: 'Error in 'where' command: The field 'count' is not a numeric type.' What is the issue?

A.The syntax should be 'where count > "100"'

B.The 'count' field is a string type

C.The 'timechart' command creates multiple 'count' fields for each host, so 'count' is not a single numeric field

D.The 'where' command should be placed before 'timechart'

AnswerC

Correct: timechart by host creates separate count series for each host, and where can't handle that.

Why this answer

The 'timechart' command creates a 'count' field, but the 'where' command expects a numeric value. However, 'count' is numeric; the error often occurs if the field is renamed or if there is a typo. In this case, 'count' should work, but if the data has multiple hosts, 'timechart' might produce multiple series with names like 'count: host1'.

The 'where' command cannot operate on multivalued fields or non-numeric data.

Full explanation →

282

MCQhard

A company has 50 Splunk users in the default 'user' role. The Splunk administrator wants to allow a subset of 5 users to create custom alerts and reports, but not modify data inputs or indexes. The administrator creates a new role called 'analyst' and assigns the 'can_create_alerts' and 'can_create_reports' capabilities. However, when these 5 users log in, they cannot create alerts or reports and receive an error that they 'do not have permission to create alerts'. The administrator verifies that the role has both capabilities. Which of the following is the most likely cause and solution?

A.The 'analyst' role lacks the 'edit_search' capability. Add it to the role.

B.The administrator must grant the 'can_create_alerts' capability to the 'user' role.

C.The administrator must configure an alert action (e.g., email) before alerts can be created.

D.The users are still assigned to the 'user' role, which does not have the creation capabilities, and the roles are not cumulative unless inheritance is set. Remove users from 'user' role or make 'analyst' inherit from 'user'.

AnswerD

Users must have a role with the capabilities; if they have multiple roles, capabilities are union, but removal of default role may be needed.

Why this answer

Option B is correct because the role inheritance must be configured: the 'user' role must be inherited or the new role must be assigned instead. Option A wrong because the issue is not with other capabilities. Option C wrong because removing from default role is not necessary.

Option D wrong because the error is not about email.

Full explanation →

283

MCQmedium

Refer to the exhibit. What is the most likely cause of the error?

A.The KV Store is not running

B.The firewall is blocking port 8191

C.The search head is overloaded

D.The indexer is out of disk space

AnswerA

Connection refused means service down.

Why this answer

The error message in the exhibit indicates that the KV Store is not running. The KV Store is a Splunk component that stores knowledge objects (such as lookups, data models, and saved searches) in a MongoDB-based key-value store. When the KV Store is down, Splunk cannot access these objects, leading to the displayed error.

Restarting the KV Store or ensuring it is enabled in the server.conf file resolves the issue.

Exam trap

The trap here is that candidates may assume any port-related error is a firewall issue, but the explicit 'KV Store is not running' message points directly to the service status, not network connectivity.

How to eliminate wrong answers

Option B is wrong because the KV Store uses port 8191 by default, but the error message does not indicate a connection timeout or firewall block; it explicitly states the KV Store is not running. Option C is wrong because a search head overload would manifest as slow search performance or timeouts, not a specific KV Store error. Option D is wrong because an indexer running out of disk space would cause indexing failures or data loss, not a KV Store-specific error.

Full explanation →

284

MCQhard

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

A.eval status=coalesce(status, "unknown")

B.default status=unknown

C.fillnull value=unknown status

D.replace status with "unknown"

AnswerC

fillnull sets null fields to a specified value.

Why this answer

Option C is correct because the `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Exam trap

The trap here is that candidates often confuse `fillnull` with `eval coalesce`, but `coalesce` only handles null values within existing fields and cannot create a field that is completely absent from an event, whereas `fillnull` explicitly addresses missing fields.

How to eliminate wrong answers

Option A is wrong because `eval status=coalesce(status, "unknown")` only works if the 'status' field exists but is null; it does not create the field if it is entirely missing from an event, as `coalesce` evaluates existing fields. Option B is wrong because `default status=unknown` is not a valid Splunk command; there is no `default` command in Splunk's search language, and this syntax would cause an error. Option D is wrong because `replace status with "unknown"` is not a valid Splunk command; `replace` is used for substituting values within existing fields, not for setting defaults for missing fields.

Full explanation →

285

MCQhard

A large enterprise Splunk environment has a heavy forwarder sending 2 TB of log data per day. An operator builds a dashboard that displays a real-time chart of events per second across all data sources, using the search 'index=* | stats count by sourcetype' with a real-time window of last 10 minutes. The dashboard is extremely slow, often timing out. The operator suspects the search is too broad. Which optimization strategy should be implemented first?

A.Replace the real-time search with a base search that runs every 10 minutes

B.Implement a summary index that aggregates events per second by sourcetype every minute, and have the dashboard search the summary index

C.Change the real-time window to a 10-minute historical search and enable report acceleration

D.Create a data model for all sourcetypes and use acceleration on the data model

AnswerB

Summary indexing pre-computes aggregated data, drastically reducing search volume.

Why this answer

Option B is correct because a summary index pre-aggregates the events-per-second data by sourcetype at a regular interval (e.g., every minute), drastically reducing the data volume the dashboard must scan. Instead of processing 2 TB of raw logs in real time, the dashboard queries a small, precomputed table, eliminating the performance bottleneck caused by the heavy forwarder's high ingestion rate.

Exam trap

Splunk often tests the misconception that report acceleration or data model acceleration can solve real-time performance issues, but these features are designed for historical searches and pivot-based reporting, not for reducing the raw data volume in near-real-time dashboards.

How to eliminate wrong answers

Option A is wrong because replacing a real-time search with a base search that runs every 10 minutes still forces the search to scan all raw data (2 TB per day) each time it runs, which does not reduce the computational load and can still cause timeouts. Option C is wrong because enabling report acceleration on a 10-minute historical search still requires Splunk to scan the full raw data index for that window, and report acceleration is designed for longer-term historical searches, not for near-real-time dashboards with high-volume data. Option D is wrong because a data model with acceleration still requires the underlying raw data to be searched and summarized on the fly for real-time queries; data model acceleration is optimized for pivot-based reporting, not for real-time event-per-second calculations across all sourcetypes.

Full explanation →

286

MCQhard

A data model 'Network_Traffic' currently has a single root dataset 'Traffic'. The administrator wants to add a child dataset 'Firewall_Logs' that only contains events from sourcetype=firewall. The admin also wants 'Firewall_Logs' to inherit all fields from 'Traffic'. Which approach should they follow?

A.Create 'Firewall_Logs' as a separate root dataset and add a constraint: sourcetype=firewall.

B.Use the 'merge' function to combine the datasets.

C.Create 'Firewall_Logs' as a child of 'Traffic' and add a constraint: sourcetype=firewall.

D.Create 'Firewall_Logs' as a child of 'Traffic' and add a filter: sourcetype=firewall.

AnswerC

Child datasets inherit fields, and constraints filter events for acceleration.

Why this answer

Option C is correct because in Splunk data models, child datasets inherit all fields from their parent root dataset automatically. By creating 'Firewall_Logs' as a child of 'Traffic' and adding a constraint of `sourcetype=firewall`, the child dataset will only contain events matching that sourcetype while inheriting all field definitions from the parent 'Traffic' dataset. Constraints in data models filter events at search time, ensuring only relevant events appear in the child dataset.

Exam trap

Splunk often tests the distinction between constraints and filters in data models, where candidates mistakenly choose 'filter' (Option D) because they confuse search-time filtering with the data model's constraint mechanism that defines dataset membership.

How to eliminate wrong answers

Option A is wrong because creating 'Firewall_Logs' as a separate root dataset would not allow it to inherit fields from 'Traffic'; root datasets are independent and do not share field definitions. Option B is wrong because the 'merge' function is used to combine datasets in a search, not to define hierarchical relationships within a data model; it does not create a child-parent inheritance structure. Option D is wrong because data models use constraints (not filters) to define which events belong to a dataset; filters are applied at the search level, not as a dataset definition mechanism, and using a filter would not properly restrict the dataset's event set in the data model hierarchy.

Full explanation →

287

MCQmedium

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

A.| lookup employee_lookup employee_name FROM emp_id

B.| lookup employee_lookup emp_id OUTPUTNEW *

C.| lookup employee_lookup emp_id OUTPUT employee_name

D.| lookup employee_lookup emp_id OUTPUTNEW employee_name

AnswerD

OUTPUTNEW prevents overwriting existing employee_name field.

Why this answer

Option D is correct because the `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.

Exam trap

Splunk often tests the distinction between `OUTPUT` and `OUTPUTNEW` in lookup commands, and the trap here is that candidates may choose `OUTPUT` (option C) thinking it simply adds the field, without realizing it will overwrite any existing field with the same name.

How to eliminate wrong answers

Option A is wrong because the syntax `employee_name FROM emp_id` is invalid; the correct order is `lookup <lookup-table> <lookup-field> OUTPUT <output-field>`, and `FROM` is not a valid clause in the lookup command. Option B is wrong because `OUTPUTNEW *` would attempt to output all fields from the lookup table as new fields, but it would not specifically target the employee name and could introduce unnecessary or conflicting fields. Option C is wrong because `OUTPUT employee_name` would overwrite any existing `employee_name` field in the event, which is not the intended behavior; the admin wants to add the name only if it does not already exist.

Full explanation →

288

MCQeasy

Refer to the exhibit. An analyst runs the search and expects the `country`, `region`, and `city` fields to appear in the results, but they do not. What is the most likely reason?

A.The fields in the lookup must have different names than the output fields.

B.The clientip field in the events has a different data type than the lookup.

C.The lookup command should use OUTPUTNEW instead of OUTPUT.

D.The lookup file is not defined as a lookup in Splunk's lookups definitions.

AnswerD

Lookup files must be uploaded and defined in Settings > Lookups before they can be used.

Why this answer

Option D is correct because Splunk requires a lookup file to be explicitly defined in Settings > Lookups > Lookup definitions before it can be used in a search. Without this definition, the `lookup` command will not find the file, and no fields will be added to the results, even if the file exists on disk.

Exam trap

Splunk often tests the distinction between uploading a lookup file and defining it as a lookup, tricking candidates into thinking the file's mere presence is sufficient for the `lookup` command to work.

How to eliminate wrong answers

Option A is wrong because lookup field names and output field names can be the same; the `lookup` command maps input fields from events to lookup fields and outputs new fields, and there is no requirement for them to be different. Option B is wrong because data type mismatches (e.g., string vs integer) would cause the lookup to fail to match, but the question states the fields do not appear at all, not that they appear with incorrect values; a type mismatch would typically result in no matches, not missing output fields. Option C is wrong because `OUTPUT` overwrites existing fields, while `OUTPUTNEW` only adds fields if they don't already exist; neither would cause the fields to be absent if the lookup were properly defined and matched.

Full explanation →

289

MCQeasy

Refer to the exhibit. An administrator runs this command. What is the effect?

A.Imports the file into Splunk as a data input.

B.Creates a lookup definition named my_lookup using the file my_lookup.csv.

C.Creates a lookup definition and automatically populates it with the file contents.

D.Adds the file to the monitor directory.

AnswerB

Adds the lookup table definition.

Why this answer

The `| inputlookup my_lookup.csv` command in Splunk reads the contents of a CSV file and creates a lookup definition named `my_lookup` that can be used in searches. This is the standard behavior for importing a static CSV file as a lookup table, not for configuring a continuous data input or monitoring.

Exam trap

The trap here is that candidates confuse `inputlookup` with data input commands like `add data` or `monitor`, thinking it creates a continuous data source rather than a one-time lookup of a static file.

How to eliminate wrong answers

Option A is wrong because `inputlookup` does not import a file as a data input; data inputs are configured via `inputs.conf` or the Settings menu, not through search commands. Option C is wrong because `inputlookup` does not automatically populate a lookup definition with file contents; it only reads the file for use in the current search, and the lookup definition must already exist or be created separately. Option D is wrong because `inputlookup` does not add files to a monitor directory; monitoring is configured via file system inputs, not search commands.

Full explanation →

290

MCQhard

A Splunk administrator notices that a new user cannot see any data in the Search & Reporting app, even though the user has the 'user' role. What is the most likely cause?

A.The user has not been granted access to any indexes.

B.The user does not have the 'search' capability.

C.The user is limited to viewing only saved searches.

D.The user is not using the correct time range.

AnswerA

Index access must be explicitly assigned to roles.

Why this answer

The 'user' role in Splunk includes the 'search' capability by default, which allows users to run searches. However, even with the search capability, a user cannot see any data unless they have explicit read access to one or more indexes. Index-level access is controlled via roles, and the default 'user' role does not grant access to any indexes; it only provides the ability to search indexes that the user has been granted access to.

Therefore, the most likely cause is that the new user has not been assigned to a role that includes index access.

Exam trap

Splunk often tests the misconception that the 'search' capability alone is sufficient to view data, when in reality index-level permissions are a separate and mandatory requirement for data visibility.

How to eliminate wrong answers

Option B is wrong because the 'user' role inherently includes the 'search' capability, so the user already has permission to run searches. Option C is wrong because the 'user' role does not restrict users to only saved searches; users with the 'user' role can create and run ad-hoc searches unless explicitly restricted by a capability like 'list_saved_searches_only', which is not part of the default 'user' role. Option D is wrong because an incorrect time range would still return results if data exists in accessible indexes; it would simply show no events for that specific time window, not a complete absence of data.

Full explanation →

291

MCQhard

A search is slow and the user wants to check the performance metrics. Which part of the UI provides details like run duration, scan count, and result count?

A.Timeline

B.Job Inspector

C.Statistics tab

D.Search History

AnswerB

Job Inspector provides detailed execution stats.

Why this answer

Option C is correct because the Job Inspector shows detailed performance metrics. Option A is wrong because the Statistics tab shows aggregated data. Option B is wrong because the Timeline shows event distribution.

Option D is wrong because the Search History lists past queries, not performance.

Full explanation →

292

MCQeasy

Refer to the exhibit. What does this search do?

A.Counts all web events with status 500.

B.Counts all events in the data model named Web.

C.Displays raw events from Web data model.

D.Counts events from the Web data model where status is 500, grouped by uri_path.

AnswerD

The search filters and groups correctly.

Why this answer

The search uses `| datamodel Web search` to access the Web data model, then pipes the results into a `stats count by uri_path` command. The `where status=500` filter restricts events to those with a 500 status code. This counts events from the Web data model where status is 500, grouped by the uri_path field, making D correct.

Exam trap

Splunk often tests the distinction between searching raw events and using data models, where candidates mistakenly think `datamodel` returns raw events or counts all events without filters.

How to eliminate wrong answers

Option A is wrong because the search does not count all web events with status 500; it counts events specifically from the Web data model, not all web events in the index, and groups them by uri_path. Option B is wrong because the search does not count all events in the Web data model; it applies a `where status=500` filter and groups by uri_path. Option C is wrong because the search does not display raw events; the `stats count` command aggregates data and does not return raw event output.

Full explanation →

293

Multi-Selecteasy

Which TWO options are valid when adding a panel to a dashboard from an existing report? (Choose two.)

Select 2 answers

A.The panel can be added as a table, chart, or single value based on the report's results.

B.The panel can only be added to the same app where the report was created.

C.The report is added as a link to the dashboard.

D.The report's search string is used as the panel's search, but it can be modified after adding.

E.The report's scheduled run time is inherited by the dashboard.

AnswersA, D

When adding from a report, you select the visualization type.

Why this answer

Option A is correct because when you add a panel from an existing report to a dashboard, Splunk allows you to choose the visualization type (table, chart, or single value) based on the report's results. This flexibility lets you reuse the report's data while customizing how it is displayed on the dashboard.

Exam trap

The trap here is that candidates often confuse 'adding a panel from a report' with 'adding a report as a link' or assume the report's scheduling applies to the dashboard, when in fact the search is embedded and the panel's behavior is decoupled from the original report's schedule and app context.

Full explanation →

294

Multi-Selectmedium

Which THREE of the following are valid considerations when accelerating a data model? (Choose three.)

Select 3 answers

A.Constraints in the data model affect which events are summarized.

B.A data model must be fully defined before acceleration can be enabled.

C.Acceleration runs at index time to pre-calculate results.

D.Acceleration summaries consume additional disk space.

E.The acceleration summary range should match the most common time range queries.

AnswersA, D, E

Constraints filter events before summarization.

Why this answer

Option A is correct because constraints in a data model (such as `| where` or `| search` filters) limit the set of events that are included in the acceleration summary. Only events matching the constraint are summarized, which reduces the data volume and speeds up query performance. This is a key design consideration when defining data model acceleration.

Exam trap

Splunk often tests the misconception that acceleration is an index-time process, when in fact it is a search-time scheduled summary that consumes disk space and must be aligned with query time ranges to be effective.

Full explanation →

295

Multi-Selecteasy

Which THREE of the following are core interface components visible on the Splunk Web search page?

Select 3 answers

A.Results area (Events, Statistics, Visualization tabs)

B.Settings menu

C.App management interface

D.Search bar

E.Time range picker

AnswersA, D, E

The results area is core to displaying search output.

Why this answer

The Splunk Web search page is designed around the core search workflow: entering a query, specifying a time range, and reviewing results. The Results area (with Events, Statistics, and Visualization tabs) is where the output of the search is displayed, making it a fundamental interface component. The Search bar and Time range picker are equally essential, as they allow users to input search strings and constrain the time window for the search, respectively.

Exam trap

The trap here is that candidates confuse global navigation elements (like the Settings menu or App management interface) with the core search-specific components, which are only those directly involved in the search workflow on the search page.

Full explanation →

296

Multi-Selectmedium

Which THREE statements about data model normalization are correct?

Select 3 answers

A.Constraints are used to include only relevant events for a dataset.

B.Calculated fields can be used to map values from raw events to data model fields.

C.Each data model must have exactly one root dataset.

D.Data models cannot contain child datasets.

E.Normalization allows different sourcetypes to be used with a single data model.

AnswersA, B, E

Constraints filter events that match the dataset.

Why this answer

Option A is correct because constraints in a data model are used to filter events from the underlying dataset, ensuring that only relevant events are included in a specific dataset. For example, a constraint like `sourcetype=access_combined` restricts the dataset to web access logs, excluding unrelated events. This is a core mechanism for defining the scope of each dataset within the data model hierarchy.

Exam trap

Splunk often tests the misconception that data models must have a single root dataset, but in reality, multiple root datasets are allowed to model different data domains independently.

Full explanation →

297

MCQmedium

Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?

A.Use the `fillnull` command to add missing values.

B.Use the `search` command to filter threat_score>90.

C.Add a third condition: if(threat_score > 60 AND threat_score <=90, "medium", ...) inside the existing eval.

D.Change the eval to a case statement with multiple conditions.

AnswerD

case can handle multiple conditions cleanly.

Why this answer

Using a case statement allows multiple conditions clearly. A nested if would work but is less readable. fillnull adds missing values, but the issue is categorization not missing data. search would filter, not categorize.

Full explanation →

298

Multi-Selectmedium

Which TWO are best practices for creating data models in Splunk? (Choose two.)

Select 2 answers

A.Use data model acceleration to improve query performance on large datasets.

B.Base data models on indexed fields rather than search-time extracted fields.

C.Design data models based on the specific use cases and queries they will support.

D.Create many-to-many relationships between root events and child datasets.

E.Include all available fields to ensure maximum flexibility.

AnswersA, C

Acceleration pre-computes summaries for faster searches.

Why this answer

Option A is correct because data model acceleration pre-computes and stores aggregated data in the form of summaries (TSIDX files), which dramatically reduces query latency on large datasets by avoiding full scan of raw events. This is a best practice for optimizing performance when using data models in Splunk.

Exam trap

The trap here is that candidates often confuse indexed fields with search-time extracted fields, mistakenly believing that indexed fields are more efficient for data models, when in fact data models rely on search-time fields for flexibility and to avoid re-indexing.

Full explanation →

299

MCQhard

Refer to the exhibit. A user runs this search and the resulting timechart shows multiple lines, one for each host. The user wants to show only the top 3 hosts by total count. Which modification achieves this?

A.Add | top 3 host before timechart

B.Add | top 3 host after timechart

C.Add | where host in (select top 3) after timechart

D.Add | head 3 after timechart

AnswerA

This reduces data to top 3 hosts first.

Why this answer

Option A is correct because the `top 3 host` command, when placed before `timechart`, calculates the top 3 hosts by total count across the entire search timeframe, then passes only those three hosts to the `timechart` command. This ensures the timechart displays exactly three lines, one for each of the top hosts, based on their overall event count.

Exam trap

Splunk often tests the order of piped commands in Splunk, and the trap here is that candidates mistakenly think `top` or `head` can be applied after `timechart` to limit the number of lines, not realizing that `timechart` already creates a separate series for each distinct value of the split-by field, and post-commands like `head` only limit rows (time buckets), not series.

How to eliminate wrong answers

Option B is wrong because placing `top 3 host` after `timechart` would attempt to apply the `top` command to the timechart results, which are already aggregated into time-series data; this would not filter the original hosts before the timechart, so all hosts would still appear in the visualization. Option C is wrong because `where host in (select top 3)` is not valid SPL syntax; there is no subquery or `select` statement in Splunk's search language, and this would cause a parsing error. Option D is wrong because `head 3` after `timechart` would simply return the first three rows of the timechart results (likely the earliest three time buckets), not the top three hosts by count, and would not reduce the number of lines in the chart.

Full explanation →

300

Multi-Selectmedium

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Select 3 answers

.It can be used to create new fields based on existing field values and functions

.It can be used to rename fields in the search results

.It supports conditional logic using the `if` function

.It modifies the original raw data stored in the index

.It can combine string values using the `+` operator

.It can be used to calculate mathematical expressions like `eval x = y + 1`

Why this answer

The `eval` command in Splunk creates new fields by evaluating expressions based on existing field values and functions, making it a powerful tool for data transformation. It supports conditional logic via the `if` function, allowing dynamic field creation based on conditions. Additionally, `eval` can concatenate string values using the `+` operator, which is a common way to combine text fields.

Exam trap

Splunk often tests the distinction between commands that modify search results in memory versus those that alter indexed data, leading candidates to incorrectly believe `eval` changes raw data.

Full explanation →

Splunk Core Certified User SPLK-1002 (SPLK-1002) — Questions 226–300