hardMultiple ChoiceObjective-mapped
SPLK-1001 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit.
Data model definition:
{
"dataModel": {
"objectName": "Authentication",
"fieldList": [
{"fieldName": "user", "type": "string"},
{"fieldName": "action", "type": "string"},
{"fieldName": "src_ip", "type": "ip"},
{"fieldName": "_time", "type": "time"},
{"fieldName": "duration", "type": "number"}
],
"constraints": [
{"field": "action", "comparison": "IN", "value": ["login", "logout"]}
],
"acceleration": {
"enabled": true,
"summaryRange": "1d",
"maxTime": "30d"
}
}
}Refer to the exhibit. A Splunk admin runs a search using the 'Authentication' data model and notices that the search does not use the acceleration summaries. The admin confirms that acceleration is enabled and the summary range is set correctly. What is the most likely reason for the acceleration being ignored?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The constraints are not restrictive enough to reduce the data volume.
The data model does not have a required field constraint on _time; however, for acceleration to be effective, the data model must include a constraint that filters a significant portion of data, typically based on time. In this definition, the only constraint is on 'action', which does not reduce the data enough, causing Splunk to decide not to use acceleration because it would not be efficient. Option A is wrong because there is no missing timestamp; _time is present. Option B is wrong because maxTime does not affect whether acceleration is used; it sets the maximum retention. Option D is wrong because the data model is correctly defined with constraints in the JSON.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The data model definition is invalid because constraints are required in the JSON.
Why it's wrong here
The JSON is valid; constraints are optional.
- ✗
The data model does not include a timestamp field.
Why it's wrong here
The data model includes _time as a field.
- ✓
The constraints are not restrictive enough to reduce the data volume.
Why this is correct
Acceleration is only used when the constraints significantly reduce the dataset; otherwise, Splunk may bypass it.
- ✗
The maxTime setting is too short for the search time range.
Why it's wrong here
maxTime does not prevent acceleration from being used; it only limits retention.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.