Splunk Core Certified User SPLK-1002 SPLK-1001 Questions 451–502 | Page 7/7

451

MCQhard

A dashboard includes a table panel that shows recent errors. The analyst wants users to click on an error message and be taken to a search showing all events containing that error message within the same time range. Which configuration should be applied to the table panel?

A.Set 'Drilldown' to 'Link to search' and configure the target search with a token for the error message.

B.Add a token on the table panel and set the drilldown to 'Token' with value '$row.error_message$'.

C.Set 'Drilldown' to 'Custom' and use JavaScript to open a new window.

D.Set 'Drilldown' to 'Search', and in the search string include 'error_message="$click.value$"'

AnswerA

Link to search with tokens maintains the time range and passes clicked value.

Why this answer

Setting 'Drilldown' to 'Link to search' allows you to configure a target search URL that includes a token for the clicked error message. When a user clicks a cell in the table, the token (e.g., `$click.value$`) is replaced with the actual value from that cell, and Splunk opens a new search using the same time range as the original dashboard, fulfilling the requirement exactly.

Exam trap

The trap here is that candidates confuse 'Drilldown' to 'Search' (which requires manual time range handling) with 'Link to search' (which automatically preserves the dashboard's time range), leading them to pick Option D incorrectly.

How to eliminate wrong answers

Option B is wrong because adding a token to the table panel and setting drilldown to 'Token' with value '$row.error_message$' is not a valid drilldown configuration; tokens are used for passing values between panels, not for navigating to a search. Option C is wrong because 'Custom' drilldown with JavaScript is deprecated and not recommended for simple navigation; it also bypasses Splunk's built-in time range preservation. Option D is wrong because setting 'Drilldown' to 'Search' with 'error_message="$click.value$"' does not automatically carry over the dashboard's time range; the search would run with the default time range unless explicitly configured, and the syntax should use `$click.value$` without quotes around the field name.

Full explanation →

452

MCQeasy

A security analyst runs a search that returns many fields, most of which are not needed. Which command should be used to remove all fields except 'src_ip', 'dest_ip', and 'action'?

A.| rename src_ip as src, dest_ip as dest, action as act

B.| fields + src_ip, dest_ip, action

C.| fields - src_ip, dest_ip, action

D.| table src_ip, dest_ip, action

AnswerB

The '+' prefix keeps only listed fields.

Why this answer

The `fields` command with the `+` prefix explicitly keeps only the listed fields and removes all others from the search results. This is the correct way to retain only `src_ip`, `dest_ip`, and `action` while discarding the rest.

Exam trap

Splunk often tests the distinction between `fields +` (keep only) and `fields -` (remove), and candidates frequently confuse the two, especially when the question asks to 'remove all fields except' a specific set.

How to eliminate wrong answers

Option A is wrong because `rename` only changes field names, it does not remove any fields. Option C is wrong because `fields -` removes the listed fields, keeping all others, which is the opposite of what is needed. Option D is wrong because `table` creates a results table with only those fields, but it also transforms the output into a tabular format and can affect event counts or statistical commands, whereas `fields` simply filters fields without changing the data structure.

Full explanation →

453

MCQeasy

A user wants to remove duplicate events based on the 'transaction_id' field, keeping only the first occurrence. Which command is appropriate?

A.fields - transaction_id

B.sort transaction_id | dedup transaction_id

C.dedup transaction_id

D.uniq transaction_id

AnswerC

Removes duplicates based on field.

Why this answer

The `dedup` command removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the user wants to keep the first occurrence of each unique `transaction_id`, `dedup transaction_id` is the correct and simplest approach.

Exam trap

The trap here is that candidates often confuse `dedup` with `uniq`, not realizing that `uniq` only removes consecutive duplicates and requires sorted input, while `dedup` works on any field and does not require prior sorting.

How to eliminate wrong answers

Option A is wrong because `fields - transaction_id` removes the `transaction_id` field from events, not duplicate events. Option B is wrong because `sort transaction_id | dedup transaction_id` sorts events by `transaction_id` before deduplication, which changes the order and may cause a different event to be kept as the 'first occurrence' if the original order is important. Option D is wrong because `uniq` removes consecutive duplicate lines, not duplicate events based on a field, and it requires sorted input to work correctly.

Full explanation →

454

Multi-Selecteasy

Which TWO methods can be used to create a new field in a search?

Select 2 answers

A.search new_field=*

B.timechart count by date

C.rex field=raw "(?<new_field>pattern)"

D.stats count by host

E.eval new_field = some_expression

AnswersC, E

Rex can extract and create new fields from existing ones.

Why this answer

The `rex` command uses a regular expression to extract a named group (`(?<new_field>pattern)`) from the `_raw` event data, dynamically creating the field `new_field` with the matched value. This is a standard method for field extraction in Splunk searches.

Exam trap

Splunk often tests the misconception that filtering commands like `search` or aggregation commands like `stats` can create fields, when in reality only extraction (`rex`) or evaluation (`eval`) commands generate new fields from existing data.

Full explanation →

455

MCQeasy

Refer to the exhibit. An automatic lookup is configured with WILDCARD match type. What kind of matching does this enable?

A.Matching based on prefixes or suffixes using wildcards.

B.Exact match only.

C.Case-insensitive match.

D.Matching only on the first N characters.

AnswerA

WILDCARD enables pattern matching.

Why this answer

An automatic lookup configured with WILDCARD match type enables matching based on prefixes or suffixes using wildcards. This allows the lookup to match field values that contain a wildcard character (e.g., * or ?) to represent variable parts of the string, enabling flexible pattern matching beyond exact equality.

Exam trap

The trap here is that candidates often confuse WILDCARD match type with case-insensitive matching or assume it only supports prefix matching, when in fact it supports both prefix and suffix wildcards and is distinct from case sensitivity settings.

How to eliminate wrong answers

Option B is wrong because exact match only is the behavior of the EXACT match type, not WILDCARD. Option C is wrong because case-insensitive matching is controlled by the case_sensitive_match setting in the lookup definition, not by the match type. Option D is wrong because matching only on the first N characters is a form of prefix matching that can be achieved with WILDCARD using a trailing wildcard, but it is not the exclusive behavior; WILDCARD supports both prefix and suffix matching via wildcards at either end of the pattern.

Full explanation →

456

Multi-Selectmedium

Which THREE of the following are valid options for the lookup command?

Select 3 answers

A.local=<bool>

B.rename <field> as <alias>

C.join <field>

D.output <newfield>

E.update=<bool>

AnswersA, D, E

local determines whether lookup runs on local search head.

Why this answer

The `local=<bool>` parameter in the lookup command specifies whether the lookup should be performed on the search head (local) or distributed across indexers. When set to `true`, the lookup file is read from the search head; when `false`, it is distributed to all indexers, which is critical for performance in large environments.

Exam trap

Splunk often tests the distinction between command-level options (like `lookup` parameters) and standalone commands (like `rename` or `join`), tricking candidates into confusing a command's sub-options with entirely separate SPL commands.

Full explanation →

457

Matchingmedium

Match each Splunk role to its typical permission scope.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Full system access including settings and users

Create and share knowledge objects and run searches

Run searches and create personal knowledge objects

Ability to delete events from indexes

Why these pairings

In Splunk, the User role has basic search and reporting capabilities without system changes, Power User adds knowledge object creation, and Admin has full system and user management access.

Full explanation →

458

MCQhard

Refer to the exhibit. A user runs the search and gets no results. Which is the most likely cause?

A.The 'sort' command must come before 'where'

B.The 'status' field does not exist in the data

C.The 'stats' command cannot be used with 'where'

D.The 'index' parameter is misspelled

AnswerB

If the field is not extracted, 'where' returns no results.

Why this answer

The search returns no results because the 'status' field referenced in the 'where' clause does not exist in the indexed data. In Splunk, the 'where' command filters events based on field values; if the field is absent, no events match the condition, resulting in zero results. The 'stats' command would have created a 'status' field only if it was used with an aggregation function like 'count by status', but the search shows 'stats count' without a 'by' clause, so 'status' remains undefined.

Exam trap

Splunk certification exams often test the misconception that command order (like 'sort' before 'where') is the root cause, when the actual issue is a missing field or incorrect field reference after a transforming command like 'stats'.

How to eliminate wrong answers

Option A is wrong because the 'sort' command can be placed before or after 'where' without affecting results; the issue is not command order but a missing field. Option C is wrong because 'stats' can absolutely be used with 'where' — 'where' filters the results after 'stats' has computed aggregations, which is a valid pattern. Option D is wrong because 'index' is spelled correctly in the exhibit (index=web), and a misspelled index would cause a different error or no data from that index, but the search would still attempt to run; the core problem is the nonexistent 'status' field.

Full explanation →

459

MCQmedium

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

A.| stats count by status | where count > 100

B.| eval count=1 | stats sum(count) by status | where count > 100

C.| stats count as cnt by status | where cnt > 100

D.| where count > 100 | stats count by status

AnswerA, C

Correct: `stats count by status` creates a count per status, then `where count > 100` filters correctly.

Why this answer

It uses `stats count by status` to count events per status code, creating a field named 'count', then filters with `where count > 100`. Option C is also correct, achieving the same result by renaming the count field to 'cnt' before filtering. Both follow the standard Splunk pipeline pattern of aggregating then filtering.

Options B and D are incorrect: B uses an unnecessary `eval` and `sum(count)` which is inefficient; D places `where count > 100` before `stats`, so `count` does not exist yet, causing an error or no filtering.

Exam trap

Splunk often tests the order of operations in the search pipeline, specifically that `where` cannot reference a field created by a later command, leading candidates to incorrectly place the filter before the aggregation.

How to eliminate wrong answers

Option A is wrong because `where count > 100` references a field named `count` that does not exist at that point; `stats count by status` creates a field named `count` only after the stats command, but the `where` clause is applied before stats in the pipeline order, causing an error or no results. Option B is wrong because it unnecessarily uses `eval count=1` and `stats sum(count) by status` instead of the simpler `stats count by status`; while it might produce the same result, it is inefficient and not the correct approach for counting events. Option D is wrong because `where count > 100` is applied before `stats count by status`, meaning it tries to filter on a field that does not exist yet; this will either fail or return no events, and the stats command then counts all remaining events without the intended filter.

Full explanation →

460

MCQhard

A time-based lookup is configured with `max_offset_secs = 3600`. An event has a timestamp 100 seconds after the lookup time value. Will the lookup match?

A.Yes, but only if min_offset_secs is also set.

B.No, because the event timestamp is later than the lookup time.

C.No, because the event timestamp must be before the lookup time.

D.Yes, because the offset is within the allowed range.

AnswerD

The offset of 100 seconds is less than 3600, so it matches.

Why this answer

The time-based lookup is configured with `max_offset_secs = 3600`, which defines the maximum allowed offset (in seconds) between the event timestamp and the lookup time. Since the event timestamp is 100 seconds after the lookup time, the offset is 100 seconds, which is well within the 3600-second window. No `min_offset_secs` is required for this match to succeed, as the default minimum offset is 0 (meaning the event timestamp can be equal to or later than the lookup time).

Exam trap

Splunk often tests the misconception that time-based lookups only work when the event timestamp is before the lookup time, but in reality, the `max_offset_secs` parameter allows events with timestamps after the lookup time, as long as the offset is within the configured range.

How to eliminate wrong answers

Option A is wrong because `min_offset_secs` is not required for a match when the event timestamp is later than the lookup time; the default minimum offset is 0, so the match works without it. Option B is wrong because the event timestamp being later than the lookup time does not prevent a match; the `max_offset_secs` parameter specifically allows events with timestamps after the lookup time, as long as the offset is within the configured range. Option C is wrong because the event timestamp does not need to be before the lookup time; time-based lookups support both forward and backward offsets depending on the configuration of `min_offset_secs` and `max_offset_secs`.

Full explanation →

461

MCQmedium

A user wants to see the values of all fields in an event, including fields that are not automatically extracted. Which search command should be used?

A.`| rex`

B.`| fields *`

C.`| spath`

D.`| table *`

AnswerD

Lists all fields and values.

Why this answer

The `| table *` command displays all fields in each event, including those not automatically extracted, by listing every field in a tabular format. This is because the asterisk wildcard in `table` includes all fields present in the search results, regardless of whether they are extracted by default or through custom parsing. In contrast, `| fields *` only retains fields that are already known to the search index, not necessarily showing all raw event data.

Exam trap

Splunk often tests the misconception that `| fields *` shows all fields, but it actually restricts output to only extracted fields, whereas `| table *` includes all fields including those from raw event data.

How to eliminate wrong answers

Option A is wrong because `| rex` is used to extract fields using regular expressions from raw event data, not to display all fields. Option B is wrong because `| fields *` removes any fields not already extracted or indexed, effectively hiding non-automatically extracted fields. Option C is wrong because `| spath` is designed to extract fields from structured data formats like JSON or XML, not to display all fields in an event.

Full explanation →

462

Multi-Selecthard

A Splunk admin wants to handle missing field values in a search. Which TWO SPL options can replace null values with a specified default? (Choose two.)

Select 2 answers

A.coalesce

B.eval

C.convert

D.fillnull

E.default

AnswersA, D

coalesce returns the first non-null value.

Why this answer

The `fillnull` command explicitly replaces null field values with a specified default string (or '0' if no default is given). The `coalesce` function, used within an `eval` command, returns the first non-null value from a list of fields or expressions, effectively replacing nulls with a fallback default. Both commands directly address missing field values by substituting a specified default.

Exam trap

Splunk often tests the distinction between commands that modify data (like `fillnull`) and functions that operate within `eval` (like `coalesce`), and the trap here is that candidates may incorrectly select `eval` alone or the non-existent `default` command, thinking they handle nulls without needing a specific function.

Full explanation →

463

MCQhard

An analyst needs to find the count of events by source type for each day in the past week, but only for source types with more than 1000 events. Which search is correct?

A.index=* earliest=-7d | bucket _time span=1d | stats count by sourcetype _time | where count>1000

B.index=* earliest=-7d | stats count by sourcetype _time | where count>1000

C.index=* earliest=-7d | timechart count by sourcetype | search count>1000

D.index=* earliest=-7d | timechart count by sourcetype | where count>1000

AnswerA

Correctly buckets and filters after stats.

Why this answer

It uses `bucket _time span=1d` to group events into daily time buckets, then `stats count by sourcetype _time` to count events per source type per day, and finally `where count>1000` to filter for source types exceeding 1000 events per day. The `bucket` command is essential to create discrete daily intervals; without it, `stats count by sourcetype _time` would treat each unique _time value as a separate bucket, which is not the intended daily aggregation.

Exam trap

Splunk often tests the distinction between `bucket` and raw _time grouping, and the misuse of `search` vs `where` for filtering aggregate results, leading candidates to pick options that omit bucket or use `search` incorrectly.

How to eliminate wrong answers

Option B is wrong because it omits the `bucket` command, so `stats count by sourcetype _time` groups by the raw _time field (with sub-second precision), resulting in many tiny buckets that do not represent daily counts, and the `where count>1000` filter would likely return no results or incorrect data. Option C is wrong because `timechart count by sourcetype` automatically creates time buckets (default span depends on time range) but then uses `search count>1000` which is invalid syntax — `search` expects a field-value pair or a keyword, not an aggregation comparison; it would either error or ignore the filter. Option D is wrong because `timechart count by sourcetype` outputs a table with time as rows and sourcetypes as columns, so `where count>1000` references a nonexistent field 'count' (the counts are in columns named after sourcetypes), causing the filter to fail or produce no results.

Full explanation →

464

MCQeasy

A user wants to create a dashboard panel that shows the top 5 most visited web pages. Which report type should be used as the underlying search?

A.stats count by page

B.top 5 page

C.rare 5 page

D.chart count by page

AnswerB

The top command directly returns the most common values.

Why this answer

The 'top' command in Splunk automatically returns the most common values of a field, and the syntax 'top 5 page' directly limits the result to the top 5 pages by count. This is the most straightforward and efficient way to generate a dashboard panel showing the top 5 most visited web pages, as it combines counting and sorting into a single command.

Exam trap

Splunk often tests the distinction between commands that only aggregate ('stats count') versus those that aggregate and limit ('top'), leading candidates to choose 'stats count by page' because they forget that it does not automatically restrict the output to the top N values.

How to eliminate wrong answers

Option A is wrong because 'stats count by page' returns a count for every page but does not sort or limit the results to the top 5, requiring additional piping (e.g., '| sort -count | head 5') to achieve the desired output. Option C is wrong because 'rare 5 page' returns the least common (rarest) pages, which is the opposite of what the user wants (most visited). Option D is wrong because 'chart count by page' produces a tabular or chart-ready output but, like 'stats count by page', does not automatically limit to the top 5 and requires extra steps to sort and truncate.

Full explanation →

465

MCQeasy

A user wants to search only data from the 'security' index. Which search syntax should they use?

A.source=security

B.sourcetype=security

C.host=security

D.index=security

AnswerD

This correctly limits the search to the security index.

Why this answer

In Splunk, the `index` field specifies which index to search, and data is organized into indexes. To restrict a search to data from a specific index, you use `index=<index_name>`. Here, `index=security` tells Splunk to only search events stored in the 'security' index, which is the precise syntax required.

Exam trap

The trap here is that candidates often confuse the `index` field with other common metadata fields like `source`, `sourcetype`, or `host`, because all are used to filter data but refer to entirely different attributes of the event.

How to eliminate wrong answers

Option A is wrong because `source=security` would search for events where the source field (typically a file path or network input) is literally named 'security', not the index. Option B is wrong because `sourcetype=security` would match events with a sourcetype value of 'security', which is a data type classification, not an index. Option C is wrong because `host=security` would filter events originating from a host named 'security', which is a network or machine identifier, not an index.

Full explanation →

466

MCQmedium

A security analyst is investigating a breach and needs to extract the 'user_id' field from raw log events. The logs contain both structured and unstructured data. The analyst uses the following search: `index=security sourcetype=syslog | rex field=_raw "user_id=(?<user_id>\w+)" | stats count by user_id`. However, some events do not contain the 'user_id' pattern, but they have a 'username' field extracted by a default extraction. The analyst wants to create a unified field 'user_id' that includes values from both. Which approach should the analyst take?

A.Rename the 'username' field to 'user_id' using `rename username as user_id`

B.Use `eval user_id=mvindex(split(user_id+" "+username," "),0)` to combine the two fields

C.Use `fillnull value=N/A user_id` to handle missing values

D.Use `eval user_id=coalesce(user_id, username)` to take the first non-null value

AnswerD

`coalesce` returns the first non-null value among the fields, effectively unifying the field.

Why this answer

The `coalesce` function returns the first non-null value from a list of fields, making it ideal for merging `user_id` and `username` into a single unified field. Since `user_id` may be null in events where the regex extraction fails, `coalesce(user_id, username)` will use the `username` value as a fallback, ensuring all events contribute to the `stats count` without data loss.

Exam trap

Splunk often tests the distinction between `coalesce` and `fillnull` or `rename`, where candidates mistakenly choose `fillnull` thinking it fills missing values, but it only replaces nulls with a static value rather than merging from another field.

How to eliminate wrong answers

Option A is wrong because `rename username as user_id` would overwrite any existing `user_id` values with `username`, losing data from events where the regex extraction succeeded. Option B is wrong because `eval user_id=mvindex(split(user_id+" "+username," "),0)` is a convoluted approach that concatenates the two fields with a space and takes the first token, which would produce incorrect results if either field contains spaces or if both fields are present. Option C is wrong because `fillnull value=N/A user_id` only replaces null values with a placeholder string 'N/A', but does not populate `user_id` from the `username` field, so the unified field would still be missing values.

Full explanation →

467

MCQeasy

Which command is used to export the current search results to a CSV file that can be used as a lookup table?

A.outputcsv

B.outputlookup

C.inputlookup

D.lookup

AnswerB

Correct command to create a lookup table from results.

Why this answer

The `outputlookup` command is used to export the current search results to a CSV file that can be used as a lookup table. It writes the results to a lookup definition in Splunk, making the data available for subsequent searches via `inputlookup` or automatic lookup configurations.

Exam trap

The trap here is that candidates confuse `outputcsv` with `outputlookup`, assuming any CSV export can serve as a lookup, but only `outputlookup` properly registers the file as a lookup table in Splunk's lookup definitions.

How to eliminate wrong answers

Option A is wrong because `outputcsv` exports search results to a CSV file, but that file is not automatically registered as a lookup table; it is simply a static file in the Splunk search results directory. Option C is wrong because `inputlookup` is used to read data from an existing lookup table into a search, not to export results. Option D is wrong because `lookup` is used to perform a lookup against a defined lookup table during a search, not to export or create a lookup file.

Full explanation →

468

Multi-Selecthard

Which THREE of the following are valid ways to add a visualization to a dashboard?

Select 3 answers

A.Paste a search query in the dashboard editor.

B.Create a report and then drag it onto the dashboard.

C.Click 'Add Panel' and choose 'New from Search'.

D.Clone an existing panel and edit its search.

E.Upload a CSV file and select visualization type.

AnswersA, C, D

Yes, it creates a new panel.

Why this answer

Pasting a search query directly into the dashboard editor is a standard method for creating a new panel. When you paste a search in the editor, Splunk automatically generates a visualization based on the search results, allowing you to configure the chart type and formatting within the dashboard context.

Exam trap

Splunk often tests the distinction between 'New from Search' (inline search) and 'New from Report' (saved report), and candidates mistakenly think dragging a report onto a dashboard is valid, when in fact you must use the 'Add Panel' workflow.

Full explanation →

469

MCQhard

Refer to the exhibit. What will be the output of this search?

A.The five most frequent error codes

B.The five least frequent error codes

C.Only error codes that appear more than five times

D.All error codes sorted alphabetically

AnswerA

Correct. The search returns the top 5 error codes by count.

Why this answer

The search uses the `top` command, which by default returns the most frequent values of the specified field (`error_code`) in descending order of count, limited to the top 10 results. Since the search explicitly limits the output to 5 with `limit=5`, the result is the five most frequent error codes. This is the standard behavior of the `top` command in Splunk's SPL.

Exam trap

The trap here is that candidates may confuse `top` with `rare` or assume that `top` includes a minimum count filter, when in fact it simply returns the most frequent values up to the specified limit without any threshold.

How to eliminate wrong answers

Option B is wrong because the `top` command returns the most frequent values, not the least frequent; to get the least frequent, you would use the `rare` command. Option C is wrong because the `top` command does not filter by a minimum count threshold; it simply returns the top N values regardless of their count, and there is no `where count > 5` clause in the search. Option D is wrong because the `top` command sorts by frequency (count) in descending order, not alphabetically; alphabetical sorting would require an explicit `sort` command on the field value.

Full explanation →

470

Multi-Selecthard

Which TWO commands can be used to filter events based on field values?

Select 2 answers

A.where

B.lookup

C.fields

D.eval

E.search

AnswersA, E

Where filters events based on boolean expressions.

Why this answer

The `where` command is used to filter events based on field values using Boolean expressions. It evaluates each event against a condition and retains only those events where the condition is true, making it a direct filtering command for field values.

Exam trap

Splunk often tests the distinction between `where` and `eval` because candidates mistakenly think `eval` can filter events, but `eval` only creates or modifies fields without removing any events.

Full explanation →

471

MCQmedium

Refer to the exhibit. The chart shows five series. What is the effect of the useother=f argument?

A.It groups status codes beyond the top 5 into 'Other'

B.It includes all status codes as separate series

C.It sets the timechart to use default colors

D.It limits the chart to exactly 5 series without an 'Other' category

AnswerD

Correct: useother=f ensures no 'Other' group, so only the top 5 are shown.

Why this answer

The `useother=f` argument in a timechart command explicitly disables the automatic grouping of the least significant series into an 'Other' category. By default, timechart limits the number of distinct series displayed (often to 10) and aggregates the rest as 'Other'; setting `useother=f` forces the chart to show exactly the top 5 series as separate lines, with no aggregation. This matches option D, which states the chart is limited to exactly 5 series without an 'Other' category.

Exam trap

The trap here is that candidates often confuse `useother=f` with the default behavior of grouping into 'Other', leading them to select option A, when in fact `useother=f` removes the 'Other' category entirely.

How to eliminate wrong answers

Option A is wrong because `useother=f` disables the 'Other' grouping, not enables it; the default behavior already groups status codes beyond the top 5 into 'Other'. Option B is wrong because `useother=f` does not include all status codes as separate series — it still limits the series count (e.g., to 5) and simply omits the 'Other' bucket, so any series beyond the limit are dropped entirely. Option C is wrong because `useother=f` has no effect on color assignment; color defaults are controlled by the visualization settings or the `use_colors` argument, not by `useother`.

Full explanation →

472

MCQhard

A large enterprise has multiple Splunk indexers and is using data model acceleration to speed up dashboards. The dashboards are slow despite acceleration being enabled. The data model has many root events and child datasets. Which best practice should the administrator consider to improve performance?

A.Use tstats commands on the data model without acceleration.

B.Reduce the number of root events in the data model.

C.Replicate the data model on each indexer to distribute load.

D.Increase the summary range to cover more data.

AnswerB

Fewer root events simplify the acceleration summary, improving build and search performance.

Why this answer

Data model acceleration creates a summary of the data, but the acceleration process must traverse all root events to build the child datasets. If there are too many root events, the acceleration job itself becomes slow and resource-intensive, negating the performance benefit. Reducing the number of root events directly reduces the workload for acceleration, allowing the summaries to be built faster and queries to run against the accelerated data more efficiently.

Exam trap

The trap here is that candidates assume acceleration always improves performance, but they overlook that the acceleration process itself can become a bottleneck if the data model has too many root events, leading them to choose options that increase workload (like increasing summary range) rather than reducing it.

How to eliminate wrong answers

Option A is wrong because using tstats without acceleration would query raw data, which is slower than using accelerated summaries; the question states acceleration is already enabled, so the issue is with the acceleration process itself. Option C is wrong because data model acceleration summaries are stored on the indexers that host the data, and replicating the data model does not distribute the acceleration workload—it would only duplicate storage and increase overhead. Option D is wrong because increasing the summary range would cause the acceleration to cover more time, making the acceleration job even slower and more resource-intensive, not faster.

Full explanation →

473

MCQmedium

A user needs to quickly find a specific event from last week. Which navigation method is most efficient?

A.Use the 'All Fields' button on the left

B.Click on the Timeline histogram to zoom in

C.Set the time range picker to 'Last 7 days' before running the search

D.Search without a time range, then use Smart Mode

AnswerC

Pre-filtering time reduces result set and speeds up search.

Why this answer

Setting the time range picker to 'Last 7 days' before running the search is the most efficient way to narrow the dataset to the relevant period. This pre-filtering reduces the index scan to only events within that window, minimizing search time and resource consumption. It directly targets the user's need to find a specific event from last week without requiring post-hoc adjustments.

Exam trap

The trap here is that candidates may think Splunk's Timeline histogram or Smart Mode are efficient for narrowing down results, but they fail to recognize that setting the time range before the search is the most efficient method because it limits data retrieval at the index level, not after results are returned.

How to eliminate wrong answers

Option A is wrong because the 'All Fields' button on the left displays field names and values from the search results, but it does not help locate a specific event by time; it is a post-search analysis tool, not a navigation method. Option B is wrong because clicking on the Timeline histogram to zoom in is a post-search action that refines the view of already retrieved results, but it does not reduce the initial search scope, making it less efficient for finding a specific event from last week. Option D is wrong because searching without a time range defaults to 'All time', which can return a massive dataset and slow down the search; Smart Mode only adjusts the search mode (e.g., verbose vs. fast) after results are returned, not the time range, so it does not efficiently narrow down to last week's events.

Full explanation →

474

MCQhard

An organization is ingesting web proxy logs and wants to enrich them with a lookup table that maps internal IP addresses to employee names. The lookup table is updated weekly. Which configuration ensures the lookup is automatically applied to all searches without manual intervention, while also minimizing performance impact?

A.Create a macro that includes the 'lookup' command and share it with users.

B.Upload the lookup file each week and manually run a search to add the field.

C.Use the 'lookup' command in every search to fetch the employee name.

D.Configure an automatic lookup in props.conf and transforms.conf.

AnswerD

Automatic lookups are applied at search time to all matching events without manual effort.

Why this answer

Configuring an automatic lookup in props.conf and transforms.conf allows the lookup to be applied at search time without requiring users to manually invoke the lookup command. This configuration minimizes performance impact by leveraging indexed field values and caching, and it ensures the lookup is automatically applied to all searches as soon as the lookup file is updated weekly.

Exam trap

The trap here is that candidates often confuse automatic lookups with the 'lookup' command or macros, thinking that any automated approach requires user action, when in fact props.conf/transforms.conf provide true automatic application without manual intervention.

How to eliminate wrong answers

Option A is wrong because a macro still requires users to explicitly invoke it in their searches, which does not achieve automatic application without manual intervention. Option B is wrong because manually uploading the lookup file and running a search each week is not automated and introduces significant manual overhead and performance impact. Option C is wrong because using the 'lookup' command in every search requires users to remember to include it, which is not automatic and can degrade performance if the lookup is large or used frequently without caching.

Full explanation →

475

MCQmedium

An analyst needs to count the number of distinct IP addresses that accessed a server. Which approach is most efficient?

A.| stats count by src_ip

B.| dedup src_ip | stats count

C.| stats dc(src_ip)

D.| fields src_ip | sort | uniq

AnswerC

The `| stats dc(src_ip)` command correctly uses the distinct count function to compute the number of unique src_ip values in one efficient pass.

Why this answer

`| stats dc(src_ip)` uses the `dc()` (distinct count) function to directly calculate the number of unique IP addresses in a single pass over the data. This is the most efficient approach as it avoids creating intermediate events or performing separate deduplication steps, leveraging Splunk's streaming stats for minimal memory and CPU overhead.

Exam trap

The trap here is that candidates often confuse `count` with `dc()` or think `dedup` is the standard way to count unique values, not realizing that `dc()` is purpose-built for efficient distinct counting in Splunk.

How to eliminate wrong answers

Option A is wrong because `| stats count by src_ip` returns a count of events per IP address, not the number of distinct IPs, requiring additional post-processing to get the distinct count. Option B is wrong because `| dedup src_ip | stats count` first removes duplicate events based on src_ip, which is less efficient than using `dc()` as it materializes all unique events in memory before counting, and can be slower on large datasets. Option D is wrong because `| fields src_ip | sort | uniq` is a multi-command pipeline that is inefficient and relies on the `uniq` command, which is not a native Splunk command (it is a Unix command not available in Splunk's search language), and it also sorts all events unnecessarily.

Full explanation →

476

MCQmedium

Refer to the exhibit. A user runs this search and gets 10 results as expected. However, they want to see the top 10 hosts for the past week. The search still returns results, but the counts are lower than expected. What is the most likely reason?

A.The time range is set to the past 24 hours by default.

B.The sort command is not needed.

C.The head command restricts results.

D.The stats command counts all time.

AnswerA

Default time range is Last 24 hours, not All time.

Why this answer

By default, Splunk searches are restricted to the last 24 hours (unless a different time range is explicitly selected). Even though the user expects results for the past week, the search is only looking at the most recent 24 hours of data. This causes the counts to be lower than expected because events from earlier in the week are not included.

Exam trap

Splunk often tests the default time range behavior, where candidates assume the search will automatically cover the entire dataset or the time range implied by the search logic, but Splunk restricts results to the last 24 hours unless the time picker is changed.

How to eliminate wrong answers

Option B is wrong because the sort command is not the issue; it is correctly used to order the results by count, and removing it would not fix the time range problem. Option C is wrong because the head command is correctly used to limit the output to the top 10 results; it does not affect the time range of the search. Option D is wrong because the stats command does not count all time; it only processes events within the currently selected time range, which defaults to the past 24 hours.

Full explanation →

477

Multi-Selectmedium

Which two tabs are always present in the search results page? (Select TWO)

Select 2 answers

A.Visualization

B.Patterns

C.Events

D.Statistics

E.Fields

AnswersC, D

Always present to show raw events.

Why this answer

The Events and Statistics tabs are always present on the search results page because they represent the two fundamental views of search results: the raw event data (Events) and the tabular summary of statistical calculations (Statistics). Even if a search does not produce events or statistics, these tabs remain visible as placeholders, ensuring consistent navigation.

Exam trap

The trap here is that candidates often confuse the always-present tabs (Events and Statistics) with commonly seen but conditional tabs like Visualization or Patterns, assuming they are permanent because they appear frequently in typical searches.

Full explanation →

478

Multi-Selectmedium

Which three of the following are valid methods for creating or using field extractions in Splunk? (Choose three.)

Select 3 answers

.Using the Field Extractor (FX) interactive tool to generate regex-based extractions

.Manually writing a regular expression in props.conf and transforms.conf

.Using the `| extract` command in a search to perform key-value pair extraction

.Using the `| fields` command to extract new fields from raw data

.Configuring automatic field extraction via the `fieldaliases.conf` file

.Using the `| rename` command to create new fields by renaming existing ones

Why this answer

The Field Extractor (FX) interactive tool is a valid method because it provides a GUI to generate regex-based extractions by highlighting sample data. Manually writing regular expressions in `props.conf` and `transforms.conf` is the standard way to define custom field extractions at the index-time or search-time level. The `| extract` command is valid because it performs key-value pair extraction on search results, typically for data formatted as `key=value` pairs, without requiring configuration files.

Exam trap

Full explanation →

479

MCQhard

Refer to the exhibit. A security analyst runs a search to identify HTTP 500 errors over time. Which time period shows the highest count of 500 errors?

A.00:00:00 - 01:00:00

B.01:00:00 - 02:00:00

C.03:00:00 - 04:00:00

D.04:00:00 - 05:00:00

AnswerD

Count is 89, the highest.

Why this answer

The exhibit shows the highest count of HTTP 500 errors occurring between 04:00:00 and 05:00:00, with a count of 89. This is determined by comparing the values for each hourly bucket: A: 23, B: 45, C: 67, D: 89. The highest value is 89, corresponding to the 04:00-05:00 time period.

Exam trap

The trap is that candidates may misread the time axis or the bar values, especially if the chart has a log scale or if the labels are truncated. They might pick a visually similar bar but with a lower count, failing to accurately compare the numeric values.

How to eliminate wrong answers

Option A is wrong because the time period 00:00:00 - 01:00:00 shows a count of 800 errors, which is lower than the peak. Option B is wrong because 01:00:00 - 02:00:00 shows a count of 600 errors, which is not the highest. Option C is wrong because 03:00:00 - 04:00:00 shows a count of 900 errors, which is still less than the 1,200 errors in the 04:00:00 - 05:00:00 period.

Full explanation →

480

MCQmedium

A dashboard includes a form input that allows users to select a user. After selecting a user, a panel should show that user's activity. Which dashboard feature is required?

A.Post-process searches

B.Tokens

C.Drilldown

D.Link to report

AnswerB

Tokens capture and propagate user input to panel searches.

Why this answer

Tokens store the selected value and pass it to search queries, enabling dynamic panel updates.

Full explanation →

481

MCQmedium

A Splunk administrator is reviewing the 'Add Data' wizard for a new data source. The admin wants to monitor a log file that is located on the same server where Splunk is installed. The admin navigates to Settings > Add Data and selects 'Monitor' and then 'Files & Directories'. In the file list, the admin sees a checkbox next to each file. The admin selects the desired file and clicks 'Next'. However, the wizard does not proceed to the next page; instead, nothing happens. The admin has confirmed that the file exists and is readable. What is the most likely cause?

A.The admin's Splunk Web session has timed out.

B.The admin did not select a source type for the file.

C.The file is already being monitored by another input.

D.The file is too large and Splunk is processing it.

AnswerA

Correct: A long idle session may need re-login.

Why this answer

The most likely cause is that the admin's Splunk Web session has timed out. When a session expires, UI interactions such as clicking 'Next' may become unresponsive without any error message. The admin should refresh the page and log in again.

Option B is incorrect because a source type is not required to proceed; the wizard defaults to automatic source type. Option C is incorrect because if the file were already monitored, Splunk would display a warning rather than silently failing to advance. Option D is incorrect because file size does not prevent clicking 'Next'; Splunk handles large files in the background.

Full explanation →

482

MCQhard

Refer to the exhibit. An admin sees that the Web_Traffic data model is accelerated but shows 'Summaries require rebuild'. What does this status indicate?

A.The disk space for acceleration is full.

B.The summary range is too short and needs to be extended.

C.The acceleration summaries are up to date and optimal.

D.The data model definition has been modified and acceleration needs to be rebuilt.

AnswerD

Changes to the model require rebuilding summaries.

Why this answer

When a data model is accelerated and shows 'Summaries require rebuild', it indicates that the data model definition has been modified (e.g., fields, constraints, or root events changed) since the last summary build. Splunk detects this change and marks the acceleration summaries as stale, requiring a rebuild to ensure query results reflect the updated definition. This is a built-in mechanism to maintain data integrity between the model and its accelerated summaries.

Exam trap

Splunk often tests the distinction between 'Summaries require rebuild' (caused by definition changes) and other acceleration issues like disk space or range problems, so candidates mistakenly attribute the status to resource constraints or misconfigured ranges.

How to eliminate wrong answers

Option A is wrong because disk space full would cause acceleration to stop or fail with a 'disk full' error, not a 'Summaries require rebuild' status. Option B is wrong because a summary range that is too short would cause incomplete coverage or missing data, but the status message specifically indicates a definition change, not a range issue. Option C is wrong because 'up to date and optimal' would show a 'Summaries are up to date' or 'Green' status, not a rebuild requirement.

Full explanation →

483

MCQhard

A Splunk admin notices that a dashboard panel using `timechart` is showing gaps (null values) for some time periods where no events exist. The admin wants to display a zero instead of null to make the chart continuous. Which command should be added before `timechart`?

A.`timechart useother=t`

B.`eventstats`

C.`makecontinuous`

D.`fillnull`

AnswerD

`fillnull` replaces null values with a specified value, typically used after aggregation like `timechart`.

Why this answer

`fillnull`, is correct because it explicitly replaces null values with a specified value (default 0) in the results of a transforming command. In Splunk, `fillnull` is used after commands like `timechart` to fill gaps where no events exist. The question asks which command should be added "before `timechart`", but in practice, `fillnull` is placed after `timechart`.

However, among the given choices, only `fillnull` can achieve the desired outcome. Option A (`timechart useother=t`) is unrelated to null filling. Option B (`eventstats`) does not replace nulls.

Option C (`makecontinuous`) creates time buckets for missing periods but does not fill the null values; it leaves them as null or adds null events. Therefore, `fillnull` is the correct command to use in conjunction with `timechart` to display zeros instead of nulls.

Exam trap

The trap here is that candidates often confuse `makecontinuous` (which fills missing time buckets with null events) with `fillnull` (which replaces null values with zeros), and may incorrectly think `makecontinuous` alone solves the problem, but it only creates the buckets—not the zero values.

How to eliminate wrong answers

Option A is wrong because `timechart useother=t` groups rare values into an 'Other' category, but does not fill null values or address gaps in time series. Option B is wrong because `eventstats` computes statistics over all events without splitting by time, and cannot fill null values in a timechart output. Option C is wrong because `makecontinuous` fills gaps in a time series by generating events for missing time buckets, but it does not replace null values with zeros—it creates null events that still require `fillnull` to convert to zero.

Full explanation →

484

MCQmedium

An analyst wants to compute the average response time for each server from web server logs. The field `response_time` is a string like '120ms'. What is the correct way to convert and compute?

A.eval response_time=response_time + "0" | stats avg(response_time) by server

B.eval response_num=replace(response_time, "ms", "") | eval response_num=response_num*1 | stats avg(response_num) by server

C.eval response_num=replace(response_time, "ms", "") | stats avg(response_num) by server

D.eval avg_response=avg(response_time)

AnswerB

Replace removes 'ms', and multiplying by 1 converts to numeric, then avg works.

Why this answer

It first uses `replace` to strip the 'ms' suffix from the string field `response_time`, then multiplies the resulting string by 1 (`response_num*1`) to coerce it into a numeric type. Only after conversion can `stats avg(response_num) by server` compute a meaningful average. Without the numeric coercion, Splunk would treat the field as a string and either fail or produce incorrect results.

Exam trap

The trap here is that candidates assume `replace` alone makes a field numeric, forgetting that Splunk treats the result as a string until an explicit arithmetic operation (like `*1` or `tonumber()`) forces type conversion.

How to eliminate wrong answers

Option A is wrong because appending '0' to a string like '120ms' yields '120ms0', which is still a string and cannot be averaged numerically. Option C is wrong because although it strips 'ms', it does not convert the resulting string to a number; `avg()` on a string field either fails or treats each value as 0. Option D is wrong because `avg(response_time)` directly on a string field is invalid — Splunk cannot compute an average of non-numeric values and will return null or an error.

Full explanation →

485

MCQmedium

After running a search, an analyst notices that useful fields are not appearing in the 'Selected Fields' section. What is the most likely reason?

A.The user has manually hidden those fields in the field sidebar.

B.The search is using a transforming command that suppresses field display.

C.The fields are not extracted or indexed in the data.

D.The time range is too wide, causing field extraction to be incomplete.

AnswerC

Fields are only available if they are extracted or indexed.

Why this answer

Fields appear in the 'Selected Fields' section only if they have been extracted and indexed from the raw data. If the data source does not contain the expected field-value pairs, or if no field extraction (such as from a props.conf or a search-time extraction) has been configured, Splunk will not populate those fields. This is the most common cause of missing fields in the interface.

Exam trap

The trap here is that candidates often confuse the 'Selected Fields' section with the 'Interesting Fields' section, or assume that a transforming command like 'stats' hides fields, when in fact the root cause is that the fields were never extracted from the raw data.

How to eliminate wrong answers

Option A is wrong because manually hiding fields in the field sidebar only affects the display of already extracted fields; it does not prevent fields from appearing in the 'Selected Fields' section if they exist. Option B is wrong because transforming commands (e.g., stats, chart, timechart) do not suppress field display; they aggregate data and may change the result set, but the underlying extracted fields remain available in the field sidebar. Option D is wrong because a wide time range does not cause incomplete field extraction; field extraction is based on the data's structure and configuration, not on the time range's breadth.

Full explanation →

486

MCQmedium

An organization needs to enrich authentication events with employee department information stored in a MySQL database. The data is updated frequently. Which lookup type is most appropriate?

A.External lookup

B.Geographic lookup

C.CSV file lookup

D.KV store lookup

AnswerA

Correct. External lookups can run scripts or use DB Connect to query a MySQL database at search time, making them ideal for frequently updated data from an external data source.

Why this answer

An external lookup is the most appropriate choice for enriching authentication events with data from a MySQL database that is updated frequently. External lookups can execute a script or command (e.g., Python, Perl) that queries the database on every search, or they can be used with Splunk DB Connect to directly connect to MySQL and retrieve fresh data. Unlike KV Store lookups, which rely on manually populating Splunk's internal store and do not natively connect to external databases, external lookups provide real-time access to the live database.

CSV lookups are static and require manual reloading, and geographic lookups are for geospatial data only.

Exam trap

The trap here is that candidates often choose CSV file lookup (Option C) because it is the simplest and most familiar lookup type, failing to recognize that it cannot handle frequently updated data without manual reloading or scheduled scripts, whereas the KV Store is designed for dynamic, real-time updates.

How to eliminate wrong answers

Option A is wrong because an external lookup relies on an external script or command to retrieve data, which introduces latency and complexity for frequently updated data, and it does not natively support bidirectional updates like the KV Store. Option B is wrong because a geographic lookup is specifically designed for mapping IP addresses or coordinates to geographic locations, not for enriching authentication events with employee department information from a database. Option C is wrong because a CSV file lookup is static and requires manual reloading or a scheduled script to reflect changes, making it unsuitable for frequently updated data that needs real-time enrichment.

Full explanation →

487

MCQeasy

Refer to the exhibit. A user reports they cannot log in to Splunk Web and sees this error in the logs. What is the most likely cause?

A.The user typed an incorrect username or password.

B.The user's session has expired or the CSRF token is invalid.

C.The Splunk indexer is not responding.

D.The user ran too many searches and hit a limit.

AnswerB

CSRF token validation is session-related.

Why this answer

The error message indicates an invalid CSRF token or expired session, which is a security mechanism in Splunk Web that prevents cross-site request forgery. When a session expires or the CSRF token is invalid, the user cannot authenticate or maintain their session, leading to a login failure. This is distinct from incorrect credentials, which would produce a different error.

Exam trap

The trap here is that candidates often confuse authentication errors (wrong password) with session/CSRF token errors, but Splunk logs distinct error messages for each, and this question tests the ability to interpret the specific log entry rather than assuming a generic login failure.

How to eliminate wrong answers

Option A is wrong because an incorrect username or password would generate a specific 'Login failed' error, not a CSRF token or session expiration error. Option C is wrong because an unresponsive indexer would cause search or data ingestion issues, not a login failure at the web interface level. Option D is wrong because hitting a search limit would result in a 'Too many concurrent searches' or resource quota error, not a session or CSRF token error.

Full explanation →

488

MCQmedium

An administrator notices that a data model is not appearing in the Pivot interface. What is a possible reason?

A.The data model is not shared with the user's role.

B.The data model acceleration is disabled.

C.The data model contains errors in field definitions.

D.The data model has no root datasets.

AnswerA

Data models must be shared to be visible in Pivot.

Why this answer

The Pivot interface only displays data models that have been explicitly shared with the user's role via permissions. If the data model is not shared, it will not appear in the Pivot editor, regardless of its internal validity or acceleration status. This is a core access control mechanism in Splunk.

Exam trap

The trap here is that candidates often confuse functional issues (like acceleration or field errors) with visibility/permission issues, assuming a data model must be broken to be missing from the Pivot interface.

How to eliminate wrong answers

Option B is wrong because disabling data model acceleration only affects performance (e.g., faster pivot queries via summary indexing), not the visibility of the data model in the Pivot interface. Option C is wrong because errors in field definitions may cause pivot queries to fail or return incorrect results, but the data model will still appear in the Pivot interface as long as it is valid enough to be saved. Option D is wrong because a data model without root datasets cannot be saved or created; if it exists, it must have at least one root dataset, so this would not be a reason for it not appearing.

Full explanation →

489

MCQhard

Refer to the exhibit. What does this configuration do?

A.It creates a new sourcetype

B.It clears the host field

C.It enables SSL for the sourcetype

D.It sets the host field based on IP using a transform

AnswerD

The transform name suggests setting host from IP.

Why this answer

This props.conf stanza applies a transform named 'set_host_from_ip' to all events of sourcetype 'my_sourcetype'. Transforms typically modify field values; this one sets the host field based on the source IP.

Full explanation →

490

MCQeasy

A user notices that a calculated field defined in props.conf is not appearing in search results. Which of the following is the most likely cause?

A.The calculated field requires index-time field extraction.

B.The source fields used in the calculation are not extracted.

C.The calculated field is defined in a field alias configuration.

D.The indexer is not configured to apply calculated fields.

AnswerB

Calculated fields depend on source fields being available.

Why this answer

Calculated fields in Splunk are evaluated at search time based on existing extracted source fields. If the source fields referenced in the calculation are not extracted (e.g., due to missing or incorrect field extraction configurations), the calculated field will not appear in search results. Option B correctly identifies this dependency.

Exam trap

The trap here is that candidates often confuse calculated fields with index-time field extractions or field aliases, assuming the issue is with indexing or alias configuration rather than the fundamental dependency on source field extraction.

How to eliminate wrong answers

Option A is wrong because calculated fields are search-time constructs, not index-time; they do not require index-time field extraction. Option C is wrong because a calculated field is defined in props.conf under the [EVAL-<fieldname>] stanza, not in a field alias configuration (which uses [fieldalias] in transforms.conf). Option D is wrong because calculated fields are applied by the search head during search-time processing, not by the indexer; indexers handle indexing and raw data storage, not calculated field evaluation.

Full explanation →

491

Multi-Selecteasy

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Select 3 answers

A.Save as alert

B.Save as event type

C.Save as search macro

D.Save as report

E.Save as dashboard panel

AnswersA, D, E

Creates an alert based on the search.

Why this answer

The 'Save As' menu in the Search app provides direct options to persist search results as an alert, a report, or a dashboard panel. 'Save as alert' (A) creates a scheduled search that triggers actions when conditions are met, which is a core feature for proactive monitoring.

Exam trap

Splunk often tests the distinction between actions available directly from the search results interface versus those requiring navigation to Settings, leading candidates to mistakenly select 'event type' or 'search macro' as valid 'Save As' options.

Full explanation →

492

MCQmedium

Refer to the exhibit. A data model named 'Web' is built on sourcetype 'web_access'. A user reports that the timestamp field is not being extracted correctly in the data model. What is the most likely issue?

A.The TIME_PREFIX is set to `^` which may not match the timestamp location.

B.The DATETIME_CONFIG file is missing.

C.The TIME_FORMAT does not match the data.

D.The MAX_TIMESTAMP_LOOKAHEAD is too high.

AnswerA

A caret `^` matches the start of the event, but timestamps often appear later.

Why this answer

The TIME_PREFIX set to `^` anchors the timestamp extraction to the very beginning of the event. If the actual timestamp appears later in the event (e.g., after a leading field like an IP address or a date), this prefix will fail to match, causing Splunk to fall back to the event's ingestion time or extract no timestamp at all. In a data model, timestamp extraction relies on the same props.conf settings as search-time field extraction, so an incorrect TIME_PREFIX directly breaks the expected timestamp field.

Exam trap

A common pitfall in Splunk exams is overlooking that the TIME_PREFIX setting can be too restrictive. Candidates often assume a missing DATETIME_CONFIG or incorrect TIME_FORMAT is the root cause, but in data models, an incorrectly anchored TIME_PREFIX (like `^`) frequently prevents proper timestamp extraction from events where the timestamp is not at the very beginning.

How to eliminate wrong answers

Option B is wrong because a missing DATETIME_CONFIG file would cause Splunk to use its default timestamp extraction rules, which often still work; it is not the most likely issue when a specific TIME_PREFIX is explicitly set. Option C is wrong because the TIME_FORMAT not matching the data would typically produce a different symptom (e.g., timestamp not parsed at all or showing as 'null'), but the question states the timestamp is 'not being extracted correctly', which points to a prefix mismatch rather than a format mismatch. Option D is wrong because a MAX_TIMESTAMP_LOOKAHEAD that is too high would not prevent extraction; it would only cause Splunk to look further into the event for a timestamp, potentially matching a wrong one, but it would not cause a complete failure to extract the timestamp field.

Full explanation →

493

MCQhard

A financial services company uses Splunk to monitor authentication logs from 500 remote servers. They created a data model named 'Authentication' with 15 fields including 'user', 'src_ip', 'dest_ip', 'action', and 'status'. They enabled acceleration with a summary range of 1 day and set the maximum search time range to 30 days. After one month of operation, searches against the data model that used to complete in seconds now time out after 60 seconds. The average daily log volume is 10 GB. The admin runs | datamodel Audit and discovers that the summary size is approximately 5 GB per day, which is similar to the raw data index size. The search head has 16 GB RAM and 4 CPU cores, and no other resource issues are observed. What is the most likely cause of the performance degradation?

A.Optimize the underlying searches by using indexed field extractions instead of search-time field extractions.

B.Increase the summary range from 1 day to 7 days to reduce the number of summaries.

C.Review the data model fields and remove high-cardinality fields from the acceleration or the data model itself.

D.Reduce the number of fields in the data model to fewer than 10 to improve acceleration efficiency.

AnswerC

High-cardinality fields prevent effective summarization, causing summary size to approach raw data size.

Why this answer

When the summary size is nearly equal to the raw data volume, it indicates that acceleration is not effectively reducing the data. This typically occurs when the data model includes high-cardinality fields (e.g., 'user', 'src_ip', 'dest_ip') that create too many unique combinations, preventing meaningful summarization. As a result, the acceleration summary remains large, causing searches to time out due to I/O overhead.

Option A is incorrect because increasing the summary range would further increase the summary size and worsen performance. Option B is incorrect because search-time vs. indexed extractions do not address the root cause of high cardinality. Option D is incorrect because the number of fields alone is not the issue; it is the high cardinality of specific fields that degrades acceleration efficiency.

Full explanation →

494

MCQeasy

Refer to the exhibit. A Splunk user is building a data model for Apache error logs. The configuration above extracts an error_type field. However, when previewing data in the data model, the error_type field is not available. What is the most likely cause?

A.The regular expression in transforms.conf is incorrectly formatted.

B.The transforms.conf is in the wrong app context.

C.The transform name in props.conf does not match the transform name in transforms.conf.

D.The DEST_KEY is set to _meta, which does not make the field available for data models.

AnswerD

_meta stores the value in internal metadata, not as an indexed or search-time field.

Why this answer

When DEST_KEY is set to _meta, the extracted field is stored in the internal metadata of the event rather than in the event's indexed fields. Data models rely on indexed fields that are part of the event's key-value structure, so fields stored in _meta are not accessible for data model field extraction or preview.

Exam trap

The trap here is that candidates assume any extracted field is automatically available to data models, but Splunk requires fields to be indexed or written to the event's key-value store, not hidden in metadata like _meta.

How to eliminate wrong answers

Option A is wrong because if the regex were incorrectly formatted, the field would simply not be extracted at all, but the question states the field is extracted yet unavailable in the data model, so the regex is likely correct. Option B is wrong because the app context of transforms.conf only affects whether the configuration is loaded, not whether an extracted field is visible to data models; if it were in the wrong context, the field wouldn't be extracted at all. Option C is wrong because a mismatch between transform names would prevent extraction entirely, resulting in no field being created, whereas the field is extracted but not available in the data model.

Full explanation →

495

MCQhard

A newly created dashboard panel is not displaying data, showing only 'No results found'. The search query works correctly in the Search app. What is the most likely cause?

A.The dashboard has not been shared with the user's role.

B.The search contains a syntax error that is not caught by the dashboard editor.

C.The dashboard's time range picker is set to a different range than the search was tested with.

D.The panel is not based on a saved report.

AnswerC

Time range mismatch is a common cause of 'No results' in dashboard panels.

Why this answer

The most common reason a dashboard panel shows 'No results found' despite the search working in the Search app is a mismatch in the time range. The dashboard's time range picker may be set to a different absolute or relative time (e.g., 'Last 15 minutes' vs. 'All time') than the search was tested with, causing the query to return no events within the dashboard's time boundary.

Exam trap

Splunk often tests the misconception that 'No results found' is caused by a search syntax error or permission issues, when the real culprit is the dashboard's time range picker overriding the search's time context.

How to eliminate wrong answers

Option A is wrong because dashboard sharing permissions affect visibility of the dashboard itself, not the data within a panel; if the user can see the dashboard but the panel shows 'No results found', it is not a sharing issue. Option B is wrong because if the search query works correctly in the Search app, there is no syntax error; the dashboard editor does not introduce additional syntax validation that would cause a working query to fail. Option D is wrong because a dashboard panel does not need to be based on a saved report; inline searches work perfectly and the absence of a saved report does not cause 'No results found'.

Full explanation →

496

Multi-Selecthard

Which THREE of the following are standard components of the Splunk Web Search interface? (Choose three.)

Select 3 answers

A.Commands bar

B.Field sidebar

C.Timeline

D.Job Inspector

E.Search bar

AnswersB, C, E

Correct: The field sidebar shows extracted fields.

Why this answer

The Field sidebar (B) is a standard component of the Splunk Web Search interface that displays extracted fields from search results, allowing users to click on field values to refine searches. It is always present by default in the Search & Reporting app, providing immediate access to field discovery and filtering without additional configuration.

Exam trap

Splunk often tests the distinction between persistent interface components (like the Field sidebar, Timeline, and Search bar) and auxiliary tools (like the Job Inspector or Commands bar) that are accessed through menus or context actions, leading candidates to overcount or misidentify standard elements.

Full explanation →

497

MCQmedium

An administrator notices that a user's search is timing out after 60 seconds. The search needs up to 5 minutes to complete. What should the administrator do?

A.Reduce the time range of the search to run faster.

B.Adjust the 'Search Results Retention' in the user's account preferences.

C.Change the search to a real-time search to avoid timeout.

D.Increase the 'Search Timeout' setting in system settings.

AnswerD

Increasing the 'Search Timeout' in system settings extends the maximum runtime for search jobs, allowing the 5-minute search to finish without timing out.

Why this answer

The 'Search Timeout' setting under Settings > System settings controls the maximum time a search job can run before being terminated. By default it is 60 seconds; increasing it to 5 minutes allows the search to complete. Option B is incorrect because 'Search Results Retention' in account preferences controls how long completed results are saved, not the timeout for running searches.

Exam trap

The trap is that there is a user-level 'Search Results Retention' setting that sounds related, but it only affects how long finished results are kept. The correct setting is the global 'Search Timeout' under system settings, which directly extends the runtime limit for all users.

How to eliminate wrong answers

Option A is wrong because reducing the time range may not address the underlying issue if the search inherently requires up to 5 minutes to process the necessary data; it could also produce incomplete results. Option C is wrong because real-time searches do not have a timeout in the same way, but they continuously run and consume resources, and changing to real-time does not solve the timeout problem for a historical search that needs 5 minutes. Option D is wrong because there is no 'Search Timeout' setting in system settings; the timeout is controlled per user via the 'Search Results Retention' preference, not a global system parameter.

Full explanation →

498

Multi-Selecteasy

Which TWO of the following are valid ways to navigate from a search result to a dashboard?

Select 2 answers

A.Drag a field from the Fields sidebar to the dashboard canvas.

B.Click the 'Dashboard' button on the search bar.

C.Click 'Open in Dashboard' from the search actions menu (ellipsis).

D.Save the search as a report, then add the report to a dashboard panel.

E.Right-click on the timeline and select 'Open in Dashboard'.

AnswersC, D

Available if user has permissions and using Dashboards feature.

Why this answer

Clicking 'Open in Dashboard' from the search actions menu (ellipsis) directly converts the current search results into a dashboard panel, allowing you to immediately add the visualization to a new or existing dashboard. This is a built-in Splunk navigation feature that streamlines the workflow from ad-hoc search to persistent dashboard content.

Exam trap

The trap here is that candidates may confuse the 'Open in Dashboard' option with a hypothetical 'Dashboard' button on the search bar, or assume that right-clicking the timeline provides dashboard navigation, when in fact only the search actions menu and the report-to-dashboard workflow are valid methods.

Full explanation →

499

MCQhard

Refer to the exhibit. What will be the output of this search?

A.All productId values sorted alphabetically

B.ProductId values with count=0

C.The top 10 productId values based on event count

D.The productId and its count for the 10 product IDs with the highest event counts

AnswerD

The search exactly produces that result.

Why this answer

The search uses the `top` command, which by default returns the 10 most frequent values of the specified field (`productId`) based on event count, along with their counts. Option D correctly describes this output: the `productId` and its count for the 10 product IDs with the highest event counts.

Exam trap

Splunk often tests the distinction between `top` returning only the field values versus returning both the field values and their counts, leading candidates to choose Option C when the correct answer is D.

How to eliminate wrong answers

Option A is wrong because the `top` command does not sort alphabetically; it sorts by count in descending order. Option B is wrong because `top` returns values with the highest counts, not count=0; values with zero count are not returned. Option C is wrong because while `top` does return the top 10 based on event count, it also includes the count for each value, not just the productId values alone.

Full explanation →

500

MCQmedium

An analyst runs `| inputlookup mylookup.csv` but gets no results. The lookup file exists. What is the most likely cause?

A.The file is not in the correct lookup directory.

B.The search time range is too narrow.

C.The lookup command requires an output fields.

D.The file is not sorted.

AnswerA

The file must be in the lookup directory specified in props.conf or the default lookups folder.

Why this answer

The `| inputlookup` command reads lookup files only from the lookups directory within the current app or from the system-level lookups directory. If the file exists elsewhere on the filesystem (e.g., in a custom path or the user's home directory), the command will return no results. This is the most likely cause because the error is not about the file's existence but about its location relative to Splunk's expected lookup paths.

Exam trap

Splunk often tests the misconception that `| inputlookup` works like a standard file read command, leading candidates to overlook the strict directory requirement and instead blame time range or file formatting issues.

How to eliminate wrong answers

Option B is wrong because `| inputlookup` does not depend on the search time range; it loads the entire static lookup file regardless of time. Option C is wrong because `| inputlookup` does not require an `outputfields` argument; it returns all fields in the lookup file by default. Option D is wrong because lookup files do not need to be sorted for `| inputlookup` to work; sorting is only relevant for certain lookup operations like `| lookup` with `max_matches` or performance optimizations, not for basic file loading.

Full explanation →

501

Multi-Selectmedium

A user wants to find events where the status code is 500 or 503 and the response time is greater than 2 seconds. Which TWO SPL commands will correctly limit the results to only these events?

Select 2 answers

A.status=500,503 AND response_time>2

B.search status=500 OR status=503 response_time>2

C.status=500 OR status=503 | where response_time>2

D.search (status=500 OR status=503) AND response_time>2

E.status IN (500,503) | where response_time>2

AnswersD, E

This correctly groups the OR conditions and applies the AND operator.

Why this answer

It uses the `search` command with explicit parentheses to group the OR conditions, ensuring the logical AND with `response_time>2` applies to the entire set of status codes. This matches the requirement to find events where status is 500 or 503 AND response time exceeds 2 seconds.

Exam trap

Splunk often tests the misconception that commas can substitute for OR operators in SPL, or that omitting parentheses in a mixed AND/OR expression will still yield correct results due to assumed left-to-right evaluation.

Full explanation →

502

MCQeasy

A user wants to quickly see the count of events per source type over the last hour without performing a search. Which Splunk Web feature provides this information with the fewest clicks?

A.Click the Field sidebar in the Search app.

B.Navigate to Settings > Data Inputs to view event counts.

C.Use the Data Summary page on the Splunk Home page.

D.Use the Search & Reporting app and run a search with | stats count by sourcetype.

AnswerC

Correct: Data Summary provides quick event counts per source type.

Why this answer

The Data Summary page on the Splunk Home page provides a quick, pre-computed overview of event counts per source type, host, and source for the last hour without requiring a search. This feature is designed for rapid data exploration with minimal clicks, making it the most efficient option for this task.

Exam trap

The Splunk exam often tests the distinction between features that require a search (like the Search & Reporting app or Field sidebar) and those that provide pre-computed summaries (like the Data Summary page), leading candidates to incorrectly choose a search-based option when the question explicitly states 'without performing a search'.

How to eliminate wrong answers

Option A is wrong because the Field sidebar in the Search app shows field values and statistics only after a search has been executed, not without performing a search. Option B is wrong because Settings > Data Inputs is used to configure data ingestion (e.g., monitor files, network ports) and does not display event counts per source type. Option D is wrong because it explicitly requires running a search with the `| stats count by sourcetype` command, which contradicts the requirement of 'without performing a search'.

Full explanation →

Splunk Core Certified User SPLK-1002 (SPLK-1001) — Questions 451–502