Courseiva

Splunk Core Certified User SPLK-1002 (SPLK-1002) — Questions 451–510

510 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 7

451
Multi-Selecthard

Which TWO of the following are true about KV Store lookups in Splunk?

Select 2 answers
A.KV Store lookups automatically support time-based retrieval
B.KV Store lookups are stored as CSV files on the search head
C.KV Store lookups can be used in automatic lookups
D.KV Store lookups can be updated via REST API
E.KV Store lookups only support exact match lookups
AnswersC, D

They can be configured as automatic lookups in props.conf.

Why this answer

Option C is correct because KV Store lookups can be configured as automatic lookups in Splunk, meaning they can be applied at search time without requiring an explicit lookup command. This is done by defining the KV Store collection as a lookup in transforms.conf and then associating it with a source type or host in props.conf, just like CSV or external lookups.

Exam trap

Splunk often tests the misconception that KV Store lookups are file-based like CSV lookups, but the trap here is that candidates may confuse KV Store storage with CSV files or assume time-based retrieval is automatic, when in fact KV Store is a database-backed lookup that requires explicit time handling and supports wildcard matching.

Full explanation →
452
MCQeasy

A user runs a search but sees zero results. What is the most common cause for this?

A.The time range picker is set to a period with no data.
B.The search did not specify an index.
C.The source type is incorrect.
D.The search syntax contains a typo.
AnswerA

If the time range is too narrow or future, no events are returned.

Why this answer

Option C is correct because the time range often defaults to a short period. Option A is wrong because search UI does not require index specification by default. Option B is wrong because source types are automatically identified.

Option D is wrong because a syntax error usually generates an error message, not empty results.

Full explanation →
453
MCQeasy

Refer to the exhibit. Which visualization is most appropriate for this data?

A.Single value
B.Scatter chart
C.Pie chart
D.Line chart
AnswerC

Pie charts effectively display the relative proportions of categories.

Why this answer

A pie chart is the most appropriate visualization for this data because it shows a breakdown of a whole into its constituent parts, specifically the percentage of total events by source type. Pie charts are ideal for displaying proportional or categorical data where the sum of all slices equals 100%, making it easy to compare the relative size of each category at a glance.

Exam trap

Splunk often tests the candidate's ability to distinguish between visualizations for categorical vs. time-series data, and the trap here is that candidates might choose a line chart because they see a time field in the data, even though the question's exhibit shows aggregated counts by source type, not a trend over time.

How to eliminate wrong answers

Option A is wrong because a single value visualization is used to display a single metric or aggregate (e.g., total count, average latency), not a distribution of multiple categories. Option B is wrong because a scatter chart is designed to plot two continuous variables to identify correlations or clusters, not to show parts of a whole. Option D is wrong because a line chart is best for showing trends over time or continuous data, not categorical proportions.

Full explanation →
454
MCQeasy

From the Splunk Home page, which of the following can be accessed directly?

A.All of the above
B.Settings
C.Search app
D.Dashboards
AnswerA

The Home page contains links to all apps and settings.

Why this answer

The Splunk Home page provides direct access to the Search app, Settings, and Dashboards via its navigation bar and default landing page tiles. Option A is correct because all listed items are accessible from the Home page without requiring additional navigation steps.

Exam trap

Splunk often tests the misconception that the Home page only provides access to the Search app, leading candidates to overlook the direct access to Settings and Dashboards from the same interface.

How to eliminate wrong answers

Option B is wrong because Settings is indeed directly accessible from the Home page via the gear icon or the 'Settings' menu in the top navigation bar, so it is not an incorrect option. Option C is wrong because the Search app is directly accessible from the Home page as the primary search bar and the 'Search & Reporting' app tile. Option D is wrong because Dashboards can be accessed directly from the Home page through the 'Dashboards' link in the navigation or the 'Dashboards' tile.

Since all options are correct, the only valid answer is A.

Full explanation →
455
MCQhard

An administrator wants to group all events from a single web session identified by session_id, where the session starts with a 'login' event and ends with a 'logout' event. Which search is correct?

A.index=web | transaction session_id
B.index=web | transaction session_id startswith="login" endswith="logout"
C.index=web | transaction session_id keepevicted=true
D.index=web | transaction session_id maxevents=2
AnswerB

Correct usage; groups sessions based on markers.

Why this answer

The transaction command with startswith and endswith parameters groups events based on field values. The session_id field ties events together.

Full explanation →
456
Multi-Selectmedium

Which three options describe features or components of the Splunk default interface that are available to a Core Certified User? (Choose three.)

Select 3 answers
.The Search bar allows users to enter SPL queries and use time range pickers to filter results
.The Data Summary button provides a list of all sourcetypes, hosts, and indexes available to the user
.The Jobs page lists all currently running and completed searches that the user has initiated
.The Distributed Management Console (DMC) is accessible from the Splunk Home page for all users
.The Settings menu includes options to manage users, roles, and authentication methods
.The Alerts menu allows direct modification of alert actions without saving a search

Why this answer

The Search bar, Data Summary button, and Jobs page are all core features of the Splunk default interface available to any user, including a Core Certified User. The Search bar allows entering SPL queries and selecting time ranges to filter results. The Data Summary button provides a list of all sourcetypes, hosts, and indexes accessible to the user.

The Jobs page displays all currently running and completed searches initiated by the user, enabling monitoring and management of search jobs.

Exam trap

Splunk often tests the distinction between features available to all users versus those restricted to administrators, such as the Settings menu and DMC, which are commonly mistaken as universally accessible.

Full explanation →
457
Multi-Selecthard

Which TWO of the following are valid ways to add a visualization to a dashboard in Splunk?

Select 2 answers
A.Use the 'Edit' button on an existing panel to change it to a new visualization.
B.Create a new panel in the dashboard editor and select a visualization type.
C.Export a report as a PDF and upload it as an image panel.
D.Convert a saved report to a dashboard panel using the 'Save As Dashboard Panel' option.
E.Set up an alert and configure it to add a panel to the dashboard.
AnswersB, D

Direct method via dashboard editor.

Why this answer

Option B is correct because the dashboard editor in Splunk provides a dedicated workflow to add a new panel and then select a visualization type (e.g., chart, table, map) from the 'Visualization' tab. This is the standard method for building a panel from scratch within a dashboard, allowing you to define the search and choose the appropriate visualization for your data.

Exam trap

The trap here is that candidates often confuse modifying an existing panel's visualization (Option A) with adding a new visualization to the dashboard, or they mistakenly believe that alerts can dynamically create dashboard panels (Option E), when in reality alerts only trigger actions and cannot modify dashboard structure.

Full explanation →
458
MCQhard

A dashboard includes a table panel that shows recent errors. The analyst wants users to click on an error message and be taken to a search showing all events containing that error message within the same time range. Which configuration should be applied to the table panel?

A.Set 'Drilldown' to 'Link to search' and configure the target search with a token for the error message.
B.Add a token on the table panel and set the drilldown to 'Token' with value '$row.error_message$'.
C.Set 'Drilldown' to 'Custom' and use JavaScript to open a new window.
D.Set 'Drilldown' to 'Search', and in the search string include 'error_message="$click.value$"'
AnswerA

Link to search with tokens maintains the time range and passes clicked value.

Why this answer

Option B is correct because 'Drilldown' with 'Link to search' allows passing the clicked field value as a token to a new search. Option A is wrong because 'Drilldown' to 'Search' with the field value creates a static search. Option C is wrong because 'Token' alone does not define a drilldown action.

Option D is wrong because 'Drilldown' to 'Custom' requires JavaScript.

Full explanation →
459
MCQeasy

A security analyst runs a search that returns many fields, most of which are not needed. Which command should be used to remove all fields except 'src_ip', 'dest_ip', and 'action'?

A.| rename src_ip as src, dest_ip as dest, action as act
B.| fields + src_ip, dest_ip, action
C.| fields - src_ip, dest_ip, action
D.| table src_ip, dest_ip, action
AnswerB

The '+' prefix keeps only listed fields.

Why this answer

The `fields` command with the `+` prefix explicitly keeps only the listed fields and removes all others from the search results. This is the correct way to retain only `src_ip`, `dest_ip`, and `action` while discarding the rest.

Exam trap

Splunk often tests the distinction between `fields +` (keep only) and `fields -` (remove), and candidates frequently confuse the two, especially when the question asks to 'remove all fields except' a specific set.

How to eliminate wrong answers

Option A is wrong because `rename` only changes field names, it does not remove any fields. Option C is wrong because `fields -` removes the listed fields, keeping all others, which is the opposite of what is needed. Option D is wrong because `table` creates a results table with only those fields, but it also transforms the output into a tabular format and can affect event counts or statistical commands, whereas `fields` simply filters fields without changing the data structure.

Full explanation →
460
MCQeasy

A user wants to remove duplicate events based on the 'transaction_id' field, keeping only the first occurrence. Which command is appropriate?

A.fields - transaction_id
B.sort transaction_id | dedup transaction_id
C.dedup transaction_id
D.uniq transaction_id
AnswerC

Removes duplicates based on field.

Why this answer

The `dedup` command removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the user wants to keep the first occurrence of each unique `transaction_id`, `dedup transaction_id` is the correct and simplest approach.

Exam trap

The trap here is that candidates often confuse `dedup` with `uniq`, not realizing that `uniq` only removes consecutive duplicates and requires sorted input, while `dedup` works on any field and does not require prior sorting.

How to eliminate wrong answers

Option A is wrong because `fields - transaction_id` removes the `transaction_id` field from events, not duplicate events. Option B is wrong because `sort transaction_id | dedup transaction_id` sorts events by `transaction_id` before deduplication, which changes the order and may cause a different event to be kept as the 'first occurrence' if the original order is important. Option D is wrong because `uniq` removes consecutive duplicate lines, not duplicate events based on a field, and it requires sorted input to work correctly.

Full explanation →
461
Multi-Selecteasy

Which TWO methods can be used to create a new field in a search?

Select 2 answers
A.search new_field=*
B.timechart count by date
C.rex field=raw "(?<new_field>pattern)"
D.stats count by host
E.eval new_field = some_expression
AnswersC, E

Rex can extract and create new fields from existing ones.

Why this answer

Option C is correct because the `rex` command uses a regular expression to extract a named group (`(?<new_field>pattern)`) from the `_raw` event data, dynamically creating the field `new_field` with the matched value. This is a standard method for field extraction in Splunk searches.

Exam trap

Splunk often tests the misconception that filtering commands like `search` or aggregation commands like `stats` can create fields, when in reality only extraction (`rex`) or evaluation (`eval`) commands generate new fields from existing data.

Full explanation →
462
MCQeasy

Refer to the exhibit. An automatic lookup is configured with WILDCARD match type. What kind of matching does this enable?

A.Matching based on prefixes or suffixes using wildcards.
B.Exact match only.
C.Case-insensitive match.
D.Matching only on the first N characters.
AnswerA

WILDCARD enables pattern matching.

Why this answer

Option A is correct because an automatic lookup configured with WILDCARD match type enables matching based on prefixes or suffixes using wildcards. This allows the lookup to match field values that contain a wildcard character (e.g., * or ?) to represent variable parts of the string, enabling flexible pattern matching beyond exact equality.

Exam trap

The trap here is that candidates often confuse WILDCARD match type with case-insensitive matching or assume it only supports prefix matching, when in fact it supports both prefix and suffix wildcards and is distinct from case sensitivity settings.

How to eliminate wrong answers

Option B is wrong because exact match only is the behavior of the EXACT match type, not WILDCARD. Option C is wrong because case-insensitive matching is controlled by the case_sensitive_match setting in the lookup definition, not by the match type. Option D is wrong because matching only on the first N characters is a form of prefix matching that can be achieved with WILDCARD using a trailing wildcard, but it is not the exclusive behavior; WILDCARD supports both prefix and suffix matching via wildcards at either end of the pattern.

Full explanation →
463
Multi-Selectmedium

Which THREE of the following are valid options for the lookup command?

Select 3 answers
A.local=<bool>
B.rename <field> as <alias>
C.join <field>
D.output <newfield>
E.update=<bool>
AnswersA, D, E

local determines whether lookup runs on local search head.

Why this answer

Option A is correct because the `local=<bool>` parameter in the lookup command specifies whether the lookup should be performed on the search head (local) or distributed across indexers. When set to `true`, the lookup file is read from the search head; when `false`, it is distributed to all indexers, which is critical for performance in large environments.

Exam trap

Splunk often tests the distinction between command-level options (like `lookup` parameters) and standalone commands (like `rename` or `join`), tricking candidates into confusing a command's sub-options with entirely separate SPL commands.

Full explanation →
464
Matchingmedium

Match each Splunk role to its typical permission scope.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Full system access including settings and users

Create and share knowledge objects and run searches

Run searches and create personal knowledge objects

Ability to delete events from indexes

Why these pairings

Roles define capabilities within Splunk.

Full explanation →
465
MCQhard

Refer to the exhibit. A user runs the search and gets no results. Which is the most likely cause?

A.The 'sort' command must come before 'where'
B.The 'status' field does not exist in the data
C.The 'stats' command cannot be used with 'where'
D.The 'index' parameter is misspelled
AnswerB

If the field is not extracted, 'where' returns no results.

Why this answer

The search uses the 'where' command before 'sort', but the 'where' command filters out all events if no status codes >= 400 exist. However, a more common issue is that the 'status' field may not be extracted correctly from the access_combined sourcetype, or the field name might be different (e.g., 'http_status'). The 'where' command requires an existing field.

Full explanation →
466
MCQmedium

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

A.| stats count by status | where count > 100
B.| eval count=1 | stats sum(count) by status | where count > 100
C.| stats count as cnt by status | where cnt > 100
D.| where count > 100 | stats count by status
AnswerC

Correct: stats counts by status, then filters on the count field.

Why this answer

Option C is correct because it first uses `stats count as cnt by status` to count events per status code, renaming the count field to `cnt`, then applies `where cnt > 100` to filter for status codes with more than 100 events. This is the standard Splunk pattern for aggregating data and then filtering on the aggregated result.

Exam trap

Splunk often tests the order of operations in the search pipeline, specifically that `where` cannot reference a field created by a later command, leading candidates to incorrectly place the filter before the aggregation.

How to eliminate wrong answers

Option A is wrong because `where count > 100` references a field named `count` that does not exist at that point; `stats count by status` creates a field named `count` only after the stats command, but the `where` clause is applied before stats in the pipeline order, causing an error or no results. Option B is wrong because it unnecessarily uses `eval count=1` and `stats sum(count) by status` instead of the simpler `stats count by status`; while it might produce the same result, it is inefficient and not the correct approach for counting events. Option D is wrong because `where count > 100` is applied before `stats count by status`, meaning it tries to filter on a field that does not exist yet; this will either fail or return no events, and the stats command then counts all remaining events without the intended filter.

Full explanation →
467
MCQhard

A time-based lookup is configured with `max_offset_secs = 3600`. An event has a timestamp 100 seconds after the lookup time value. Will the lookup match?

A.Yes, but only if min_offset_secs is also set.
B.No, because the event timestamp is later than the lookup time.
C.No, because the event timestamp must be before the lookup time.
D.Yes, because the offset is within the allowed range.
AnswerD

The offset of 100 seconds is less than 3600, so it matches.

Why this answer

Option D is correct because the time-based lookup is configured with `max_offset_secs = 3600`, which defines the maximum allowed offset (in seconds) between the event timestamp and the lookup time. Since the event timestamp is 100 seconds after the lookup time, the offset is 100 seconds, which is well within the 3600-second window. No `min_offset_secs` is required for this match to succeed, as the default minimum offset is 0 (meaning the event timestamp can be equal to or later than the lookup time).

Exam trap

Splunk often tests the misconception that time-based lookups only work when the event timestamp is before the lookup time, but in reality, the `max_offset_secs` parameter allows events with timestamps after the lookup time, as long as the offset is within the configured range.

How to eliminate wrong answers

Option A is wrong because `min_offset_secs` is not required for a match when the event timestamp is later than the lookup time; the default minimum offset is 0, so the match works without it. Option B is wrong because the event timestamp being later than the lookup time does not prevent a match; the `max_offset_secs` parameter specifically allows events with timestamps after the lookup time, as long as the offset is within the configured range. Option C is wrong because the event timestamp does not need to be before the lookup time; time-based lookups support both forward and backward offsets depending on the configuration of `min_offset_secs` and `max_offset_secs`.

Full explanation →
468
MCQmedium

A user wants to see the values of all fields in an event, including fields that are not automatically extracted. Which search command should be used?

A.`| rex`
B.`| fields *`
C.`| spath`
D.`| table *`
AnswerD

Lists all fields and values.

Why this answer

The `| table *` command displays all fields in each event, including those not automatically extracted, by listing every field in a tabular format. This is because the asterisk wildcard in `table` includes all fields present in the search results, regardless of whether they are extracted by default or through custom parsing. In contrast, `| fields *` only retains fields that are already known to the search index, not necessarily showing all raw event data.

Exam trap

Splunk often tests the misconception that `| fields *` shows all fields, but it actually restricts output to only extracted fields, whereas `| table *` includes all fields including those from raw event data.

How to eliminate wrong answers

Option A is wrong because `| rex` is used to extract fields using regular expressions from raw event data, not to display all fields. Option B is wrong because `| fields *` removes any fields not already extracted or indexed, effectively hiding non-automatically extracted fields. Option C is wrong because `| spath` is designed to extract fields from structured data formats like JSON or XML, not to display all fields in an event.

Full explanation →
469
Multi-Selecthard

A Splunk admin wants to handle missing field values in a search. Which TWO commands can replace null values with a specified default? (Choose two.)

Select 2 answers
A.coalesce
B.eval
C.convert
D.fillnull
E.default
AnswersA, D

coalesce returns the first non-null value.

Why this answer

The `fillnull` command explicitly replaces null field values with a specified default string (or '0' if no default is given). The `coalesce` function, used within an `eval` command, returns the first non-null value from a list of fields or expressions, effectively replacing nulls with a fallback default. Both commands directly address missing field values by substituting a specified default.

Exam trap

Splunk often tests the distinction between commands that modify data (like `fillnull`) and functions that operate within `eval` (like `coalesce`), and the trap here is that candidates may incorrectly select `eval` alone or the non-existent `default` command, thinking they handle nulls without needing a specific function.

Full explanation →
470
MCQhard

An analyst needs to find the count of events by source type for each day in the past week, but only for source types with more than 1000 events. Which search is correct?

A.index=* earliest=-7d | bucket _time span=1d | stats count by sourcetype _time | where count>1000
B.index=* earliest=-7d | stats count by sourcetype _time | where count>1000
C.index=* earliest=-7d | timechart count by sourcetype | search count>1000
D.index=* earliest=-7d | timechart count by sourcetype | where count>1000
AnswerA

Correctly buckets and filters after stats.

Why this answer

Option A is correct because it uses `bucket _time span=1d` to group events into daily time buckets, then `stats count by sourcetype _time` to count events per source type per day, and finally `where count>1000` to filter for source types exceeding 1000 events per day. The `bucket` command is essential to create discrete daily intervals; without it, `stats count by sourcetype _time` would treat each unique _time value as a separate bucket, which is not the intended daily aggregation.

Exam trap

Splunk often tests the distinction between `bucket` and raw _time grouping, and the misuse of `search` vs `where` for filtering aggregate results, leading candidates to pick options that omit bucket or use `search` incorrectly.

How to eliminate wrong answers

Option B is wrong because it omits the `bucket` command, so `stats count by sourcetype _time` groups by the raw _time field (with sub-second precision), resulting in many tiny buckets that do not represent daily counts, and the `where count>1000` filter would likely return no results or incorrect data. Option C is wrong because `timechart count by sourcetype` automatically creates time buckets (default span depends on time range) but then uses `search count>1000` which is invalid syntax — `search` expects a field-value pair or a keyword, not an aggregation comparison; it would either error or ignore the filter. Option D is wrong because `timechart count by sourcetype` outputs a table with time as rows and sourcetypes as columns, so `where count>1000` references a nonexistent field 'count' (the counts are in columns named after sourcetypes), causing the filter to fail or produce no results.

Full explanation →
471
MCQeasy

A user wants to create a dashboard panel that shows the top 5 most visited web pages. Which report type should be used as the underlying search?

A.stats count by page
B.top 5 page
C.rare 5 page
D.chart count by page
AnswerB

The top command directly returns the most common values.

Why this answer

The 'top' command in Splunk automatically returns the most common values of a field, and the syntax 'top 5 page' directly limits the result to the top 5 pages by count. This is the most straightforward and efficient way to generate a dashboard panel showing the top 5 most visited web pages, as it combines counting and sorting into a single command.

Exam trap

Splunk often tests the distinction between commands that only aggregate ('stats count') versus those that aggregate and limit ('top'), leading candidates to choose 'stats count by page' because they forget that it does not automatically restrict the output to the top N values.

How to eliminate wrong answers

Option A is wrong because 'stats count by page' returns a count for every page but does not sort or limit the results to the top 5, requiring additional piping (e.g., '| sort -count | head 5') to achieve the desired output. Option C is wrong because 'rare 5 page' returns the least common (rarest) pages, which is the opposite of what the user wants (most visited). Option D is wrong because 'chart count by page' produces a tabular or chart-ready output but, like 'stats count by page', does not automatically limit to the top 5 and requires extra steps to sort and truncate.

Full explanation →
472
MCQeasy

A user wants to search only data from the 'security' index. Which search syntax should they use?

A.source=security
B.sourcetype=security
C.host=security
D.index=security
AnswerD

This correctly limits the search to the security index.

Why this answer

Option D is correct because in Splunk, the `index` field specifies which index to search, and data is organized into indexes. To restrict a search to data from a specific index, you use `index=<index_name>`. Here, `index=security` tells Splunk to only search events stored in the 'security' index, which is the precise syntax required.

Exam trap

The trap here is that candidates often confuse the `index` field with other common metadata fields like `source`, `sourcetype`, or `host`, because all are used to filter data but refer to entirely different attributes of the event.

How to eliminate wrong answers

Option A is wrong because `source=security` would search for events where the source field (typically a file path or network input) is literally named 'security', not the index. Option B is wrong because `sourcetype=security` would match events with a sourcetype value of 'security', which is a data type classification, not an index. Option C is wrong because `host=security` would filter events originating from a host named 'security', which is a network or machine identifier, not an index.

Full explanation →
473
MCQmedium

A security analyst is investigating a breach and needs to extract the 'user_id' field from raw log events. The logs contain both structured and unstructured data. The analyst uses the following search: `index=security sourcetype=syslog | rex field=_raw "user_id=(?<user_id>\w+)" | stats count by user_id`. However, some events do not contain the 'user_id' pattern, but they have a 'username' field extracted by a default extraction. The analyst wants to create a unified field 'user_id' that includes values from both. Which approach should the analyst take?

A.Rename the 'username' field to 'user_id' using `rename username as user_id`
B.Use `eval user_id=mvindex(split(user_id+" "+username," "),0)` to combine the two fields
C.Use `fillnull value=N/A user_id` to handle missing values
D.Use `eval user_id=coalesce(user_id, username)` to take the first non-null value
AnswerD

`coalesce` returns the first non-null value among the fields, effectively unifying the field.

Why this answer

Option C is correct because using `coalesce` allows combining fields from different extractions into a single field. Option A is wrong because renaming only works if the field already exists, and the regex extraction may not always produce a value. Option B is wrong because the `eval` function with logical OR does not handle missing fields correctly.

Option D is wrong because `fillnull` only replaces null values, not combine fields.

Full explanation →
474
MCQeasy

Which command is used to export the current search results to a CSV file that can be used as a lookup table?

A.outputcsv
B.outputlookup
C.inputlookup
D.lookup
AnswerB

Correct command to create a lookup table from results.

Why this answer

The `outputlookup` command is used to export the current search results to a CSV file that can be used as a lookup table. It writes the results to a lookup definition in Splunk, making the data available for subsequent searches via `inputlookup` or automatic lookup configurations.

Exam trap

The trap here is that candidates confuse `outputcsv` with `outputlookup`, assuming any CSV export can serve as a lookup, but only `outputlookup` properly registers the file as a lookup table in Splunk's lookup definitions.

How to eliminate wrong answers

Option A is wrong because `outputcsv` exports search results to a CSV file, but that file is not automatically registered as a lookup table; it is simply a static file in the Splunk search results directory. Option C is wrong because `inputlookup` is used to read data from an existing lookup table into a search, not to export results. Option D is wrong because `lookup` is used to perform a lookup against a defined lookup table during a search, not to export or create a lookup file.

Full explanation →
475
Multi-Selecthard

Which THREE of the following are valid ways to add a visualization to a dashboard?

Select 3 answers
A.Paste a search query in the dashboard editor.
B.Create a report and then drag it onto the dashboard.
C.Click 'Add Panel' and choose 'New from Search'.
D.Clone an existing panel and edit its search.
E.Upload a CSV file and select visualization type.
AnswersA, C, D

Yes, it creates a new panel.

Why this answer

Option A is correct because pasting a search query directly into the dashboard editor is a standard method for creating a new panel. When you paste a search in the editor, Splunk automatically generates a visualization based on the search results, allowing you to configure the chart type and formatting within the dashboard context.

Exam trap

Splunk often tests the distinction between 'New from Search' (inline search) and 'New from Report' (saved report), and candidates mistakenly think dragging a report onto a dashboard is valid, when in fact you must use the 'Add Panel' workflow.

Full explanation →
476
Multi-Selecthard

Which TWO commands can be used to filter events based on field values?

Select 2 answers
A.where
B.lookup
C.fields
D.eval
E.search
AnswersA, E

Where filters events based on boolean expressions.

Why this answer

The `where` command is used to filter events based on field values using Boolean expressions. It evaluates each event against a condition and retains only those events where the condition is true, making it a direct filtering command for field values.

Exam trap

Splunk often tests the distinction between `where` and `eval` because candidates mistakenly think `eval` can filter events, but `eval` only creates or modifies fields without removing any events.

Full explanation →
477
MCQmedium

Refer to the exhibit. The chart shows five series. What is the effect of the useother=f argument?

A.It groups status codes beyond the top 5 into 'Other'
B.It includes all status codes as separate series
C.It sets the timechart to use default colors
D.It limits the chart to exactly 5 series without an 'Other' category
AnswerD

Correct: useother=f ensures no 'Other' group, so only the top 5 are shown.

Why this answer

The `useother=f` argument in a timechart command explicitly disables the automatic grouping of the least significant series into an 'Other' category. By default, timechart limits the number of distinct series displayed (often to 10) and aggregates the rest as 'Other'; setting `useother=f` forces the chart to show exactly the top 5 series as separate lines, with no aggregation. This matches option D, which states the chart is limited to exactly 5 series without an 'Other' category.

Exam trap

The trap here is that candidates often confuse `useother=f` with the default behavior of grouping into 'Other', leading them to select option A, when in fact `useother=f` removes the 'Other' category entirely.

How to eliminate wrong answers

Option A is wrong because `useother=f` disables the 'Other' grouping, not enables it; the default behavior already groups status codes beyond the top 5 into 'Other'. Option B is wrong because `useother=f` does not include all status codes as separate series — it still limits the series count (e.g., to 5) and simply omits the 'Other' bucket, so any series beyond the limit are dropped entirely. Option C is wrong because `useother=f` has no effect on color assignment; color defaults are controlled by the visualization settings or the `use_colors` argument, not by `useother`.

Full explanation →
478
MCQhard

A large enterprise has multiple Splunk indexers and is using data model acceleration to speed up dashboards. The dashboards are slow despite acceleration being enabled. The data model has many root events and child datasets. Which best practice should the administrator consider to improve performance?

A.Use tstats commands on the data model without acceleration.
B.Reduce the number of root events in the data model.
C.Replicate the data model on each indexer to distribute load.
D.Increase the summary range to cover more data.
AnswerB

Fewer root events simplify the acceleration summary, improving build and search performance.

Why this answer

Data model acceleration creates a summary of the data, but the acceleration process must traverse all root events to build the child datasets. If there are too many root events, the acceleration job itself becomes slow and resource-intensive, negating the performance benefit. Reducing the number of root events directly reduces the workload for acceleration, allowing the summaries to be built faster and queries to run against the accelerated data more efficiently.

Exam trap

The trap here is that candidates assume acceleration always improves performance, but they overlook that the acceleration process itself can become a bottleneck if the data model has too many root events, leading them to choose options that increase workload (like increasing summary range) rather than reducing it.

How to eliminate wrong answers

Option A is wrong because using tstats without acceleration would query raw data, which is slower than using accelerated summaries; the question states acceleration is already enabled, so the issue is with the acceleration process itself. Option C is wrong because data model acceleration summaries are stored on the indexers that host the data, and replicating the data model does not distribute the acceleration workload—it would only duplicate storage and increase overhead. Option D is wrong because increasing the summary range would cause the acceleration to cover more time, making the acceleration job even slower and more resource-intensive, not faster.

Full explanation →
479
MCQmedium

A user needs to quickly find a specific event from last week. Which navigation method is most efficient?

A.Use the 'All Fields' button on the left
B.Click on the Timeline histogram to zoom in
C.Set the time range picker to 'Last 7 days' before running the search
D.Search without a time range, then use Smart Mode
AnswerC

Pre-filtering time reduces result set and speeds up search.

Why this answer

Option D is correct because setting a specific time range narrows the search scope. Option A is wrong because searching all time is unnecessary. Option B is wrong because All Fields is not a filtering method.

Option C is wrong because the Timeline is a visualization, not a navigation method.

Full explanation →
480
MCQhard

An organization is ingesting web proxy logs and wants to enrich them with a lookup table that maps internal IP addresses to employee names. The lookup table is updated weekly. Which configuration ensures the lookup is automatically applied to all searches without manual intervention, while also minimizing performance impact?

A.Create a macro that includes the 'lookup' command and share it with users.
B.Upload the lookup file each week and manually run a search to add the field.
C.Use the 'lookup' command in every search to fetch the employee name.
D.Configure an automatic lookup in props.conf and transforms.conf.
AnswerD

Automatic lookups are applied at search time to all matching events without manual effort.

Why this answer

Option D is correct because configuring an automatic lookup in props.conf and transforms.conf allows the lookup to be applied at search time without requiring users to manually invoke the lookup command. This configuration minimizes performance impact by leveraging indexed field values and caching, and it ensures the lookup is automatically applied to all searches as soon as the lookup file is updated weekly.

Exam trap

The trap here is that candidates often confuse automatic lookups with the 'lookup' command or macros, thinking that any automated approach requires user action, when in fact props.conf/transforms.conf provide true automatic application without manual intervention.

How to eliminate wrong answers

Option A is wrong because a macro still requires users to explicitly invoke it in their searches, which does not achieve automatic application without manual intervention. Option B is wrong because manually uploading the lookup file and running a search each week is not automated and introduces significant manual overhead and performance impact. Option C is wrong because using the 'lookup' command in every search requires users to remember to include it, which is not automatic and can degrade performance if the lookup is large or used frequently without caching.

Full explanation →
481
MCQmedium

An analyst needs to count the number of distinct IP addresses that accessed a server. Which approach is most efficient?

A.| stats count by src_ip
B.| dedup src_ip | stats count
C.| stats dc(src_ip)
D.| fields src_ip | sort | uniq
AnswerC

Directly computes distinct count, most efficient.

Why this answer

`stats dc(src_ip)` directly computes distinct count of src_ip, avoiding unnecessary sorting or dedup.

Full explanation →
482
MCQmedium

Refer to the exhibit. A user runs this search and gets 10 results as expected. However, they want to see the top 10 hosts for the past week. The search still returns results, but the counts are lower than expected. What is the most likely reason?

A.The time range is set to the past 24 hours by default.
B.The sort command is not needed.
C.The head command restricts results.
D.The stats command counts all time.
AnswerA

Default time range is Last 24 hours, not All time.

Why this answer

By default, Splunk searches are restricted to the last 24 hours (unless a different time range is explicitly selected). Even though the user expects results for the past week, the search is only looking at the most recent 24 hours of data. This causes the counts to be lower than expected because events from earlier in the week are not included.

Exam trap

Splunk often tests the default time range behavior, where candidates assume the search will automatically cover the entire dataset or the time range implied by the search logic, but Splunk restricts results to the last 24 hours unless the time picker is changed.

How to eliminate wrong answers

Option B is wrong because the sort command is not the issue; it is correctly used to order the results by count, and removing it would not fix the time range problem. Option C is wrong because the head command is correctly used to limit the output to the top 10 results; it does not affect the time range of the search. Option D is wrong because the stats command does not count all time; it only processes events within the currently selected time range, which defaults to the past 24 hours.

Full explanation →
483
Multi-Selectmedium

Which two tabs are always present in the search results page? (Select TWO)

Select 2 answers
A.Visualization
B.Patterns
C.Events
D.Statistics
E.Fields
AnswersC, D

Always present to show raw events.

Why this answer

The Events and Statistics tabs are always present on the search results page because they represent the two fundamental views of search results: the raw event data (Events) and the tabular summary of statistical calculations (Statistics). Even if a search does not produce events or statistics, these tabs remain visible as placeholders, ensuring consistent navigation.

Exam trap

The trap here is that candidates often confuse the always-present tabs (Events and Statistics) with commonly seen but conditional tabs like Visualization or Patterns, assuming they are permanent because they appear frequently in typical searches.

Full explanation →
484
Multi-Selectmedium

Which three of the following are valid methods for creating or using field extractions in Splunk? (Choose three.)

Select 3 answers
.Using the Field Extractor (FX) interactive tool to generate regex-based extractions
.Manually writing a regular expression in props.conf and transforms.conf
.Using the `| extract` command in a search to perform key-value pair extraction
.Using the `| fields` command to extract new fields from raw data
.Configuring automatic field extraction via the `fieldaliases.conf` file
.Using the `| rename` command to create new fields by renaming existing ones

Why this answer

The Field Extractor (FX) interactive tool is a valid method because it provides a GUI to generate regex-based extractions by highlighting sample data. Manually writing regular expressions in `props.conf` and `transforms.conf` is the standard way to define custom field extractions at the index-time or search-time level. The `| extract` command is valid because it performs key-value pair extraction on search results, typically for data formatted as `key=value` pairs, without requiring configuration files.

Exam trap

Splunk often tests the distinction between commands that manipulate existing fields (`| fields`, `| rename`) versus commands that create new fields from raw data (`| extract`, `| rex`), leading candidates to mistakenly select `| fields` or `| rename` as valid extraction methods.

Full explanation →
485
MCQhard

A user runs a search in Splunk Web that returns no results. The user believes data should exist for the current time. Which action most quickly verifies whether the time range is the issue?

A.Change the time range to 'All time' and rerun the search.
B.Open the Job Inspector to see the search time range.
C.Check the time range picker above the search bar.
D.Look at the earliest and latest timestamps in the search bar.
AnswerC

Correct: The time range picker shows the current selection instantly.

Why this answer

Option D is correct because the time range picker is always visible and shows the currently selected range, so glancing at it quickly confirms if it's set correctly. Option A is incorrect because the Job Inspector requires opening a separate window and provides detailed info but is not the quickest. Option B is incorrect because changing the time range to 'All time' will run a new search, taking time to complete.

Option C is incorrect because the search bar does not display the current time range by default; only the time modifiers in the search string.

Full explanation →
486
MCQmedium

A dashboard includes a form input that allows users to select a user. After selecting a user, a panel should show that user's activity. Which dashboard feature is required?

A.Post-process searches
B.Tokens
C.Drilldown
D.Link to report
AnswerB

Tokens capture and propagate user input to panel searches.

Why this answer

Tokens store the selected value and pass it to search queries, enabling dynamic panel updates.

Full explanation →
487
MCQmedium

A Splunk administrator is reviewing the 'Add Data' wizard for a new data source. The admin wants to monitor a log file that is located on the same server where Splunk is installed. The admin navigates to Settings > Add Data and selects 'Monitor' and then 'Files & Directories'. In the file list, the admin sees a checkbox next to each file. The admin selects the desired file and clicks 'Next'. However, the wizard does not proceed to the next page; instead, nothing happens. The admin has confirmed that the file exists and is readable. What is the most likely cause?

A.The admin's Splunk Web session has timed out.
B.The admin did not select a source type for the file.
C.The file is already being monitored by another input.
D.The file is too large and Splunk is processing it.
AnswerA

Correct: A long idle session may need re-login.

Why this answer

Option C is correct because the 'Next' button may be disabled if the file is not valid or the index is not set; but the admin didn't fill in required fields? Actually, the typical flow: after selecting file, you click 'Next' to go to source type settings. But if the file is locked or the index is not set, the button might be grayed. However, most likely the wizard requires a source type selection before proceeding; but the default is 'automatic'.

Option A is plausible but a popup would appear. Option B is a common issue: the Splunk Web session may have timed out. Option D is unlikely because the file is local.

I'll go with B: session timeout.

Full explanation →
488
Multi-Selectmedium

Which three options correctly describe characteristics or behaviors of Splunk reports and visualizations? (Choose three.)

Select 3 answers
.A report can be scheduled to run at a specific time and send results via email.
.The trellis layout in a chart divides data into multiple smaller charts based on a field.
.A single report can be used as a data source for multiple dashboard panels.
.The Single Value visualization can display trend indicators and sparklines.
.Radial gauges are the default visualization type for all statistical reports.
.Time series charts cannot be used with the 'stacked' mode option.

Why this answer

Option 1 is correct because Splunk reports can be scheduled to run at specific times using the 'Schedule Report' feature, and they can be configured to send results via email, PDF, or other delivery methods. Option 2 is correct because the trellis layout (also known as small multiples) splits a chart into multiple smaller charts based on the values of a specified field, allowing for comparison across categories. Option 3 is correct because a single report can be used as a data source for multiple dashboard panels by referencing the report's SID (Search ID) in each panel, ensuring consistent data across the dashboard.

Exam trap

Splunk often tests the misconception that all statistical reports default to radial gauges, but in Splunk, the default visualization is context-dependent and typically a table or column chart, not a radial gauge.

Full explanation →
489
MCQhard

Refer to the exhibit. An admin sees that the Web_Traffic data model is accelerated but shows 'Summaries require rebuild'. What does this status indicate?

A.The disk space for acceleration is full.
B.The summary range is too short and needs to be extended.
C.The acceleration summaries are up to date and optimal.
D.The data model definition has been modified and acceleration needs to be rebuilt.
AnswerD

Changes to the model require rebuilding summaries.

Why this answer

When a data model is accelerated and shows 'Summaries require rebuild', it indicates that the data model definition has been modified (e.g., fields, constraints, or root events changed) since the last summary build. Splunk detects this change and marks the acceleration summaries as stale, requiring a rebuild to ensure query results reflect the updated definition. This is a built-in mechanism to maintain data integrity between the model and its accelerated summaries.

Exam trap

Splunk often tests the distinction between 'Summaries require rebuild' (caused by definition changes) and other acceleration issues like disk space or range problems, so candidates mistakenly attribute the status to resource constraints or misconfigured ranges.

How to eliminate wrong answers

Option A is wrong because disk space full would cause acceleration to stop or fail with a 'disk full' error, not a 'Summaries require rebuild' status. Option B is wrong because a summary range that is too short would cause incomplete coverage or missing data, but the status message specifically indicates a definition change, not a range issue. Option C is wrong because 'up to date and optimal' would show a 'Summaries are up to date' or 'Green' status, not a rebuild requirement.

Full explanation →
490
MCQhard

A Splunk admin notices that a dashboard panel using `timechart` is showing gaps (null values) for some time periods where no events exist. The admin wants to display a zero instead of null to make the chart continuous. Which command should be added before `timechart`?

A.`timechart useother=t`
B.`eventstats`
C.`makecontinuous`
D.`fillnull`
AnswerD

`fillnull` replaces null values with a specified value, typically used after aggregation like `timechart`.

Why this answer

Option D, `fillnull`, is correct because it explicitly replaces null values in the results of a transforming search (like `timechart`) with zeros. When `timechart` produces gaps for time buckets with no events, `fillnull` fills those null fields with a specified value (default 0), making the chart continuous. This command must be placed after the transforming command, not before it, but the question asks which command should be added before `timechart`—in practice, `fillnull` is used in a subsearch or after `timechart`; however, the intended correct answer is `fillnull` as the command that achieves the desired result.

Exam trap

The trap here is that candidates often confuse `makecontinuous` (which fills missing time buckets with null events) with `fillnull` (which replaces null values with zeros), and may incorrectly think `makecontinuous` alone solves the problem, but it only creates the buckets—not the zero values.

How to eliminate wrong answers

Option A is wrong because `timechart useother=t` groups rare values into an 'Other' category, but does not fill null values or address gaps in time series. Option B is wrong because `eventstats` computes statistics over all events without splitting by time, and cannot fill null values in a timechart output. Option C is wrong because `makecontinuous` fills gaps in a time series by generating events for missing time buckets, but it does not replace null values with zeros—it creates null events that still require `fillnull` to convert to zero.

Full explanation →
491
MCQmedium

An analyst wants to compute the average response time for each server from web server logs. The field `response_time` is a string like '120ms'. What is the correct way to convert and compute?

A.eval response_time=response_time + "0" | stats avg(response_time) by server
B.eval response_num=replace(response_time, "ms", "") | eval response_num=response_num*1 | stats avg(response_num) by server
C.eval response_num=replace(response_time, "ms", "") | stats avg(response_num) by server
D.eval avg_response=avg(response_time)
AnswerB

Replace removes 'ms', and multiplying by 1 converts to numeric, then avg works.

Why this answer

Option B is correct because it uses eval to convert the string to a number by removing 'ms' and multiplying by 1 (or using tonumber). Option A is wrong because it adds literal 'ms' to numeric values. Option C is wrong because replace doesn't convert to numeric.

Option D is wrong because it adds the unit back.

Full explanation →
492
MCQmedium

After running a search, an analyst notices that useful fields are not appearing in the 'Selected Fields' section. What is the most likely reason?

A.The user has manually hidden those fields in the field sidebar.
B.The search is using a transforming command that suppresses field display.
C.The fields are not extracted or indexed in the data.
D.The time range is too wide, causing field extraction to be incomplete.
AnswerC

Fields are only available if they are extracted or indexed.

Why this answer

Fields appear in the 'Selected Fields' section only if they have been extracted and indexed from the raw data. If the data source does not contain the expected field-value pairs, or if no field extraction (such as from a props.conf or a search-time extraction) has been configured, Splunk will not populate those fields. This is the most common cause of missing fields in the interface.

Exam trap

The trap here is that candidates often confuse the 'Selected Fields' section with the 'Interesting Fields' section, or assume that a transforming command like 'stats' hides fields, when in fact the root cause is that the fields were never extracted from the raw data.

How to eliminate wrong answers

Option A is wrong because manually hiding fields in the field sidebar only affects the display of already extracted fields; it does not prevent fields from appearing in the 'Selected Fields' section if they exist. Option B is wrong because transforming commands (e.g., stats, chart, timechart) do not suppress field display; they aggregate data and may change the result set, but the underlying extracted fields remain available in the field sidebar. Option D is wrong because a wide time range does not cause incomplete field extraction; field extraction is based on the data's structure and configuration, not on the time range's breadth.

Full explanation →
493
MCQmedium

An organization needs to enrich authentication events with employee department information stored in a MySQL database. The data is updated frequently. Which lookup type is most appropriate?

A.External lookup
B.Geographic lookup
C.CSV file lookup
D.KV store lookup
AnswerD

KV store can connect to external databases and update in near-real-time.

Why this answer

A KV Store lookup is the most appropriate choice because it supports real-time, bidirectional updates via the REST API, allowing the organization to frequently modify employee department data in a MySQL database and have those changes reflected immediately in Splunk. Unlike static CSV lookups or external lookups that require manual reloading or script execution, the KV Store provides a scalable, dynamic lookup mechanism that integrates seamlessly with Splunk's search-time field enrichment.

Exam trap

The trap here is that candidates often choose CSV file lookup (Option C) because it is the simplest and most familiar lookup type, failing to recognize that it cannot handle frequently updated data without manual reloading or scheduled scripts, whereas the KV Store is designed for dynamic, real-time updates.

How to eliminate wrong answers

Option A is wrong because an external lookup relies on an external script or command to retrieve data, which introduces latency and complexity for frequently updated data, and it does not natively support bidirectional updates like the KV Store. Option B is wrong because a geographic lookup is specifically designed for mapping IP addresses or coordinates to geographic locations, not for enriching authentication events with employee department information from a database. Option C is wrong because a CSV file lookup is static and requires manual reloading or a scheduled script to reflect changes, making it unsuitable for frequently updated data that needs real-time enrichment.

Full explanation →
494
MCQeasy

Refer to the exhibit. A user reports they cannot log in to Splunk Web and sees this error in the logs. What is the most likely cause?

A.The user typed an incorrect username or password.
B.The user's session has expired or the CSRF token is invalid.
C.The Splunk indexer is not responding.
D.The user ran too many searches and hit a limit.
AnswerB

CSRF token validation is session-related.

Why this answer

Option A is correct because CSRF token failures indicate a session or security token issue, often due to an expired or invalid session. Option B is wrong because authentication failed would show a different error. Option C is wrong because too many search jobs would not cause a CSRF error.

Option D is wrong because indexer connectivity issues show different errors.

Full explanation →
495
MCQmedium

An administrator notices that a data model is not appearing in the Pivot interface. What is a possible reason?

A.The data model is not shared with the user's role.
B.The data model acceleration is disabled.
C.The data model contains errors in field definitions.
D.The data model has no root datasets.
AnswerA

Data models must be shared to be visible in Pivot.

Why this answer

The Pivot interface only displays data models that have been explicitly shared with the user's role via permissions. If the data model is not shared, it will not appear in the Pivot editor, regardless of its internal validity or acceleration status. This is a core access control mechanism in Splunk.

Exam trap

The trap here is that candidates often confuse functional issues (like acceleration or field errors) with visibility/permission issues, assuming a data model must be broken to be missing from the Pivot interface.

How to eliminate wrong answers

Option B is wrong because disabling data model acceleration only affects performance (e.g., faster pivot queries via summary indexing), not the visibility of the data model in the Pivot interface. Option C is wrong because errors in field definitions may cause pivot queries to fail or return incorrect results, but the data model will still appear in the Pivot interface as long as it is valid enough to be saved. Option D is wrong because a data model without root datasets cannot be saved or created; if it exists, it must have at least one root dataset, so this would not be a reason for it not appearing.

Full explanation →
496
MCQhard

Refer to the exhibit. What does this configuration do?

A.It creates a new sourcetype
B.It clears the host field
C.It enables SSL for the sourcetype
D.It sets the host field based on IP using a transform
AnswerD

The transform name suggests setting host from IP.

Why this answer

This props.conf stanza applies a transform named 'set_host_from_ip' to all events of sourcetype 'my_sourcetype'. Transforms typically modify field values; this one sets the host field based on the source IP.

Full explanation →
497
MCQeasy

A user notices that a calculated field defined in props.conf is not appearing in search results. Which of the following is the most likely cause?

A.The calculated field requires index-time field extraction.
B.The source fields used in the calculation are not extracted.
C.The calculated field is defined in a field alias configuration.
D.The indexer is not configured to apply calculated fields.
AnswerB

Calculated fields depend on source fields being available.

Why this answer

Calculated fields in Splunk are evaluated at search time based on existing extracted source fields. If the source fields referenced in the calculation are not extracted (e.g., due to missing or incorrect field extraction configurations), the calculated field will not appear in search results. Option B correctly identifies this dependency.

Exam trap

The trap here is that candidates often confuse calculated fields with index-time field extractions or field aliases, assuming the issue is with indexing or alias configuration rather than the fundamental dependency on source field extraction.

How to eliminate wrong answers

Option A is wrong because calculated fields are search-time constructs, not index-time; they do not require index-time field extraction. Option C is wrong because a calculated field is defined in props.conf under the [EVAL-<fieldname>] stanza, not in a field alias configuration (which uses [fieldalias] in transforms.conf). Option D is wrong because calculated fields are applied by the search head during search-time processing, not by the indexer; indexers handle indexing and raw data storage, not calculated field evaluation.

Full explanation →
498
Multi-Selecteasy

Which three of the following actions can be performed from the "Save As" menu in the Search app? (Select THREE)

Select 3 answers
A.Save as alert
B.Save as event type
C.Save as search macro
D.Save as report
E.Save as dashboard panel
AnswersA, D, E

Creates an alert based on the search.

Why this answer

The 'Save As' menu in the Search app provides direct options to persist search results as an alert, a report, or a dashboard panel. 'Save as alert' (A) creates a scheduled search that triggers actions when conditions are met, which is a core feature for proactive monitoring.

Exam trap

Splunk often tests the distinction between actions available directly from the search results interface versus those requiring navigation to Settings, leading candidates to mistakenly select 'event type' or 'search macro' as valid 'Save As' options.

Full explanation →
499
MCQmedium

Refer to the exhibit. A data model named 'Web' is built on sourcetype 'web_access'. A user reports that the timestamp field is not being extracted correctly in the data model. What is the most likely issue?

A.The TIME_PREFIX is set to `^` which may not match the timestamp location.
B.The DATETIME_CONFIG file is missing.
C.The TIME_FORMAT does not match the data.
D.The MAX_TIMESTAMP_LOOKAHEAD is too high.
AnswerA

A caret `^` matches the start of the event, but timestamps often appear later.

Why this answer

Option A is correct because the TIME_PREFIX is set to `^`, which may not accurately match the timestamp location in the event. Option B is wrong because MAX_TIMESTAMP_LOOKAHEAD is fine. Option C is wrong because the DATETIME_CONFIG file exists.

Option D is wrong unless the format does not match; but the format looks correct for common web logs.

Full explanation →
500
MCQhard

A financial services company uses Splunk to monitor authentication logs from 500 remote servers. They created a data model named 'Authentication' with 15 fields including 'user', 'src_ip', 'dest_ip', 'action', and 'status'. They enabled acceleration with a summary range of 1 day and set the maximum search time range to 30 days. After one month of operation, searches against the data model that used to complete in seconds now time out after 60 seconds. The average daily log volume is 10 GB. The admin runs | datamodel Audit and discovers that the summary size is approximately 5 GB per day, which is similar to the raw data index size. The search head has 16 GB RAM and 4 CPU cores, and no other resource issues are observed. What is the most likely cause of the performance degradation?

A.Optimize the underlying searches by using indexed field extractions instead of search-time field extractions.
B.Increase the summary range from 1 day to 7 days to reduce the number of summaries.
C.Review the data model fields and remove high-cardinality fields from the acceleration or the data model itself.
D.Reduce the number of fields in the data model to fewer than 10 to improve acceleration efficiency.
AnswerC

High-cardinality fields prevent effective summarization, causing summary size to approach raw data size.

Why this answer

Option B is correct because the summary size being nearly equal to the raw index indicates that the accelerated data is not significantly reduced; this typically happens when the data model has high cardinality fields (like src_ip or user) that produce many unique combinations, preventing effective summarization. Option A is wrong because increasing the summary range would only make the summary larger and exacerbate the problem. Option C is wrong because default field extraction tuning does not directly cause acceleration to fail; the issue is cardinality.

Option D is wrong because the data model design itself is flawed; using all 15 fields in the data model is not the problem—the high cardinality fields are the issue.

Full explanation →
501
MCQeasy

Refer to the exhibit. A Splunk user is building a data model for Apache error logs. The configuration above extracts an error_type field. However, when previewing data in the data model, the error_type field is not available. What is the most likely cause?

A.The regular expression in transforms.conf is incorrectly formatted.
B.The transforms.conf is in the wrong app context.
C.The transform name in props.conf does not match the transform name in transforms.conf.
D.The DEST_KEY is set to _meta, which does not make the field available for data models.
AnswerD

_meta stores the value in internal metadata, not as an indexed or search-time field.

Why this answer

Option D is correct because when DEST_KEY is set to _meta, the extracted field is stored in the internal metadata of the event rather than in the event's indexed fields. Data models rely on indexed fields that are part of the event's key-value structure, so fields stored in _meta are not accessible for data model field extraction or preview.

Exam trap

The trap here is that candidates assume any extracted field is automatically available to data models, but Splunk requires fields to be indexed or written to the event's key-value store, not hidden in metadata like _meta.

How to eliminate wrong answers

Option A is wrong because if the regex were incorrectly formatted, the field would simply not be extracted at all, but the question states the field is extracted yet unavailable in the data model, so the regex is likely correct. Option B is wrong because the app context of transforms.conf only affects whether the configuration is loaded, not whether an extracted field is visible to data models; if it were in the wrong context, the field wouldn't be extracted at all. Option C is wrong because a mismatch between transform names would prevent extraction entirely, resulting in no field being created, whereas the field is extracted but not available in the data model.

Full explanation →
502
MCQhard

A newly created dashboard panel is not displaying data, showing only 'No results found'. The search query works correctly in the Search app. What is the most likely cause?

A.The dashboard has not been shared with the user's role.
B.The search contains a syntax error that is not caught by the dashboard editor.
C.The dashboard's time range picker is set to a different range than the search was tested with.
D.The panel is not based on a saved report.
AnswerC

Time range mismatch is a common cause of 'No results' in dashboard panels.

Why this answer

Option A is correct because dashboards often inherit time range from the dashboard time picker, which may be set to a different time than the search tested. Option B is wrong because permissions affect who sees the dashboard, not whether data appears. Option C is wrong because a dashboard panel doesn't need a saved search.

Option D is wrong because the search works in Search app, so syntax is fine.

Full explanation →
503
MCQhard

Refer to the exhibit. A user runs this search but receives an error. What is the most likely cause?

A.The 'rename' command cannot be used before 'convert'.
B.The 'timeformat' argument is only valid for the 'strftime' function.
C.The 'ctime' function can only be used with the 'eval' command.
D.The 'convert' command requires the field specification before the time format.
AnswerD

The syntax is 'convert <type>(<field>) [as <newfield>] [timeformat=...]' timeformat comes after the function.

Why this answer

The convert command syntax requires the type function (e.g., ctime) before any optional parameters like timeformat. The correct order is 'convert ctime(Time) timeformat="%Y-%m-%d"'. Placing timeformat first causes a syntax error.

Full explanation →
504
Multi-Selecthard

Which THREE of the following are standard components of the Splunk Web Search interface? (Choose three.)

Select 3 answers
A.Commands bar
B.Field sidebar
C.Timeline
D.Job Inspector
E.Search bar
AnswersB, C, E

Correct: The field sidebar shows extracted fields.

Why this answer

Options A, B, and C are correct because the search bar, timeline, and field sidebar are always present in the Search & Reporting app. Option D is incorrect because the Job Inspector is a separate popup that appears only when clicked. Option E is incorrect because there is no 'Commands bar' in the standard interface; search commands are typed in the search bar.

Full explanation →
505
MCQmedium

An administrator notices that a user's search is timing out after 60 seconds. The search needs up to 5 minutes to complete. What should the administrator do?

A.Reduce the time range of the search to run faster.
B.Adjust the 'Search Results Retention' in the user's account preferences.
C.Change the search to a real-time search to avoid timeout.
D.Increase the 'Search Timeout' setting in system settings.
AnswerB

This setting controls how long Splunk waits for results before timing out.

Why this answer

Option B is correct because the 'Search Results Retention' setting in a user's account preferences controls how long Splunk waits for a search to complete before timing out. By default, this is set to 60 seconds, but increasing it to 5 minutes allows the search to run to completion without being terminated prematurely.

Exam trap

The trap here is that candidates often confuse the user-level 'Search Results Retention' timeout with a non-existent global 'Search Timeout' setting, or incorrectly assume that reducing the time range or switching to real-time search is a valid workaround for a long-running historical search.

How to eliminate wrong answers

Option A is wrong because reducing the time range may not address the underlying issue if the search inherently requires up to 5 minutes to process the necessary data; it could also produce incomplete results. Option C is wrong because real-time searches do not have a timeout in the same way, but they continuously run and consume resources, and changing to real-time does not solve the timeout problem for a historical search that needs 5 minutes. Option D is wrong because there is no 'Search Timeout' setting in system settings; the timeout is controlled per user via the 'Search Results Retention' preference, not a global system parameter.

Full explanation →
506
Multi-Selecteasy

Which TWO of the following are valid ways to navigate from a search result to a dashboard?

Select 2 answers
A.Drag a field from the Fields sidebar to the dashboard canvas.
B.Click the 'Dashboard' button on the search bar.
C.Click 'Open in Dashboard' from the search actions menu (ellipsis).
D.Save the search as a report, then add the report to a dashboard panel.
E.Right-click on the timeline and select 'Open in Dashboard'.
AnswersC, D

Available if user has permissions and using Dashboards feature.

Why this answer

Options A and D are correct. Option A: Save search as a report and then add report to dashboard. Option D: Use the 'Open in Dashboard' option directly from the search menu (if using Splunk Dashboards app).

Option B is wrong because there is no 'Dashboard' button on the search bar. Option C is wrong because you cannot directly open a dashboard from the timeline. Option E is wrong because you cannot directly create a dashboard from the fields sidebar.

Full explanation →
507
MCQhard

Refer to the exhibit. What will be the output of this search?

A.All productId values sorted alphabetically
B.ProductId values with count=0
C.The top 10 productId values based on event count
D.The productId and its count for the 10 product IDs with the highest event counts
AnswerD

The search exactly produces that result.

Why this answer

The search uses the `top` command, which by default returns the 10 most frequent values of the specified field (`productId`) based on event count, along with their counts. Option D correctly describes this output: the `productId` and its count for the 10 product IDs with the highest event counts.

Exam trap

Splunk often tests the distinction between `top` returning only the field values versus returning both the field values and their counts, leading candidates to choose Option C when the correct answer is D.

How to eliminate wrong answers

Option A is wrong because the `top` command does not sort alphabetically; it sorts by count in descending order. Option B is wrong because `top` returns values with the highest counts, not count=0; values with zero count are not returned. Option C is wrong because while `top` does return the top 10 based on event count, it also includes the count for each value, not just the productId values alone.

Full explanation →
508
MCQmedium

An analyst runs `| inputlookup mylookup.csv` but gets no results. The lookup file exists. What is the most likely cause?

A.The file is not in the correct lookup directory.
B.The search time range is too narrow.
C.The lookup command requires an output fields.
D.The file is not sorted.
AnswerA

The file must be in the lookup directory specified in props.conf or the default lookups folder.

Why this answer

The `| inputlookup` command reads lookup files only from the lookups directory within the current app or from the system-level lookups directory. If the file exists elsewhere on the filesystem (e.g., in a custom path or the user's home directory), the command will return no results. This is the most likely cause because the error is not about the file's existence but about its location relative to Splunk's expected lookup paths.

Exam trap

Splunk often tests the misconception that `| inputlookup` works like a standard file read command, leading candidates to overlook the strict directory requirement and instead blame time range or file formatting issues.

How to eliminate wrong answers

Option B is wrong because `| inputlookup` does not depend on the search time range; it loads the entire static lookup file regardless of time. Option C is wrong because `| inputlookup` does not require an `outputfields` argument; it returns all fields in the lookup file by default. Option D is wrong because lookup files do not need to be sorted for `| inputlookup` to work; sorting is only relevant for certain lookup operations like `| lookup` with `max_matches` or performance optimizations, not for basic file loading.

Full explanation →
509
Multi-Selectmedium

A user wants to find events where the status code is 500 or 503 and the response time is greater than 2 seconds. Which TWO SPL commands will correctly limit the results to only these events?

Select 2 answers
A.status=500,503 AND response_time>2
B.search status=500 OR status=503 response_time>2
C.status=500 OR status=503 | where response_time>2
D.search (status=500 OR status=503) AND response_time>2
E.status IN (500,503) | where response_time>2
AnswersD, E

This correctly groups the OR conditions and applies the AND operator.

Why this answer

Option D is correct because it uses the `search` command with explicit parentheses to group the OR conditions, ensuring the logical AND with `response_time>2` applies to the entire set of status codes. This matches the requirement to find events where status is 500 or 503 AND response time exceeds 2 seconds.

Exam trap

Splunk often tests the misconception that commas can substitute for OR operators in SPL, or that omitting parentheses in a mixed AND/OR expression will still yield correct results due to assumed left-to-right evaluation.

Full explanation →
510
MCQeasy

A user wants to quickly see the count of events per source type over the last hour without performing a search. Which Splunk Web feature provides this information with the fewest clicks?

A.Click the Field sidebar in the Search app.
B.Navigate to Settings > Data Inputs to view event counts.
C.Use the Data Summary page on the Splunk Home page.
D.Use the Search & Reporting app and run a search with | stats count by sourcetype.
AnswerC

Correct: Data Summary provides quick event counts per source type.

Why this answer

Option A is correct because the Data Summary page on the Splunk Home page shows a breakdown of events by source type, host, and source, with counts, without requiring a search. Option B is incorrect because the Search & Reporting app requires entering a search. Option C is incorrect because Settings > Data Inputs is for configuration, not data viewing.

Option D is incorrect because the Field sidebar appears only during a search.

Full explanation →
Page 6

Page 7 of 7

All pages

1234567

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Splunk Basics and Interface NavigationBasic Searching and Transforming CommandsUsing Fields and LookupsCreating Reports, Dashboards and VisualizationsData Models and Best Practices
See all domains with question counts →