Courseiva

Splunk Core Certified User SPLK-1002 (SPLK-1002) — Questions 376–450

510 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 7

Page 7
376
Multi-Selectmedium

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Select 2 answers
A.The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.
B.The `stats` command displays a list of individual events with their fields.
C.The `stats` command is used to create new fields using the `eval` function.
D.The `stats` command can only be used with numeric fields.
E.The `stats` command can be used with a `by` clause to group results, but the `by` fields must be present in the search results.
AnswersA, E

Correct. `stats` is designed for aggregate calculations.

Why this answer

Option A is correct because the `stats` command in Splunk is specifically designed to compute summary statistics like count, sum, avg, and distinct count over a set of events. It transforms raw event data into aggregated results, making it a core transforming command for reporting and analysis.

Exam trap

The trap here is that candidates often confuse the `stats` command with `eval` or `table`, thinking `stats` can create fields or display raw events, when in fact it only produces aggregated results and requires fields to exist for grouping.

Full explanation →
377
MCQhard

A medium-sized enterprise uses Splunk Enterprise with a single indexer and one search head. They have 50 universal forwarders sending data from web servers, application servers, and database logs. Recently, the indexer crashed during peak hours. The administrator restarted the indexer and it came back up. After analyzing the crash log, they found that the indexer ran out of memory. The indexer has 16 GB RAM and the default memory settings. The daily indexing volume is about 20 GB. The administrator is concerned about stability. They want to prevent future crashes without adding hardware. What should they do?

A.Reduce the number of forwarders sending data
B.Switch universal forwarders to heavy forwarders
C.Reduce the max memory for the indexer process in limits.conf
D.Increase the max memory for the indexer process in limits.conf
AnswerC

This reduces memory usage and prevents crashes.

Why this answer

Option C is correct because the indexer crashed due to running out of memory with 16 GB RAM and default settings. Reducing the max memory for the indexer process in limits.conf (specifically the maxMemMB parameter) limits the heap size used by Splunk, preventing out-of-memory (OOM) kills during peak indexing loads. This is a software-level tuning that avoids hardware upgrades by capping memory consumption to a safe level below the physical RAM.

Exam trap

The trap here is that candidates may think increasing memory allocation solves performance issues, but in a constrained environment with a single indexer, reducing memory prevents OOM crashes, while increasing it would worsen the problem.

How to eliminate wrong answers

Option A is wrong because reducing the number of forwarders would decrease data intake, but it is not a viable solution for a medium-sized enterprise that needs all data; it also does not address the root cause of memory exhaustion during peak hours. Option B is wrong because switching universal forwarders to heavy forwarders would increase resource consumption on the forwarders and potentially add more load to the indexer due to parsing overhead, worsening the memory issue. Option D is wrong because increasing the max memory for the indexer process would exacerbate the out-of-memory condition, likely causing more frequent crashes on a 16 GB system.

Full explanation →
378
MCQhard

A user selects 'Last 24 hours' from the time picker but their search returns events from only the last hour. What is the most likely cause?

A.The user's role restricts time ranges
B.The indexer is down, preventing older events from being retrieved
C.The timezone is misconfigured, shifting the time range
D.The search includes a constraint like `earliest=-1h`
AnswerD

This overrides the time picker and limits results.

Why this answer

If the search includes an explicit earliest or latest override, that takes precedence over the time picker. Other options would affect data availability or visibility.

Full explanation →
379
MCQmedium

A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?

A.Create a search-time field extraction that parses the dest_ip to derive owner and department
B.Increase the number of indexers to parallelize the lookup operations
C.Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches
D.Use the 'lookup' command with a KV Store lookup that is populated from the database in real time
AnswerC

Pre-loading the data into a faster lookup source (CSV or KV Store) eliminates real-time database queries and speeds up searches.

Why this answer

Option C is correct because exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.

Exam trap

The trap here is that candidates often assume real-time database connectivity (Option D) is always better for freshness, but they overlook the severe performance penalty of per-event database queries in high-volume environments.

How to eliminate wrong answers

Option A is wrong because search-time field extraction cannot derive owner and department from dest_ip without an external data source; it would require complex regex or pattern matching that is not feasible for arbitrary IP-to-asset mapping. Option B is wrong because increasing the number of indexers does not parallelize lookup operations; indexers handle indexing and search distribution, but the bottleneck here is the per-event dbquery call to the SQL database, which is not parallelized by adding indexers. Option D is wrong because using a KV Store lookup populated in real time from the database would still require a live connection and per-event queries, defeating the performance improvement; KV Store is designed for static or periodically refreshed data, not real-time database synchronization.

Full explanation →
380
MCQeasy

A new user wants to start a search in Splunk Web. Which is the first step they should take?

A.Click into the search bar and type a query.
B.Click on 'Add Data' to ingest logs.
C.Click on 'Settings' in the top menu bar.
D.Open the 'Reports' listing and select a saved search.
AnswerA

The search bar is where you enter search strings.

Why this answer

The correct answer is B because the search bar is the primary location to enter search queries. Option A is wrong because the settings menu is for configuration, not searching. Option C is wrong because the 'Add Data' button is for data ingestion.

Option D is wrong because reports are saved searches, not the starting point for a new search.

Full explanation →
381
MCQhard

The exhibit shows log output from a Splunk search head. What is the most likely performance issue indicated?

A.The 'error_count' search is inefficient, consuming high CPU for few results.
B.The 'login_failures' search is scanning too many events.
C.The search head is overloaded due to multiple simultaneous searches.
D.There are duplicate search job IDs (SIDs) conflicting.
AnswerA

80% CPU for 1000 events is excessive.

Why this answer

Option C is correct because the 'error_count' search scanned only 1000 events and returned 10 events, yet consumed 80% CPU, indicating it is inefficient. Option A is wrong because 'login_failures' scanned many events but consumed only 20% CPU, which is proportional. Option B is wrong because there is no indication of duplicate SIDs.

Option D is wrong because the search head is the same for both.

Full explanation →
382
MCQmedium

A Splunk administrator needs to create a field alias that renames the field 'src_ip' to 'source_ip' for events in the index 'network'. The administrator has created the field alias in the Field Aliases settings in the UI. However, when searching index=network, the new field 'source_ip' does not appear in the events. The search still shows 'src_ip'. What could be the reason?

A.Field aliases only work with lookups, not with standard fields
B.The field 'src_ip' is not extracted automatically; an explicit field extraction is required first
C.The alias should be created using the 'rename' command in the search, not via the UI
D.The field alias is configured for a specific sourcetype that does not match the events in the index
AnswerD

The alias must be applied to the correct sourcetype or to all sourcetypes.

Why this answer

Option D is correct because field aliases in Splunk are configured per sourcetype. If the alias is applied to a sourcetype that does not match the events in the 'network' index, the alias will not take effect, and the original field name 'src_ip' will continue to appear. The administrator must ensure the alias is assigned to the correct sourcetype(s) present in the index.

Exam trap

The trap here is that candidates assume field aliases apply globally to all events in an index, when in reality they are scoped to specific sourcetypes, and misconfiguring the sourcetype match is a frequent cause of the alias not appearing.

How to eliminate wrong answers

Option A is wrong because field aliases work on any extracted field, not just lookup fields; they rename fields regardless of how the field was created. Option B is wrong because 'src_ip' is already present in the events (as shown by the search), so it is already extracted; no explicit extraction is needed for an alias to work. Option C is wrong because the 'rename' command only renames fields for the duration of a single search, whereas a field alias created in the UI persists across all searches and is the correct method for permanent renaming.

Full explanation →
383
Multi-Selecthard

Which THREE of the following are capabilities of the rex command?

Select 3 answers
A.Perform case-insensitive extraction by default.
B.Extract fields using regex named groups.
C.Replace text using sed expressions.
D.Set a default value for a field.
E.Extract fields from a specific field using field parameter.
AnswersB, C, E

The primary use of rex.

Why this answer

Option B is correct because the `rex` command can extract fields using regex named groups, where the group name becomes the field name and the matched value becomes the field value. This is a core capability of `rex` for field extraction in Splunk.

Exam trap

Splunk often tests the distinction between `rex` and `sed` commands, where candidates confuse `rex`'s regex extraction with `sed`'s text replacement, or assume `rex` can set default values like `eval` does.

Full explanation →
384
MCQeasy

Which of the following is the default time range in a new Splunk search?

A.Last 24 hours
B.All time
C.Last 7 days
D.Real-time
AnswerB

Default time range.

Why this answer

When you open a new search in Splunk, the default time range is set to 'All time' (no time filter), meaning the search will scan all indexed data unless you explicitly specify a time range. This is because Splunk defaults to showing all available events to avoid inadvertently excluding data, and it is the user's responsibility to narrow the search scope.

Exam trap

Splunk often tests the misconception that Splunk defaults to a recent time range like 'Last 24 hours' to be helpful, but the actual default is 'All time' to ensure no data is missed without explicit user input.

How to eliminate wrong answers

Option A is wrong because 'Last 24 hours' is a common preset but not the default; it must be selected manually or via a saved search. Option C is wrong because 'Last 7 days' is another preset that is not the default; it is often used for longer-term analysis but requires explicit selection. Option D is wrong because 'Real-time' is a special search mode that continuously streams events, but it is not the default; the default is a historical search over all time.

Full explanation →
385
Multi-Selecthard

A Splunk administrator is configuring a lookup to enrich firewall logs with a static CSV file containing allowed IP ranges. Which TWO statements about lookup configuration are correct?

Select 2 answers
A.A KV Store lookup is required for static tables.
B.The lookup definition must include the fields to match on from the event data.
C.The CSV file can be uploaded through the Lookups menu in Settings.
D.The lookup is defined in macros.conf.
E.The CSV file must be placed in an absolute path on the search head.
AnswersB, C

Matching fields are required to relate the lookup table to events.

Why this answer

Option B is correct because a lookup definition must specify the fields from the event data that will be used to match against the lookup table. This is configured in the 'Lookup definition' settings where you define the input fields (event fields) and output fields (lookup fields). Without this match configuration, Splunk cannot correlate the event data with the CSV file contents.

Exam trap

The trap here is that candidates often confuse the purpose of KV Store lookups (dynamic, editable) with static CSV lookups, or mistakenly think lookups are defined in macros.conf instead of transforms.conf.

Full explanation →
386
MCQmedium

A user creates a CSV lookup file 'users.csv' with columns 'userid' and 'full_name'. A lookup definition is set up. The search `index=auth | lookup users.csv userid AS user OUTPUT full_name` returns no results for 'full_name' even though there are matching userids. What is the most likely cause?

A.The search returns no events for the userid field.
B.The lookup command should be placed before the index search.
C.The lookup name 'users.csv' should be the lookup definition name, not the filename.
D.The 'AS user' should be 'AS userid'.
AnswerC

The lookup command uses the definition name as configured in Splunk, typically without extension.

Why this answer

The `lookup` command in Splunk requires the lookup definition name, not the filename, when referencing a lookup table. Even though the CSV file is named 'users.csv', the lookup definition created in Settings > Lookups defines the logical name used in searches. Using the filename directly causes Splunk to fail to resolve the lookup, resulting in no 'full_name' values being returned.

Exam trap

Splunk often tests the distinction between the lookup filename and the lookup definition name, trapping candidates who assume the filename can be used directly in the `lookup` command.

How to eliminate wrong answers

Option A is wrong because the search returns events from index=auth, and matching userids exist; the issue is that the lookup itself fails to execute, not that events are missing. Option B is wrong because the lookup command can be placed anywhere in the search pipeline after the index search; order is not the cause of the missing field. Option D is wrong because 'AS user' renames the userid field to 'user' for matching, which is syntactically correct; the problem is the lookup name, not the field alias.

Full explanation →
387
MCQmedium

You are working as a Splunk consultant for a financial services firm. They have multiple data sources: application logs, database audit logs, and network firewall logs. The security team needs to correlate events across these sources to detect potential fraud. You decide to create a data model named 'Security_Events'. The data model will be used with tstats for real-time dashboards. The logs vary in volume: application logs are 200 GB/day, audit logs are 50 GB/day, and firewall logs are 100 GB/day. The firm wants to optimize performance and storage. The data model currently has one root event with no constraints and three child objects with constraints based on sourcetype. The admin is concerned about acceleration storage costs. Which of the following is the best approach to balance performance and storage?

A.Disable acceleration on all objects and rely on the base search for queries.
B.Enable acceleration only on the child objects that are used in the most critical dashboards, and leave others unaccelerated.
C.Enable acceleration on the root event only and disable acceleration on child objects.
D.Remove the child objects and merge all constraints into the root event.
AnswerB

Selective acceleration saves storage.

Why this answer

Option B is correct because enabling acceleration only on the child objects used in the most critical dashboards balances performance and storage. The tstats command can leverage accelerated child objects for fast queries, while unaccelerated objects avoid unnecessary storage overhead. Given the high volume of logs (350 GB/day total), selective acceleration minimizes storage costs while still providing real-time performance for key fraud detection dashboards.

Exam trap

The trap here is that candidates assume accelerating the root event is more efficient because it covers all data, but they miss that root acceleration without constraints still processes all events, wasting storage and not providing the targeted performance gains that child object acceleration offers.

How to eliminate wrong answers

Option A is wrong because disabling acceleration on all objects forces tstats to run against raw data, which is extremely slow for real-time dashboards and defeats the purpose of using a data model. Option C is wrong because accelerating only the root event with no constraints does not narrow the data scope; tstats would still scan all events in the root, missing the performance benefit of pre-aggregated child objects. Option D is wrong because merging all constraints into the root event removes the structural separation needed for tstats to efficiently query specific sourcetypes, and it would require reindexing or redesigning the data model, which is not a performance optimization.

Full explanation →
388
MCQhard

A visualization is showing unexpected spikes in a timechart. The data is aggregated by hour, but the spikes align with time zone changes. What is the likely cause?

A.The data contains events with different time zones
B.The timechart uses a gap threshold
C.The search uses _time instead of _indextime
D.The bin span is too small
AnswerA

Mixed time zones cause events to be bucketed into incorrect hours, creating spikes.

Why this answer

The unexpected spikes in the timechart are caused by events being timestamped with different time zones. When Splunk aggregates data by hour using `_time`, it converts all timestamps to the search head's local time zone. Events originally logged in different time zones (e.g., UTC vs.

EST) will be shifted into different hour buckets, creating artificial spikes at the boundaries of time zone changes (e.g., daylight saving time transitions). This is a classic time zone misalignment issue in time-series analysis.

Exam trap

The trap here is that candidates often assume spikes are caused by data volume or indexing delays, rather than recognizing that time zone misalignment in event timestamps can create artificial spikes in timecharts, especially during daylight saving time transitions.

How to eliminate wrong answers

Option B is wrong because a gap threshold controls how Splunk fills missing time buckets (e.g., connecting gaps with null values), not the cause of spikes aligned with time zone changes. Option C is wrong because using `_indextime` (the time the event was indexed) instead of `_time` (the event timestamp) would shift all events to the indexing time, which is typically in UTC and would not produce spikes aligned with time zone changes in the original event timestamps. Option D is wrong because a bin span that is too small would produce more granular data with potential noise, but it would not cause spikes specifically aligned with time zone changes; the spikes would be random or based on event volume, not time zone boundaries.

Full explanation →
389
MCQhard

A company has a data model for email logs that includes a calculated field named 'sentiment_score' derived from a lookup. The data model is accelerated, but some reports using |tstats with 'sentiment_score' are returning incorrect values. What is the most likely reason?

A.The data model constraint excludes the events that contain the lookup values.
B.The |tstats command does not support calculated fields in accelerated data models.
C.The calculated field is defined incorrectly in the data model editor.
D.The lookup used in the calculated field has been updated after the acceleration summary was built, causing a mismatch.
AnswerD

Acceleration snapshots cache calculated values at build time; changes to lookups after rebuild cause stale data.

Why this answer

Option D is correct because when a data model is accelerated, it pre-computes and stores a summary of the data at the time of acceleration. If the lookup used in a calculated field (like 'sentiment_score') is updated after the acceleration summary is built, the |tstats command will query the stale summary, not the current lookup values. This mismatch causes incorrect results, as |tstats does not re-evaluate lookups against the live lookup table for accelerated data models.

Exam trap

The trap here is that candidates assume |tstats always queries live data, but they forget that accelerated data models serve pre-computed summaries, so any dynamic component like a lookup must be re-evaluated by rebuilding the acceleration.

How to eliminate wrong answers

Option A is wrong because a data model constraint filters events before acceleration; if it excluded events with lookup values, those events would not appear in the summary at all, not cause incorrect values. Option B is wrong because |tstats does support calculated fields in accelerated data models, as long as the calculated field is defined in the data model and the acceleration is up-to-date. Option C is wrong because if the calculated field were defined incorrectly, it would consistently produce wrong values, not become incorrect only after a lookup update.

Full explanation →
390
Multi-Selecteasy

Which TWO of the following are valid ways to create a data model in Splunk?

Select 2 answers
A.Run the | makeresults command and pipe to | datamodel.
B.From the Settings menu, select Data Models, then click New.
C.Import a CSV file from a lookup and convert it to a data model.
D.Use the mksplunk command in the CLI.
E.Right-click on an existing data model and select Clone, then edit the clone.
AnswersB, E

Standard UI method.

Why this answer

Option B is correct because Splunk provides a dedicated UI path to create data models: from the Settings menu, select Data Models, then click New. This is the standard method for defining a new data model, allowing you to specify constraints, field definitions, and object hierarchies without using any command-line or search-based approach.

Exam trap

The trap here is that candidates may confuse the ability to generate sample data with the ability to create a data model, or assume that a CLI command exists for data model creation, when in fact only the UI and cloning (or REST API) are valid methods.

Full explanation →
391
MCQmedium

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

A.The lookup field name is different from the event field name
B.The lookup is defined with the wrong field order
C.The time range of the search is too narrow
D.The lookup is case-sensitive and the key values have different cases
AnswerD

Lookups are case-sensitive by default.

Why this answer

Option D is correct because lookups in Splunk are case-sensitive by default. If the lookup file contains key values in a different case (e.g., 'ABC') than the event field values (e.g., 'abc'), the lookup will not match, even though the underlying data is logically equivalent. This is a common cause of lookup failures when the data sources have inconsistent casing.

Exam trap

The trap here is that candidates often assume lookups are case-insensitive by default, similar to SQL JOINs, and overlook Splunk's case-sensitive string matching behavior, leading them to incorrectly choose options like field name mismatch or time range issues.

How to eliminate wrong answers

Option A is wrong because if the lookup field name differs from the event field name, the admin would typically see no results at all, not just for some events; the lookup definition explicitly maps fields, so a mismatch would be a configuration error, not a partial failure. Option B is wrong because field order in a lookup definition only matters for output fields or when using automatic lookup with multiple fields; it does not affect whether matching keys return results—the lookup still matches on the specified key fields regardless of order. Option C is wrong because the time range of a search does not affect lookup matching; lookups are static file-based or KV-store-based and do not depend on time, so a narrow time range would simply return fewer events, not cause lookup failures for events that do exist.

Full explanation →
392
MCQhard

Refer to the exhibit. A user scheduled a report but it never runs. Which of the following is the most likely reason?

A.The report needs to be shared with the scheduler role.
B.The stats command requires a by clause with a time field.
C.The search string is missing the 'timechart' command.
D.The cron schedule is invalid because it lacks the weekday field.
AnswerD

The cron schedule must have five fields; the provided expression only has four, making it invalid.

Why this answer

The cron schedule is invalid because it only has four fields (minute, hour, day of month, month) and is missing the weekday field. Splunk requires five fields for a cron expression. Options A, B, and C are incorrect for the stated reasons.

Full explanation →
393
MCQhard

An organization has a large dataset and wants to create a daily report of top 10 error messages. The search takes a long time to run. Which optimization approach reduces run time while maintaining accuracy?

A.Use | rare instead of | top
B.Use | head 10 early in the search
C.Increase the time range
D.Use summary indexing to pre-aggregate
AnswerD

Summary indexing captures aggregated results and speeds up subsequent searches.

Why this answer

Summary indexing pre-aggregates data at search time and stores the results in a summary index. The daily report can then run against this pre-computed summary rather than scanning the entire raw dataset, drastically reducing run time while preserving accuracy because the aggregation is done once.

Exam trap

Splunk often tests the misconception that simply limiting results early (like `| head`) is a valid optimization, but candidates must understand that accuracy requires aggregation before truncation, and that summary indexing is the proper method for pre-computing results without data loss.

How to eliminate wrong answers

Option A is wrong because `| rare` finds the least common values, which is the opposite of the required top 10 error messages and would not reduce search time. Option B is wrong because `| head 10` early in the search truncates the result set before aggregation, which would produce inaccurate results (only the first 10 events, not the top 10 by count). Option C is wrong because increasing the time range expands the data to be scanned, making the search run longer, not shorter.

Full explanation →
394
Multi-Selectmedium

Which THREE elements are required to create a dashboard in Splunk Web? (Choose three.)

Select 3 answers
A.A time range picker
B.At least one panel
C.A title for the dashboard
D.Permissions set to viewable by at least one role
E.A scheduled report in at least one panel
AnswersB, C, D

A dashboard without panels is empty and invalid.

Why this answer

Option B is correct because a dashboard in Splunk Web must contain at least one panel to display data. Panels are the fundamental building blocks of a dashboard; without them, there is no content to visualize. A dashboard with zero panels is invalid and cannot be saved or rendered.

Exam trap

The trap here is that candidates often confuse optional features (like a time range picker or scheduled reports) with mandatory elements, leading them to select A or E instead of recognizing that only a panel, a title, and at least one role permission are strictly required.

Full explanation →
395
MCQeasy

To create a real-time dashboard panel showing errors in the last 30 minutes, which time range setting should be used?

A.Real-time
B.Last 30 minutes
C.Real-time (30 minutes)
D.All time
AnswerC

This sets a real-time window of 30 minutes.

Why this answer

Option C is correct because a real-time dashboard panel that shows errors in the last 30 minutes requires a 'Real-time' time range with a specific window of 30 minutes. In Splunk, the 'Real-time (30 minutes)' setting continuously updates the panel to show events from the current time back 30 minutes, which is exactly what is needed for monitoring recent errors as they occur.

Exam trap

The trap here is that candidates often confuse 'Last 30 minutes' (a static historical search) with 'Real-time (30 minutes)' (a continuously updating real-time search), leading them to select Option B instead of the correct real-time window setting.

How to eliminate wrong answers

Option A is wrong because 'Real-time' without a window (e.g., 'Real-time (30 seconds)') defaults to a very short rolling window (typically 10 seconds or 30 seconds), which would not cover the last 30 minutes of data. Option B is wrong because 'Last 30 minutes' is a historical time range that does not update in real-time; it shows a static snapshot of the past 30 minutes from the time the search was run, not a continuously updating view. Option D is wrong because 'All time' searches the entire indexed data, which is not limited to the last 30 minutes and does not provide real-time updates.

Full explanation →
396
MCQhard

A user wants to create a report that shows the average response time for each web endpoint over the past week. The data has fields: endpoint, response_time. Which search correctly calculates the average?

A.... | stats avg(response_time) by endpoint
B.... | stats mean(response_time) by endpoint
C.... | stats avg(response_time) by _time
D.... | eval avg=sum(response_time)/count | stats values(avg) by endpoint
AnswerA

Correctly calculates average per endpoint.

Why this answer

Option A is correct because the `stats avg(response_time) by endpoint` command calculates the average (mean) of the response_time field for each unique endpoint value. This directly meets the requirement of showing average response time per web endpoint over the past week, assuming the time range is set in the search bar or via an earliest/latest constraint.

Exam trap

Splunk often tests the distinction between `avg()` and `mean()` — `mean()` is not a valid SPL command, but candidates may confuse it with the statistical term or with SQL syntax, leading them to select Option B.

How to eliminate wrong answers

Option B is wrong because `mean()` is not a valid SPL function; the correct function for average is `avg()`. Option C is wrong because `by _time` groups results by the timestamp field, not by endpoint, which would produce average response times per time bucket rather than per endpoint. Option D is wrong because it manually calculates an average using `eval avg=sum(response_time)/count` and then uses `stats values(avg) by endpoint`, which is redundant and incorrect — `values()` returns a multivalue list of all computed averages per endpoint rather than a single aggregated average, and the manual calculation is unnecessary when `avg()` exists.

Full explanation →
397
MCQmedium

An organization wants to build a data model that includes data from multiple sourcetypes. Which best practice should they follow regarding field definitions?

A.Define separate fields for each sourcetype with unique names.
B.Leave fields as 'unknown' and let the search head infer types.
C.Normalize fields to have the same name and type across sourcetypes.
D.Use automatic field extraction for each sourcetype at index time.
AnswerC

Normalization allows the data model to work uniformly across data sources.

Why this answer

Option C is correct because data models in Splunk are designed to normalize data from multiple sourcetypes into a common schema. By defining fields with the same name and type across sourcetypes, you enable consistent reporting, pivot analysis, and data model acceleration. This best practice ensures that field values are comparable and aggregations work correctly regardless of the source.

Exam trap

The trap here is that candidates often confuse data model field normalization with index-time field extraction or think that unique field names per sourcetype are acceptable, not realizing that data models require a consistent schema for pivot and report acceleration to function correctly.

How to eliminate wrong answers

Option A is wrong because defining separate fields for each sourcetype with unique names defeats the purpose of a data model, which is to provide a unified view; it would require complex field aliasing and break pivot compatibility. Option B is wrong because leaving fields as 'unknown' prevents the data model from properly typing and indexing fields, leading to incorrect search results and inability to use the data model for accelerated reporting. Option D is wrong because automatic field extraction at index time is not a best practice for data models; index-time extraction is inflexible, consumes resources, and is generally discouraged in favor of search-time field extraction for data model definitions.

Full explanation →
398
MCQhard

A search includes a lookup that returns multiple matches for a single event. The analyst wants to keep only the first match. Which lookup command option should they use?

A.update=t
B.local=t
C.max_matches=1
D.append=t
AnswerC

max_matches=1 limits the lookup to return only the first matching row.

Why this answer

Option B is correct because the max_matches option controls how many results to keep; setting it to 1 keeps the first match. Option A is wrong because local is for time-based lookup. Option C is wrong because append is for adding fields from external.

Option D is wrong because update is for outputlookup.

Full explanation →
399
Multi-Selectmedium

An analyst needs to create a lookup file. Which TWO methods can be used?

Select 2 answers
A.Use inputlookup command.
B.Use rex to parse and then outputcsv.
C.Upload a CSV file via the Lookups UI.
D.Use eval to create a table and then export.
E.Use outputlookup command.
AnswersC, E

Direct upload via UI creates a lookup definition.

Why this answer

Option C is correct because the Lookups UI in Splunk Web provides a direct method to upload a CSV file and create a lookup table file (static lookup) without needing to write any commands. Option E is correct because the `outputlookup` command writes the results of a search directly into a lookup file, creating or appending to a lookup definition. Both are standard methods for creating lookup files in Splunk.

Exam trap

Splunk often tests the distinction between commands that create lookup files (`outputlookup`) versus commands that only export data as CSV (`outputcsv`), trapping candidates who assume any CSV export creates a usable lookup.

Full explanation →
400
MCQeasy

A support technician is troubleshooting a user who cannot see the 'Field sidebar' and 'Timeline' in the Search & Reporting app. The user says that when they run a search, they only see the results in a table format, but no side panels or timeline below the search bar. The technician checks the user's settings and finds that the user's default app is set to 'Search & Reporting'. The technician then looks at the user's browser and notices that the user has a very small browser window. What is the most likely cause of the missing panels?

A.The user's default app is set incorrectly.
B.The user has disabled the timeline in their preferences.
C.The browser window is too small, causing panels to be hidden by the responsive interface.
D.The user's role does not have permission to view the timeline.
AnswerC

Correct: Small windows hide side panels in Splunk Web.

Why this answer

Option D is correct because Splunk Web responsive design may hide side panels if the browser window is too small; the technician observed the small window. Option A is incorrect because the default app is correct. Option B is incorrect because there is no such setting as 'show timeline' in user preferences.

Option C is incorrect because the role does not affect the presence of these UI elements; they are universal.

Full explanation →
401
MCQmedium

A team wants to add an interactive time range picker to a dashboard. The dashboard uses a base search with a token for earliest and latest. Which configuration is required?

A.Set the search's earliest and latest to -1h and now
B.Use the built-in time range picker by adding <option> elements
C.Add input type='dropdown' token='time' and use $time$ in the search
D.Add input type='time' token='time_tok' and use $time_tok$ in the search
AnswerD

This correctly creates a time range picker and links it to the search via token.

Why this answer

Option D is correct because the `input type='time'` element is the standard way to add an interactive time range picker in Splunk dashboards. By setting the `token` attribute to `time_tok` and referencing `$time_tok$` in the base search, the dashboard dynamically passes the selected time range to the search, overriding any static earliest/latest values.

Exam trap

Splunk often tests the distinction between `input type='time'` (the correct element for a time range picker) and `input type='dropdown'` (which only provides a static list of options), leading candidates to mistakenly choose a dropdown with a time token.

How to eliminate wrong answers

Option A is wrong because setting the search's earliest and latest to static values like -1h and now would hardcode the time range, preventing the interactive time picker from having any effect. Option B is wrong because the built-in time range picker is not added via `<option>` elements; `<option>` elements are used for dropdown or radio inputs, not for the time input type. Option C is wrong because `input type='dropdown'` creates a simple dropdown menu, not a time range picker; the `$time$` token is not a standard token for time ranges, and the correct input type for time selection is `time`.

Full explanation →
402
MCQhard

A Splunk administrator is troubleshooting a slow search on firewall logs. The index is 'firewall', sourcetype is 'cisco:asa', and there is about 500 GB of data per day. The search is: index=firewall sourcetype=cisco:asa action=block | stats count by src_ip | where count > 1000. This search takes over 5 minutes to return results. The administrator needs the same results faster. The index has a data model named 'firewall_dm' that is accelerated with a summary range of 7 days. Which change to the search will improve performance the most while still returning the same results?

A.Add | stats count by src_ip, _time to the search
B.Change to | tstats count from datamodel=firewall_dm where action=block by src_ip | where count > 1000
C.Add | fields src_ip before the stats command
D.| search action=block instead of placing action=block in the base search
AnswerB

tstats uses the accelerated data model, drastically reducing the amount of data scanned.

Why this answer

Option B is correct because it uses `tstats` against an accelerated data model, which pre-aggregates data in the summary range (7 days). This avoids scanning raw 500 GB/day of firewall logs, drastically reducing I/O and CPU. The `where` clause in `tstats` filters on the `action` field directly from the accelerated index, returning the same results much faster.

Exam trap

The trap here is that candidates think `fields` or moving the filter to `| search` reduces data volume, but only `tstats` with an accelerated data model avoids scanning raw events entirely.

How to eliminate wrong answers

Option A is wrong because adding `_time` to the `stats` command increases cardinality (more groups), making the search slower, not faster. Option C is wrong because `fields` only reduces output fields, not the volume of data scanned; the bottleneck is raw data retrieval, not field projection. Option D is wrong because moving `action=block` to a `| search` command after the base search still requires scanning all raw events for `index=firewall sourcetype=cisco:asa`, offering no performance gain over the original filter.

Full explanation →
403
Multi-Selecthard

Which THREE of the following are valid reasons to use data models instead of raw searches?

Select 3 answers
A.To provide real-time indexing of data.
B.To improve query performance through acceleration.
C.To enforce role-based access control on specific fields.
D.To abstract the underlying data structure for end users.
E.To allow users to search across multiple data sources using consistent field names.
AnswersB, D, E

Accelerated data models speed up searches.

Why this answer

Option B is correct because data model acceleration pre-computes and stores summarized data in the form of a tsidx file, which significantly reduces the time needed to run searches against large datasets. This acceleration is enabled by creating a data model and then running a summary search that populates the acceleration index, allowing subsequent searches to use the pre-aggregated data rather than scanning raw events.

Exam trap

Splunk often tests the misconception that data models are used for real-time indexing or access control, when in fact they are strictly for data abstraction and search performance optimization through acceleration.

Full explanation →
404
MCQmedium

A security team wants to create a data model to analyze authentication events from multiple sources (Windows Event Log, Linux syslog, and VPN logs). The data model should normalize the fields for user, source IP, and action (success/failure). Which Splunk best practice should be applied when designing this data model?

A.Use event types to categorize authentication events and then create a data model based on event types.
B.Create separate data models for each data source to avoid field conflicts.
C.Define a single data model that maps fields to the Common Information Model (CIM).
D.Create field aliases in props.conf for each source to rename fields to a common name, then use a simple data model.
AnswerC

Using CIM field mapping allows normalization and correlation across different sources.

Why this answer

Option C is correct because the Common Information Model (CIM) provides a standardized, normalized schema for security events. By mapping fields like user, src_ip, and action to CIM field names, the data model ensures consistent searching and correlation across heterogeneous sources (Windows Event Log, Linux syslog, VPN logs) without per-source customizations. This approach leverages Splunk's built-in CIM add-on to accelerate data model design and maintain interoperability with security analytics apps.

Exam trap

The trap here is that candidates confuse field aliasing (a simple rename) with the comprehensive normalization and acceleration provided by the CIM data model, leading them to choose option D as a 'simpler' solution that actually lacks the structured schema and cross-source correlation capabilities required for enterprise security analytics.

How to eliminate wrong answers

Option A is wrong because event types are a legacy method for categorizing events based on search-time field values; they do not normalize fields or provide the structured, field-mapping framework required for a data model. Option B is wrong because creating separate data models for each source defeats the purpose of normalization, leading to fragmented searches and inability to correlate authentication events across sources in a single pivot or report. Option D is wrong because field aliases in props.conf only rename fields at search time and do not create a reusable, structured data model; a data model built on aliases still requires manual field mapping and lacks the CIM's standardized hierarchy and acceleration benefits.

Full explanation →
405
Matchingmedium

Match each Splunk search command to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Compute statistics on search results

Evaluate expression and create new fields

Extract fields using regular expressions

Group related events into transactions

Create time-based chart of statistics

Why these pairings

These are common transforming commands in Splunk.

Full explanation →
406
MCQmedium

A company has a distributed Splunk environment with a single search head and 4 indexers. The data volume is approximately 50 GB per day across various sourcetypes. Users frequently run searches that span 'All time' (from the time picker), and these searches are taking significantly longer than expected. The search head shows high CPU usage during these searches, while indexers are moderately loaded. The administrator has verified that all indexers are healthy and that there are no network bottlenecks. The data is raw log data with minimal field extractions. Which course of action will most effectively improve search performance for these 'All time' searches?

A.Upgrade the search head to a larger instance with more CPU cores and memory.
B.Increase the number of indexers to 8 to distribute the search load more evenly.
C.Enable summary indexing and use the tstats command for searches over large time ranges.
D.Reduce the data retention period on the indexers from 90 days to 30 days.
AnswerC

Summary indexing pre-calculates statistics (e.g., counts, sums) and stores them in tsidx files, allowing tstats to retrieve results quickly without scanning raw data. This greatly reduces search head CPU and query time.

Why this answer

Summary indexing with tstats allows pre-aggregating data over time, drastically reducing the amount of data scanned for historical searches. This addresses the root cause of scanning large volumes of raw data. Other options either do not directly address the performance issue or would have negative side effects.

Full explanation →
407
Multi-Selectmedium

Which TWO statements are true about saved reports in Splunk?

Select 2 answers
A.All saved reports automatically send email alerts.
B.Saved reports are created exclusively from dashboard panels.
C.Saved reports can be used as data sources for dashboard panels.
D.Saved reports can be scheduled to run at specific times.
E.Saved reports cannot be edited after creation.
AnswersC, D

Correct.

Why this answer

Option C is correct because saved reports in Splunk can be used as data sources for dashboard panels. When you create a dashboard panel, you can select a saved report as its data source, which allows the panel to display the report's results. This enables reuse of report logic across multiple dashboards without rewriting the search.

Exam trap

The trap here is that candidates often confuse saved reports with alerts, assuming all saved reports have email actions enabled by default, or they think reports are only for dashboards, when in fact reports are standalone search artifacts that can be scheduled, shared, and used as data sources.

Full explanation →
408
MCQmedium

A security analyst needs to enrich firewall logs with user identity information stored in a CSV file. The CSV file contains fields: user_id, username, department, location. The firewall logs contain a field 'src_user_id'. Which Splunk feature should be used to add the username and department fields to the firewall events based on matching src_user_id to user_id?

A.Create a field alias that maps src_user_id to username and department
B.Define a lookup table from the CSV file and use the input lookup command or automatic lookup to add username and department
C.Use the eval command with an if statement to populate username and department from src_user_id
D.Create a calculated field that computes username and department based on src_user_id
AnswerB

Lookups are designed to enrich events with data from external sources like CSV files based on matching field values.

Why this answer

Option B is correct because a lookup table defined from the CSV file allows Splunk to map the 'src_user_id' field in firewall events to the 'user_id' field in the CSV, then add the 'username' and 'department' fields from the lookup. This is the standard method for enriching events with external data using the 'inputlookup' command or an automatic lookup configuration.

Exam trap

The trap here is confusing field aliases or calculated fields with lookups, leading candidates to choose options that cannot perform external data enrichment based on a key match.

How to eliminate wrong answers

Option A is wrong because a field alias only creates an alternate name for an existing field; it cannot add new fields or map values from an external source. Option C is wrong because the 'eval' command with an 'if' statement would require hardcoding every possible user_id-to-username/department mapping, which is impractical for large datasets and not designed for CSV-based enrichment. Option D is wrong because calculated fields are derived from existing event fields using eval expressions, not from external lookup files, and cannot perform key-based matching against a separate data source.

Full explanation →
409
MCQmedium

A user is trying to create a dashboard in Splunk Web by saving a search as a dashboard panel. The user runs a search that produces a table of results. The user clicks 'Save As' and selects 'Dashboard Panel'. The user then selects an existing dashboard and clicks 'Save'. However, the panel does not appear on the dashboard. The user has confirmed that the dashboard exists and that they have write permission to it. The user also sees no error messages. What is the most likely cause of this issue?

A.The dashboard is locked by another user.
B.The user does not have permission to add panels to the dashboard.
C.The search does not produce statistical data required for a dashboard table panel.
D.The panel was saved but is hidden due to time range settings.
AnswerC

Correct: Only transforming searches can be saved as panels.

Why this answer

Option D is correct because when saving a panel, you can save to a new or existing dashboard, but if the dashboard already has a panel with the same title, the save might fail silently or overwrite? Actually, the most common issue is that the user did not select the correct dashboard or the panel was saved but not visible due to layout. However, a plausible cause is that the search results were not formatted as a proper data table for a dashboard panel. Option A is incorrect because the user has permission.

Option B is incorrect because the dashboard exists. Option C is incorrect because no error was shown. Option D is correct: the search must be a transforming search that produces statistical data to create a table panel; a non-transforming search may not be saved as a table panel.

Full explanation →
410
MCQmedium

Refer to the exhibit. A Splunk user runs this search against a lookup file containing application error data. The search returns fewer than 10 results. Which is the most likely reason?

A.The inputlookup command only returns the first 10 rows by default.
B.The lookup file contains more than 10 rows.
C.The search filter 'severity="high"' is too restrictive, resulting in fewer than 10 matching rows.
D.The table command limits the number of results.
AnswerC

Correct. The filter limits results, so head returns all matches.

Why this answer

The search filters for severity='high', which may be a small subset. The head command limits to 10, but if fewer than 10 match, that's all that's returned.

Full explanation →
411
MCQmedium

A Splunk user needs to perform a lookup that matches events based on a field 'userid' to a lookup table that contains 'userid', 'full_name', and 'email'. The lookup table is a CSV file named 'users.csv' located in the default lookup directory. The user runs the search: index=main | lookup users.csv userid OUTPUT full_name, email. However, the search returns an error that the lookup table 'users.csv' was not found. What is the most likely reason for this error?

A.The CSV file must have a .csv extension, but the command should omit the extension
B.The fields 'full_name' and 'email' are not present in the CSV file
C.The CSV file is not in the correct format; it should have a header row
D.The lookup command must reference the lookup definition name, not the CSV file name directly
AnswerD

Splunk requires a lookup definition to be created that points to the CSV file; then you use the definition name in the lookup command.

Why this answer

The `lookup` command in Splunk requires a lookup definition name, not the raw CSV filename. The lookup definition is created in Splunk's configuration (e.g., transforms.conf) and maps a logical name to the actual CSV file. Using the filename directly bypasses this definition, causing Splunk to report the file as not found because it searches for a definition, not the file path.

Exam trap

The trap here is that candidates assume the `lookup` command can directly use a CSV filename, confusing it with the `inputlookup` command which does accept filenames, while `lookup` strictly requires a definition name.

How to eliminate wrong answers

Option A is wrong because the `lookup` command does not require omitting the extension; the issue is that the command expects a definition name, not a filename. Option B is wrong because the error message explicitly states the table was not found, not that fields are missing; field presence is irrelevant to this error. Option C is wrong because the CSV format (header row) is not the cause; Splunk can parse CSV files with headers, but the error occurs before any parsing, as the lookup definition is missing.

Full explanation →
412
Multi-Selectmedium

Which TWO of the following are valid ways to create a field alias in Splunk?

Select 2 answers
A.Use the INDEXED_EXTRACTIONS setting with an alias directive
B.Define FIELDALIAS-<class> in props.conf
C.Use eval to assign a field to another field name
D.Use the rename command in a saved search
E.Use the aliases command in a search
AnswersA, B

Some indexed extractions allow aliasing.

Why this answer

Option A is correct because the INDEXED_EXTRACTIONS setting in props.conf can include an alias directive (e.g., `alias::<field>=<alias>`) to define field aliases directly at index time. This allows you to map an extracted field to an alternative name without modifying the raw data or using search-time operations.

Exam trap

Splunk often tests the distinction between transient search-time operations (like `eval` or `rename`) and persistent configuration-based aliases (props.conf), leading candidates to mistakenly think that a search command can create a permanent field alias.

Full explanation →
413
MCQeasy

A user creates a dashboard with a line chart showing server response times. The chart looks correct in the dashboard editor but when saved and viewed by other users, the chart shows no data. The other users have the same role as the creator. What is the most likely cause?

A.The time range is set to 'Real-time' while the other users access at a different time
B.The other users do not have permission to the index
C.The search includes a field that is only visible to the creator
D.The dashboard is set to private
AnswerA

Real-time search shows data only within a small sliding window; if no events at that moment, chart is empty.

Why this answer

Option A is correct because when a dashboard chart uses a 'Real-time' time range, it continuously updates to show data from the current moment. If the creator views the dashboard at one time, the chart displays data, but when other users access it later, the real-time window has shifted, and if no data exists for that new window, the chart appears empty. This is a common issue with real-time searches in Splunk dashboards, as they do not retain historical data.

Exam trap

Splunk often tests the misconception that permission issues (like index access or field visibility) are the cause, when the real problem is the ephemeral nature of real-time searches in shared dashboards.

How to eliminate wrong answers

Option B is wrong because the other users have the same role as the creator, and the chart works for the creator, so index permissions are not the issue; if they lacked permission, the creator would also see no data or an error. Option C is wrong because fields are not permission-based; if a field is used in the search, it is either available to all users with data access or the search would fail for everyone, not just other users. Option D is wrong because a private dashboard is only visible to the creator, but the question states other users can view the dashboard (they see it, but with no data), so it cannot be set to private.

Full explanation →
414
MCQmedium

A user notices that a data model designed for web server logs is not showing any events in the 'Web' object, even though the underlying logs are searched correctly with a normal search. The root events are pulling from the 'main' index, and the data model uses constraints. Which of the following is the most likely cause?

A.The time range picker is set to a period outside the acceleration summary's range.
B.The data model definition includes calculated fields that require specific field extractions.
C.The user does not have permissions to run the data model, so events are hidden.
D.The constraint defined in the data model's root event is too restrictive and excludes all events.
AnswerD

Constraints filter events; if mismatched, root event may have zero results.

Why this answer

The most likely cause is that the constraint defined in the data model's root event is too restrictive and excludes all events. Data model constraints act as a filter on the underlying index data; if the constraint condition (e.g., `sourcetype=access_combined`) does not match any events in the 'main' index, the root event will be empty, even though a normal search without the constraint returns results. This is a common misconfiguration when the constraint is too narrow or uses incorrect field values.

Exam trap

Splunk often tests the misconception that acceleration or permissions cause empty data model objects, but the real issue is almost always a misconfigured constraint that filters out all events.

How to eliminate wrong answers

Option A is wrong because the acceleration summary's time range only affects the pre-computed acceleration data, not the real-time search against the data model; if the user is running a real-time or ad-hoc search, the time picker does not block events from appearing. Option B is wrong because calculated fields are applied after the root event constraint is evaluated; they do not prevent events from being included in the root event object. Option C is wrong because permissions control access to the data model itself, not the visibility of events within it; if the user lacked permissions, they would not be able to see the data model at all, not just have empty events.

Full explanation →
415
MCQeasy

Refer to the exhibit. What will this search return?

A.A time chart of URI counts
B.A statistical summary of URI lengths
C.The 5 most common URI values
D.A list of all URI values
AnswerC

top 5 limits to top 5.

Why this answer

The `top` command in SPL returns the most common values of a field, sorted by count in descending order, limited by default to 10 results. Since the search specifies `limit=5`, it returns the 5 most frequent URI values, making option C correct.

Exam trap

The trap here is that candidates confuse `top` with `timechart` or `stats`, expecting a time-series or statistical summary instead of a simple frequency count of field values.

How to eliminate wrong answers

Option A is wrong because `top` does not produce a time-based chart; it returns a table of counts, not a timechart. Option B is wrong because `top` counts occurrences of field values, not lengths or statistical summaries of lengths. Option D is wrong because `top` with `limit=5` restricts output to the top 5 values, not a list of all values.

Full explanation →
416
Multi-Selecthard

Which THREE of the following are elements of the Splunk search interface?

Select 3 answers
A.Time Range Picker
B.Visualization Tab
C.Save Button
D.Mode Selector (Fast, Smart, Verbose)
E.Search Bar
AnswersA, D, E

Controls the time window for search results.

Why this answer

Options A, B, and D are correct. Option A is correct: the search bar is the main element. Option B is correct: the time range picker is essential for temporal context.

Option D is correct: the mode selector (Fast, Smart, Verbose) affects search behavior. Option C is wrong because there is no 'Save' button on the search bar; saving is done via the 'Save As' menu. Option E is wrong because 'Visualization' is a tab, not a permanent element of the search interface.

Full explanation →
417
MCQmedium

An analyst runs: index=app sourcetype=log ERROR | stats count by host | where count > 5. What is the function of the where command in this search?

A.Remove duplicate hosts
B.Filter events that contain ERROR before counting
C.Rename the count field
D.Filter the output of stats to show only hosts with count > 5
AnswerD

where post-processes the stats results to keep only rows meeting the condition.

Why this answer

The `where` command filters the results of the `stats` calculation, keeping only rows where the `count` field exceeds 5. This is a post-processing filter applied after aggregation, not a pre-filter on raw events. The `where` command operates on the output of `stats`, not on the original events.

Exam trap

The trap here is that candidates often confuse `where` with a search-time filter (like `ERROR` in the base search) or think it removes duplicates, but Splunk tests the understanding that `where` applies after aggregation, not before.

How to eliminate wrong answers

Option A is wrong because `where` does not remove duplicate hosts; it filters aggregated results based on a condition, and deduplication is not its function. Option B is wrong because the `ERROR` filter is already applied in the initial search string (`index=app sourcetype=log ERROR`), not by the `where` command; `where` operates on the post-stats output. Option C is wrong because `where` does not rename fields; renaming is done with the `eval` command or by using `as` in `stats`.

Full explanation →
418
Multi-Selectmedium

Which TWO of the following are valid ways to add data to Splunk?

Select 2 answers
A.Deploying a universal forwarder to monitor a log file.
B.Configuring an HTTP Event Collector (HEC) token.
C.Creating an alert that writes results to a summary index.
D.Using the 'Add Data' button in Splunk Web.
E.Typing data directly into the search bar.
AnswersA, B

Forwarders are standard data input methods.

Why this answer

Option A is correct because a universal forwarder is a dedicated Splunk component designed to collect and forward log data to a Splunk indexer. It monitors specified log files, sends data over a secure TCP connection (default port 9997), and is the standard method for scalable, production-grade data ingestion.

Exam trap

The trap here is that candidates confuse the 'Add Data' button (a configuration wizard) with an actual data ingestion method, or mistakenly think summary indexes or the search bar can be used to import raw data into Splunk.

Full explanation →
419
MCQmedium

During data model creation, an administrator adds a calculated field that concatenates `src_ip` and `dest_ip` with a hyphen. Which of the following is a best practice for calculated fields in data models?

A.Calculated fields should only use basic mathematical operations, not string functions.
B.Calculated fields should be used sparingly to avoid impacting search performance.
C.Calculated fields are evaluated at index time, so they improve search performance.
D.Calculated fields are automatically accelerated when the data model is accelerated.
AnswerB

Excessive calculated fields increase search-time computation.

Why this answer

Calculated fields in data models are evaluated at search time, not index time, meaning they add computational overhead for every search that references them. Using them sparingly is a best practice because excessive calculated fields can degrade search performance, especially in large datasets or when the data model is accelerated. Option B correctly identifies this performance consideration.

Exam trap

Splunk often tests the misconception that calculated fields are evaluated at index time (like indexed fields) and therefore improve performance, when in fact they are search-time constructs that add overhead.

How to eliminate wrong answers

Option A is wrong because calculated fields can use string functions like concatenation, not just basic math; the restriction to mathematical operations is a misconception. Option C is wrong because calculated fields are evaluated at search time, not index time, so they do not improve performance and actually add overhead. Option D is wrong because calculated fields are not automatically accelerated when the data model is accelerated; only certain fields (e.g., those used in constraints or acceleration summaries) benefit from acceleration, and calculated fields can even complicate acceleration.

Full explanation →
420
MCQmedium

After running a search, the Fields sidebar shows several fields but the analyst wants to see all fields. Which button should they click?

A.The gear icon next to 'Selected Fields'
B.'Add field' button
C.'All fields' button
D.'Show all fields' checkbox
AnswerA

This opens the field selector to customize displayed fields.

Why this answer

The gear icon next to 'Selected Fields' opens a dialog to add/remove fields from the sidebar.

Full explanation →
421
MCQeasy

A user runs a search for errors but notices that the `source` field is not appearing in the selected fields list. What is the most likely reason?

A.The field `source` is a default field and is always present.
B.The search returned no results.
C.The user may have closed the field sidebar.
D.The `source` field is only available if explicitly extracted.
AnswerA

source is a default field.

Why this answer

Option A is correct because the `source` field is a default metadata field in Splunk, automatically extracted at index time for every event. It is always present in the selected fields list when events are returned, regardless of the search query or data source type.

Exam trap

The trap here is that candidates may think `source` is an optional or extracted field, but Splunk automatically includes it as a default metadata field for every event, so it is always available in the selected fields list when events exist.

How to eliminate wrong answers

Option B is wrong because if the search returned no results, the selected fields list would be empty or show no fields, not specifically omit the `source` field. Option C is wrong because closing the field sidebar hides the entire fields panel, not just the `source` field from the selected fields list. Option D is wrong because the `source` field is not explicitly extracted; it is a default metadata field that Splunk automatically populates from the file or input path at index time.

Full explanation →
422
MCQhard

A large enterprise uses Splunk to monitor 500+ servers. A search returns results slowly due to high data volume. Which best practice can improve performance when using the top command?

A.Use the fields command to remove unnecessary fields
B.Use rare instead of top to reduce output
C.Add a limit to top, e.g., top limit=20
D.Apply the sort command before top
AnswerC

Limiting results reduces memory and CPU overhead for top.

Why this answer

Option C is correct because adding a limit to the top command (e.g., top limit=20) restricts the number of results returned, reducing the computational load and memory usage. In high-volume environments, this directly improves search performance by limiting the aggregation work Splunk must perform across all 500+ servers.

Exam trap

Splunk often tests the misconception that removing fields or using rare will improve performance, when in fact only limiting the output of the top command directly reduces the aggregation workload.

How to eliminate wrong answers

Option A is wrong because the fields command removes unnecessary fields from results but does not reduce the number of events processed by the top command, so it has minimal impact on the performance bottleneck caused by high data volume. Option B is wrong because rare performs the same aggregation work as top (just in reverse order), so it does not improve performance and may even be slower due to sorting fewer common values. Option D is wrong because applying the sort command before top forces Splunk to sort all events first, which is extremely expensive on large datasets and will degrade performance further.

Full explanation →
423
Multi-Selectmedium

Which three of the following statements about lookup tables and their usage in Splunk are correct? (Choose three.)

Select 3 answers
.A lookup table can be defined as a CSV file stored in the lookups directory of an app
.The `| inputlookup` command can be used to return the contents of a lookup table as search results
.Lookups can be configured to automatically enrich events during search time using the `lookup` command
.Lookup table files must always have a .csv extension and cannot be in other formats like .kvstore
.The `| outputlookup` command is used to append data to an existing lookup file without any limitations
.Lookups can only match on a single field; using multiple fields requires creating separate lookups

Why this answer

The first three statements are correct. Lookup tables can be defined as CSV files stored in the lookups directory of an app, which is a standard method for creating static lookups. The `| inputlookup` command retrieves and returns the contents of a lookup table as search results, allowing you to inspect or use the data.

Lookups can be configured to automatically enrich events during search time using the `lookup` command, which matches fields in events against the lookup table to add additional fields.

Exam trap

Splunk often tests the misconception that lookups are restricted to single-field matching or that outputlookup has no limitations, leading candidates to overlook the flexibility of multi-field lookups and the constraints of outputlookup.

Full explanation →
424
MCQhard

Refer to the exhibit. A user gets this error when running a search with a GeoIP lookup. What is the most likely cause?

A.The user does not have permission to use lookups
B.The lookup command syntax is incorrect
C.The lookup file has not been uploaded to Splunk
D.The field name in the lookup does not match the event field
AnswerC

The file is missing from the expected location.

Why this answer

The error message indicates that Splunk cannot find the lookup table referenced in the search. Option C is correct because the GeoIP lookup file must be uploaded to Splunk (as a CSV or KMZ file) and defined as a lookup table in the lookups.conf configuration before it can be used in a search. Without the file being present in the system, the lookup command fails with a 'lookup table not found' error.

Exam trap

Splunk often tests the distinction between a missing lookup file (Option C) and a syntax error (Option B), because candidates may assume the command is wrong when the actual issue is that the lookup table resource is not available.

How to eliminate wrong answers

Option A is wrong because permission errors typically produce a different error message (e.g., 'You do not have permission to run this search' or 'No permission for lookup'), not a 'lookup table not found' error. Option B is wrong because the lookup command syntax (e.g., `| lookup geoip clientip`) is correct; the error is about the missing lookup file, not the command structure. Option D is wrong because a field name mismatch would cause the lookup to return no results or a 'field not found' warning, not a 'lookup table not found' error.

Full explanation →
425
MCQhard

A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?

A.Modify the lookup definition to set case_sensitive_match = false
B.Swap the field order in the lookup command
C.Change OUTPUT to OUTPUTNEW to avoid overwriting fields
D.Change the index to default
AnswerA

This allows case-insensitive matching.

Why this answer

The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.

Exam trap

The trap here is that candidates often assume the lookup command syntax is wrong (e.g., field order or OUTPUT vs OUTPUTNEW) when the real issue is a subtle default behavior like case sensitivity, which Splunk explicitly tests in the SPLK-1002 exam.

How to eliminate wrong answers

Option B is wrong because the field order in the lookup command (`threat_intel.csv src_ip OUTPUT category confidence`) is correct — the first field after the filename is the lookup field to match, and `src_ip` matches the field in the events. Option C is wrong because `OUTPUTNEW` only prevents overwriting existing fields, but the problem is that no matches are found at all, not that fields are being overwritten. Option D is wrong because the index name is irrelevant — the search explicitly specifies `index=firewall`, and the lookup failure is not related to the index selection.

Full explanation →
426
MCQhard

A user runs a search but sees no results, even though they know events exist. The search does not show any errors. What is the most likely cause?

A.The time range picker is set to a very narrow or recent window that doesn't include any events.
B.The user is in the wrong app and cannot see any data.
C.The indexer is out of disk space and cannot return results.
D.The search is specifying an incorrect index that doesn't exist.
AnswerA

Time range is a common filter that can exclude all events.

Why this answer

The most likely cause is that the time range picker is set to a very narrow or recent window that does not include any events. Splunk searches are always constrained by the selected time range, and if the time range does not cover the period when the events were indexed, no results will be returned even though the data exists. The absence of search errors confirms the query syntax is valid, but the time filter silently excludes matching events.

Exam trap

The trap here is that candidates often assume a search with no results and no errors must be a data access or index issue, overlooking the time range picker as the silent filter that is the most common cause in real-world Splunk troubleshooting.

How to eliminate wrong answers

Option B is wrong because being in the wrong app only affects which knowledge objects (dashboards, saved searches) are available, not the underlying data; the search would still return events from the specified index regardless of the app context. Option C is wrong because if the indexer were out of disk space, it would not be able to write new data, but existing data would still be searchable and returned; disk space issues typically cause indexing failures, not search result suppression. Option D is wrong because specifying an incorrect index that doesn't exist would cause a search error (e.g., 'No index matched' or 'Unable to find index'), not a silent return of zero results.

Full explanation →
427
MCQmedium

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

A.index=web | timechart avg(duration) by url_path
B.index=web | chart avg(duration) by url_path
C.index=web | eval avg_duration=avg(duration) | stats by url_path
D.index=web | stats avg(duration) by url_path
AnswerD

stats correctly computes average per group.

Why this answer

Option D is correct because the `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Exam trap

The trap here is that candidates often confuse `stats` with `chart` or `timechart`, or incorrectly try to use `eval` for aggregation, not realizing that `eval` operates on individual events and cannot compute summary statistics across groups.

How to eliminate wrong answers

Option A is wrong because `timechart` creates a time-based chart with a series for each `url_path`, which is unnecessary and may produce many data points over time rather than a single average per URL path. Option B is wrong because `chart avg(duration) by url_path` would produce a table with one row per `url_path` but is less efficient and not the standard way to compute grouped averages; `stats` is the idiomatic command for this task. Option C is wrong because `eval` cannot perform aggregation functions like `avg()` — `eval` works on a per-event basis, not across groups, and the syntax `eval avg_duration=avg(duration) | stats by url_path` is invalid and would cause a parsing error.

Full explanation →
428
MCQmedium

Refer to the exhibit. The search returns only events where src_zone is 'external'. What is the problem?

A.The 'src_ip' field is not extracted
B.The default condition should be 'true()' instead of '1=1'
C.The 'case' function cannot compare IP addresses to CIDR ranges
D.The 'search' command should be before 'eval'
AnswerC

Correct: case uses exact string comparison, not subnet matching.

Why this answer

The 'case' function evaluates conditions in order. The second condition '1=1' is always true, so any IP not matching '10.0.0.0/8' gets 'external'. However, the 'case' function does not support CIDR matching; it treats '10.0.0.0/8' as a literal string.

So no IP matches the first condition, and all get 'external'.

Full explanation →
429
MCQhard

A dashboard has multiple panels that each use the same base search but apply different aggregate functions. To avoid running the base search multiple times, which technique should be used?

A.Use a base search with post-process panels
B.Use | savedsearch to reference the base search
C.Use | multisearch to combine all aggregations
D.Use | map to run the base search for each panel
AnswerA

Post-process panels share the base search results, reducing duplicate searches.

Why this answer

Option A is correct because Splunk's post-process search feature allows a dashboard to define a single base search that runs once, and then multiple panels can apply different aggregate functions (e.g., stats, timechart) on the results without re-executing the base search. This is achieved by using the `base` and `postprocess` attributes in the dashboard XML or Simple XML, which significantly reduces search overhead and improves dashboard performance.

Exam trap

The trap here is that candidates often confuse `| multisearch` or `| map` with sharing results, but Splunk specifically designed post-process searches for this exact use case, and the exam tests the distinction between running a search once versus running it multiple times.

How to eliminate wrong answers

Option B is wrong because `| savedsearch` runs the saved search as a new independent search each time it is invoked, so it does not avoid running the base search multiple times across panels. Option C is wrong because `| multisearch` is used to run multiple subsearches in parallel and combine their results, but it does not allow different panels to apply different aggregate functions on a single shared base result set. Option D is wrong because `| map` runs a search for each input value from a prior search, which would actually multiply the number of base search executions rather than reduce them, and is not designed for sharing a single base result across panels.

Full explanation →
430
Multi-Selecthard

Which TWO methods allow a user to share a saved search with other users in the same Splunk instance?

Select 2 answers
A.Schedule the search to run periodically.
B.Copy the search URL from the browser and send it to others.
C.Export the search results and attach them in an email.
D.Set the search's permissions to 'Everyone' or to specific roles.
E.Add the search as a panel in a shared dashboard.
AnswersD, E

Permissions control who can see and use the search.

Why this answer

Option D is correct because Splunk's permission system allows a search owner to set read and edit permissions to 'Everyone' or specific roles, making the saved search accessible to other users in the same instance. Option E is correct because adding a saved search as a panel in a shared dashboard automatically inherits the dashboard's sharing permissions, allowing other users to view and run the search from that dashboard.

Exam trap

Splunk often tests the distinction between sharing the search definition (via permissions or dashboards) versus sharing output or transient links, leading candidates to mistakenly choose options like copying a URL or emailing results.

Full explanation →
431
Drag & Dropmedium

Drag and drop the steps to configure a Splunk alert that sends an email when a specific condition is met into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Alerts are created from a search, with conditions and actions defined in the alert configuration.

Full explanation →
432
MCQhard

An IT operations team has a dashboard with multiple panels showing server metrics. Each panel uses a separate search that runs every time the dashboard is loaded, causing slow performance. What is the best practice to improve dashboard load time?

A.Use a base search and post-process searches for dependent panels.
B.Reduce the time range picker to the last 24 hours.
C.Combine all searches into one large search and use eval to separate results.
D.Add more panels to distribute the data load.
AnswerA

This allows sharing search results across panels, reducing overall search execution.

Why this answer

Option A is correct because using a base search with post-process searches allows multiple dashboard panels to share a single, initial data retrieval. Instead of each panel running its own independent search against the index, they all reference the results of the base search, which runs once. This drastically reduces the number of indexer queries and speeds up dashboard load time, especially when panels share a common data source or filtering criteria.

Exam trap

The trap here is that candidates often think reducing the time range or consolidating searches into one large query will improve performance, but they overlook the fundamental Splunk best practice of using base searches to eliminate redundant index access.

How to eliminate wrong answers

Option B is wrong because reducing the time range to the last 24 hours only limits the data volume, but does not address the root cause of multiple independent searches running concurrently; each panel still executes its own search, so performance gains are minimal and may miss needed historical data. Option C is wrong because combining all searches into one large search with eval statements creates a monolithic, complex query that is harder to debug, may exceed search limits, and still forces Splunk to process all data for every panel, often increasing load time rather than reducing it. Option D is wrong because adding more panels would increase the number of independent searches, making performance worse, not better.

Full explanation →
433
MCQeasy

A user wants to use the Pivot interface to analyze web traffic data. Which data model should they select?

A.Network_Traffic
B.Web
C.Authentication
D.Email
AnswerB

The Web data model is designed for web traffic data.

Why this answer

The Pivot interface is designed to work with data models that have been properly defined and accelerated. The 'Web' data model is the correct choice because it is a standard, pre-built data model in Splunk that specifically models web traffic data, including fields like status, bytes, referrer, and user agent, which are essential for analyzing web traffic.

Exam trap

The trap here is that candidates may confuse 'Network_Traffic' with web traffic due to the word 'traffic,' but Splunk's data models are domain-specific, and 'Network_Traffic' is for lower-level network protocols (e.g., IP, TCP, UDP), not HTTP/HTTPS web data.

How to eliminate wrong answers

Option A is wrong because the 'Network_Traffic' data model is designed for network-level data such as firewall logs, NetFlow, and packet captures, not for web traffic analysis. Option C is wrong because the 'Authentication' data model focuses on login events, user authentication, and access control, which is unrelated to web traffic analysis. Option D is wrong because the 'Email' data model is structured for email server logs and message tracking, not for web traffic data.

Full explanation →
434
Multi-Selectmedium

Which TWO of the following methods allow a user to switch between apps in Splunk Web?

Select 2 answers
A.Change the app name in the URL to the desired app.
B.Type the app name in the search bar before the query.
C.Use the app dropdown in the top menu bar.
D.Select 'All apps' from the app dropdown.
E.Click on the timeline and select an app.
AnswersA, C

URL can directly navigate to an app.

Why this answer

Option A is correct because Splunk Web uses URL-based routing where the app context is embedded in the path (e.g., /app/search/). Manually changing the app name in the URL directly modifies this context, forcing Splunk to load the specified app's dashboards and data models. This is a valid method for power users who know the exact app name.

Exam trap

Splunk often tests the distinction between navigating to an app (via dropdown or URL) versus merely listing apps (via 'All apps'), causing candidates to mistakenly select 'All apps' as a switching method.

Full explanation →
435
MCQeasy

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

A.source_ip
B.dest_ip
C.host
D.user
AnswerA

source_ip typically contains the originating IP address.

Why this answer

The correct answer is A: source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Exam trap

The trap here is that candidates often confuse source_ip with dest_ip, assuming any IP field will work, but Splunk requires field-specific searches to accurately capture the role of the IP in the event.

How to eliminate wrong answers

Option B (dest_ip) is wrong because it only captures events where the IP is the destination of traffic, missing events where the IP originated the connection. Option C (host) is wrong because host refers to the machine or device that generated the event, not the IP address itself, and may not even contain the IP in question. Option D (user) is wrong because user identifies a username or account, not an IP address, and would not return any events related to the IP.

Full explanation →
436
Multi-Selecteasy

A user wants to save a search as a report that can be used in a dashboard. Which TWO steps are required? (Select two.)

Select 2 answers
A.Schedule the report for email delivery
B.Run the search and click 'Save As' > 'Report'
C.Set a time range in the search
D.Name the report and set permissions
E.Add the report to a dashboard panel
AnswersB, D

This initiates the save process for a report.

Why this answer

Option B is correct because the first required step to save a search as a report is to run the search and then select 'Save As' > 'Report' from the Splunk UI. This action opens the Save As Report dialog, which is the standard method for converting an ad-hoc search into a persistent report object that can be used in dashboards.

Exam trap

The trap here is that candidates often confuse the optional post-save actions (like scheduling or adding to a dashboard) with the mandatory steps required to create the report object itself.

Full explanation →
437
MCQmedium

An analyst needs to create a dashboard that displays real-time data (streaming) for operational monitoring. Which panel type supports real-time data?

A.A panel based on a scheduled alert.
B.A panel based on a saved search with a fixed time range.
C.A panel based on a saved report with a scheduled time range.
D.A panel with a search that uses the 'Real-time' time range option.
AnswerD

Real-time time range enables streaming data display.

Why this answer

Option D is correct because the 'Real-time' time range option in Splunk allows a dashboard panel to continuously stream and update data as it is indexed, providing live operational monitoring. This is the only panel type that supports true real-time data, as it sets the search to run continuously with a rolling window (e.g., last 60 seconds) rather than relying on a fixed or scheduled time range.

Exam trap

The trap here is that candidates confuse scheduled searches or alerts with real-time streaming, but Splunk's 'Real-time' time range is the only mechanism that provides continuous, live data updates in a dashboard panel.

How to eliminate wrong answers

Option A is wrong because a scheduled alert runs at defined intervals and generates results only when triggered, not as a continuous real-time stream for dashboard display. Option B is wrong because a saved search with a fixed time range (e.g., last 24 hours) is static and does not update in real time; it reflects historical data at the time of execution. Option C is wrong because a saved report with a scheduled time range runs on a cron schedule (e.g., every hour), producing snapshots of data at those intervals, not a live streaming feed.

Full explanation →
438
Multi-Selecthard

A security analyst creates a dashboard with multiple timechart panels. To ensure the dashboard performs well with large datasets, which THREE practices should be followed? (Select three.)

Select 3 answers
A.Use `| eval` to create calculated fields after aggregation
B.Use `eventstats` instead of `stats` when possible
C.Use the `fields` command to remove unnecessary fields early
D.Limit the time range to necessary periods
E.Use report acceleration on the base search
AnswersC, D, E

Removing unnecessary fields early reduces resource usage.

Why this answer

Option C is correct because the `fields` command removes unnecessary fields from events early in the search pipeline, reducing the amount of data that must be processed and stored in memory. This is especially important in dashboard timechart panels where large datasets can cause slow rendering and timeout issues.

Exam trap

Splunk often tests the misconception that `eventstats` is always better than `stats` for performance, but in dashboard contexts where you only need aggregated results, `stats` is more efficient because it does not attach the aggregation back to every raw event.

Full explanation →
439
MCQeasy

In Splunk, which of the following is true about fields?

A.Fields are extracted at search time from raw data
B.Fields must be manually defined before indexing
C.Fields are only available after using the fields command
D.All fields are predefined by Splunk
AnswerA

Splunk extracts fields during search.

Why this answer

In Splunk, fields are extracted at search time from raw data using the Search Processing Language (SPL) and the default field extraction rules. This allows Splunk to dynamically identify and index field-value pairs without requiring predefined schemas, enabling flexible ad-hoc analysis of unstructured or semi-structured data.

Exam trap

The trap here is that candidates often confuse search-time field extraction with index-time field extraction, mistakenly believing fields must be defined before indexing (Option B) or that Splunk predefines all fields (Option D), when in reality Splunk's flexibility comes from extracting fields at search time from raw data.

How to eliminate wrong answers

Option B is wrong because Splunk does not require fields to be manually defined before indexing; it uses automatic key-value extraction and can also leverage custom field extractions via transforms.conf or props.conf. Option C is wrong because fields are available automatically after indexing and can be used in searches without the fields command; the fields command is used to include or exclude specific fields from search results. Option D is wrong because not all fields are predefined by Splunk; many fields are extracted dynamically from the raw data, and users can define custom fields using field extractions or lookups.

Full explanation →
440
MCQeasy

A user wants to see only events where the 'action' field has a value of 'success'. Which search syntax should they use?

A.where action=success
B.action=success
C.lookup action=success
D.search action=success
AnswerB

Direct filtering in the search bar.

Why this answer

Option B is correct because in Splunk's Search Processing Language (SPL), a field-value pair like `action=success` is the most direct and efficient way to filter events where the field 'action' has the value 'success'. This syntax leverages Splunk's index-time field extraction and inverted index lookup, making it faster than using the `where` or `search` commands for simple equality filters.

Exam trap

Splunk often tests the misconception that the `where` command is required for all filtering, but in Splunk, a bare field-value pair is the standard and most performant way to filter on exact field values, while `where` is reserved for complex expressions or comparisons.

How to eliminate wrong answers

Option A is wrong because `where action=success` is invalid syntax; the `where` command requires an expression (e.g., `where action="success"`) and does not accept a bare field-value pair. Option C is wrong because `lookup action=success` is not a valid search command; the `lookup` command is used to enrich events with external data from a lookup table, not to filter on existing fields. Option D is wrong because `search action=success` is redundant and less efficient; while it works, the implicit search prefix already applies, so the explicit `search` command is unnecessary and can be slower in large datasets.

Full explanation →
441
Multi-Selecthard

Which THREE are valid considerations when troubleshooting data model acceleration? (Choose three.)

Select 3 answers
A.The summary index must be writable and have enough disk space.
B.Too many fields in the data model can cause acceleration to fail.
C.The data model must be based on a real-time search to be accelerated.
D.Insufficient memory on the indexer for the summary build process.
E.The base search for the data model must be efficient and not timeout.
AnswersA, D, E

Acceleration writes summaries to a summary index; it must be writable.

Why this answer

Option A is correct because data model acceleration creates a summary index that stores pre-computed results. If the summary index is not writable or lacks sufficient disk space, the acceleration process will fail, preventing the data model from being accelerated.

Exam trap

Splunk often tests the misconception that data model acceleration requires real-time data, but in reality, acceleration is designed for historical data and uses scheduled summary builds, not real-time searches.

Full explanation →
442
Drag & Dropmedium

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Troubleshooting no results involves checking time range, syntax, data existence, and logs.

Full explanation →
443
Multi-Selectmedium

Which THREE of the following are transforming commands in Splunk?

Select 3 answers
A.search
B.stats
C.timechart
D.chart
E.eval
AnswersB, C, D

stats is a transforming command that computes statistics.

Why this answer

The `stats`, `timechart`, and `chart` commands are all transforming commands in Splunk because they convert raw event data into statistical results, typically producing a table or time-based chart. Unlike non-transforming commands (e.g., `search` or `eval`), these commands change the data structure from events to a summary, which is required for visualizations and further statistical processing.

Exam trap

Splunk often tests the distinction between transforming and non-transforming commands, and the trap here is that candidates mistakenly think `eval` is transforming because it can create new fields, but it does not aggregate or change the event structure into a statistical table.

Full explanation →
444
MCQhard

A company has a dashboard that uses a base search and four post-process searches to display metrics. The dashboard loads slowly. The base search returns 10,000 results and each post-process search further filters. The infrastructure team suggests using tstats to improve performance. Which approach is best?

A.Use the tstats command in each post-process search without changing the base search
B.Replace all searches with a single tstats search and use eval in the dashboard
C.Use tstats only in the base search and keep the post-process searches as they are
D.Accelerate the data model used by the base search and use tstats in the post-process searches
AnswerD

Acceleration and tstats optimize both base and post-process searches, improving performance.

Why this answer

Option D is correct because tstats is optimized to run against accelerated data models, which pre-aggregate statistics and dramatically reduce the time needed to compute metrics. By accelerating the data model used by the base search, the base search itself becomes faster, and using tstats in the post-process searches leverages that acceleration to filter and aggregate results without scanning raw events. This combination addresses the root cause of slow performance—scanning 10,000 raw results in post-process searches—by moving computation to the indexed, pre-summarized data.

Exam trap

Splunk often tests the misconception that tstats can be used as a drop-in replacement for any search without considering the prerequisite of an accelerated data model or summary index, leading candidates to pick options that misuse tstats in post-process searches without addressing the base search's performance bottleneck.

How to eliminate wrong answers

Option A is wrong because using tstats in each post-process search without changing the base search still requires the base search to return 10,000 raw results, and tstats in post-process searches cannot bypass the base search's raw event retrieval, so the overall performance gain is minimal. Option B is wrong because replacing all searches with a single tstats search and using eval in the dashboard eliminates the ability to have separate, independent post-process searches that filter different metrics, and eval cannot replicate the filtering logic of post-process searches without significant complexity and performance loss. Option C is wrong because using tstats only in the base search while keeping post-process searches as they are does not accelerate the post-process searches themselves, which still filter the 10,000 raw results using slow, non-accelerated commands.

Full explanation →
445
MCQhard

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

A.The time range is set to a period with no data
B.The lookup file is not defined as a lookup table in Splunk
C.The sort command requires a field name
D.The where clause is incorrectly formatted
AnswerB

Inputlookup requires a lookup definition.

Why this answer

The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Exam trap

Splunk often tests the distinction between uploading a lookup file and defining it as a lookup table, tricking candidates into thinking the file's mere existence on the filesystem is sufficient for it to be used in searches.

How to eliminate wrong answers

Option A is wrong because if the time range had no data, the search would still attempt to use the lookup file and might return results from the lookup itself, but the panel shows no results at all, indicating the lookup is not being resolved. Option C is wrong because the `sort` command does not require a field name; it can sort by the default field `_raw` or by the entire event, and a missing field name would cause a syntax error, not a silent failure with no results. Option D is wrong because the `where` clause is correctly formatted in the exhibit (e.g., `where status=200`), and an incorrectly formatted `where` clause would produce a search syntax error, not a panel with no results.

Full explanation →
446
MCQmedium

A security analyst wants to create a report showing the number of failed login attempts by user over the past 24 hours, updated automatically every hour. Which approach is most efficient?

A.Create a real-time search in a dashboard
B.Create a report with a scheduled search that runs every hour and saves to a CSV file
C.Create a dashboard panel with a fast search
D.Use the tstats command in a dashboard
AnswerB

Scheduled reports run at specified intervals and can save results, making them efficient for periodic updates.

Why this answer

Option B is correct because scheduled reports with a time range run periodically and save results, reducing resource usage. Option A is wrong because dashboard panels run every time the dashboard loads, not scheduled. Option C is wrong because real-time searches are continuous and resource-intensive.

Option D is wrong because tstats is used for accelerated data models, not for ad-hoc reporting.

Full explanation →
447
MCQhard

Refer to the exhibit. The search returns no results. What is the most likely reason?

A.The sourcetype is incorrect
B.The 'regex' command cannot extract fields; use 'rex' instead
C.The regex pattern is invalid
D.The 'top' command requires a field to be extracted first
AnswerB

Correct: regex filters events, rex extracts fields.

Why this answer

The regex uses named capture groups, but Splunk's 'regex' command does not support creating fields with named capture groups. The 'rex' command should be used instead to extract fields.

Full explanation →
448
MCQeasy

A user wants to create a pie chart showing the distribution of error types from web server logs. Which Splunk command should be used to group the errors before visualization?

A.table
B.eval
C.top
D.stats count by error_type
AnswerD

This returns the count per error type, which can be visualized as a pie chart.

Why this answer

Option D is correct because the `stats count by error_type` command groups the raw events by the `error_type` field and computes the count for each group, producing the structured data needed for a pie chart. A pie chart requires aggregated numerical values per category, and `stats count by` is the standard Splunk approach to create this summary from log events.

Exam trap

The trap here is that candidates often confuse `top` with `stats count by` because both can show counts, but `top` is optimized for ranking and may truncate results, whereas `stats count by` provides a complete, unranked aggregation suitable for full-distribution visualizations like pie charts.

How to eliminate wrong answers

Option A is wrong because `table` simply displays selected fields in a tabular format without performing any aggregation, so it cannot group error types or compute counts for a pie chart. Option B is wrong because `eval` is used to create or modify fields using expressions, not to group or count events; it does not produce the aggregated dataset required for a pie chart. Option C is wrong because `top` displays the most common values of a field along with their counts and percentages, but it is designed for ranking and includes a limit (default 10), which may omit less frequent error types and is not the general-purpose grouping command for all error categories in a pie chart.

Full explanation →
449
MCQhard

A search includes the command '| stats dc(user) by host'. What does this command return?

A.The number of unique hosts per user
B.The count of events per host
C.The sum of user values per host
D.The number of distinct users per host
AnswerD

dc(user) counts distinct users.

Why this answer

The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Exam trap

The trap here is confusing `dc(user)` with `count(user)` or `sum(user)`, leading candidates to think it returns event counts or sums instead of distinct counts.

How to eliminate wrong answers

Option A is wrong because `dc(user) by host` counts distinct users per host, not distinct hosts per user. Option B is wrong because `dc(user)` does not count events; it counts distinct values of the `user` field. Option C is wrong because `dc(user)` performs a distinct count, not a sum of user values, and summing string values is not a valid operation in this context.

Full explanation →
450
MCQeasy

A user needs to see the trend of login failures over the past 7 days, broken down by hour. Which command should be used?

A.stats count by _time
B.eval count
C.timechart count by _time
D.chart count over _time
AnswerC

timechart automatically groups events into time buckets and displays the count over time.

Why this answer

C is correct because `timechart count by _time` automatically creates a time-based chart with login failures aggregated per hour over the past 7 days. The `timechart` command splits the time range into equal-span buckets (default 1 hour for a 7-day window) and counts events in each bucket, displaying the trend over time. The `by _time` clause is redundant but not harmful; the command inherently uses `_time` as the x-axis.

Exam trap

Splunk often tests the distinction between `timechart` (which automatically buckets and charts time-based data) and `stats` (which requires manual time-binning via `bin` or `timechart`-like syntax), leading candidates to choose `stats count by _time` thinking it will produce a trend chart.

How to eliminate wrong answers

Option A is wrong because `stats count by _time` would group events by exact `_time` timestamps (including milliseconds), producing a row per unique timestamp rather than hourly buckets, and it does not generate a time-based chart. Option B is wrong because `eval count` is not a transforming command; it creates or modifies a field but cannot aggregate or trend data over time. Option D is wrong because `chart count over _time` is invalid syntax; the `chart` command uses `by` or `over` incorrectly here—`over` is not a valid clause for `chart`, and even if corrected to `chart count by _time`, it would behave like `stats` without automatic time bucketing or charting.

Full explanation →
Page 5

Page 6 of 7

Page 7

All pages

1234567

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Splunk Basics and Interface NavigationBasic Searching and Transforming CommandsUsing Fields and LookupsCreating Reports, Dashboards and VisualizationsData Models and Best Practices
See all domains with question counts →