Practise Splunk Core Certified User SPLK-1002 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.
These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.
Quick answer
Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Related SPLK-1001 topic practice pages
Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.
You are a Splunk administrator at a large e-commerce company. The operations team has created a real-time dashboard to monitor website performance. The dashboard includes multiple panels: a line chart showing page load times over the last 60 minutes, a single value showing the number of active users, and a table listing the top 10 slowest pages. The dashboard refreshes every 30 seconds. Recently, users have reported that the dashboard is very slow to load and sometimes times out. The underlying searches are not accelerated. The dashboard uses a shared time range picker set to 'Last 60 minutes'. The index for web logs receives about 2 GB of data per hour. The team wants to improve performance without losing real-time capability. Which approach best addresses the problem?
A
Reduce the time range to 'Last 15 minutes' and keep the 30-second refresh.
Less data improves load time, still real-time.
B
Increase the refresh interval to 5 minutes to reduce search frequency.
Why wrong: Reduces freshness, not real-time.
C
Implement summary indexing for the searches and run them every 5 minutes.
Why wrong: Not real-time, adds delay.
D
Remove the single value panel to reduce the number of searches.
Why wrong: Doesn't address root cause (data volume).
Refer to the exhibit. An admin sees that the Web_Traffic data model is accelerated but shows 'Summaries require rebuild'. What does this status indicate?
Exhibit
| datamodel list
Data model App Type Accelerated? Status
Web_Traffic search root Yes Summaries require rebuild
Error_Logs search root No -
A
The disk space for acceleration is full.
Why wrong: Disk space issues would show a different error.
B
The summary range is too short and needs to be extended.
Why wrong: Summary range does not cause this status.
C
The acceleration summaries are up to date and optimal.
Why wrong: This status indicates a problem, not optimal state.
D
The data model definition has been modified and acceleration needs to be rebuilt.
Changes to the model require rebuilding summaries.
A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:
The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?
A
Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.
Why wrong: eventstats does not reduce events, still processes all.
B
Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.
Why wrong: Transaction is more resource-intensive than stats.
C
Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.
Why wrong: Internal IPs are not filtered early, still processes all data.
D
Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.
Filters early, uses efficient stats, then filters and sorts on reduced data.
A Splunk administrator notices that a new user cannot see any data in the Search & Reporting app, even though the user has the 'user' role. What is the most likely cause?
A
The user has not been granted access to any indexes.
Index access must be explicitly assigned to roles.
B
The user does not have the 'search' capability.
Why wrong: The 'user' role includes the search capability.
C
The user is limited to viewing only saved searches.
Why wrong: The user role can run ad-hoc searches.
D
The user is not using the correct time range.
Why wrong: Time range affects results, but no data at all suggests permission issue.
A security team uses a KV Store lookup to track threat intelligence indicators (IPs, domains) with a field 'indicator' and a field 'threat_type'. They regularly update the KV Store with new indicators. The team notices that searches using the lookup are very slow when the KV Store contains over 100,000 entries. They want to improve lookup performance without losing the ability to update frequently. Which approach should they take?
A
Split the KV Store into multiple smaller KV Stores based on threat_type
Why wrong: This adds complexity and might not improve performance if each lookup still queries a large collection.
B
Convert the KV Store to a CSV file and use the lookup command
Why wrong: CSV lookups are loaded into memory and can be slow for large files, and updates are not as flexible.
C
Add an index on the 'indicator' field in the KV Store collection to speed up lookup queries
Indexing the lookup field reduces search time when matching events.
D
Increase the memory allocation for the Splunk search head
Why wrong: While more memory might help, the root cause is lack of indexing on the KV Store field.
A large enterprise uses Splunk to monitor 500+ servers. A search returns results slowly due to high data volume. Which best practice can improve performance when using the top command?
A
Use the fields command to remove unnecessary fields
Why wrong: While fields can help, top's performance is more affected by input size and the number of distinct values, not fields.
B
Use rare instead of top to reduce output
Why wrong: Rare can be even slower as it requires full aggregation first.
C
Add a limit to top, e.g., top limit=20
Limiting results reduces memory and CPU overhead for top.
D
Apply the sort command before top
Why wrong: sort before top is unnecessary and can slow the search.
A user has a search that produces a chart of error counts by host. They want to add a calculated field 'error_rate' as errors per million events. Which approach is correct?
A
Use eventstats to get total counts, then eval to compute rate, then chart
eventstats adds aggregate counts to each event.
B
Use chart eval(error_count/total_count) by host
Why wrong: chart does not support eval within.
C
Use stats to compute error_rate directly: stats avg(error_rate) by host
Why wrong: error_rate field not defined yet.
D
Use the lookup command to apply a calculated field
Why wrong: lookup is for external data, not calculation.
A financial services company uses Splunk to monitor authentication logs from 500 remote servers. They created a data model named 'Authentication' with 15 fields including 'user', 'src_ip', 'dest_ip', 'action', and 'status'. They enabled acceleration with a summary range of 1 day and set the maximum search time range to 30 days. After one month of operation, searches against the data model that used to complete in seconds now time out after 60 seconds. The average daily log volume is 10 GB. The admin runs | datamodel Audit and discovers that the summary size is approximately 5 GB per day, which is similar to the raw data index size. The search head has 16 GB RAM and 4 CPU cores, and no other resource issues are observed. What is the most likely cause of the performance degradation?
A
Optimize the underlying searches by using indexed field extractions instead of search-time field extractions.
Why wrong: This may help search performance but does not address the acceleration summary size issue.
B
Increase the summary range from 1 day to 7 days to reduce the number of summaries.
Why wrong: A longer summary range would create larger summaries, worsening performance.
C
Review the data model fields and remove high-cardinality fields from the acceleration or the data model itself.
High-cardinality fields prevent effective summarization, causing summary size to approach raw data size.
D
Reduce the number of fields in the data model to fewer than 10 to improve acceleration efficiency.
Why wrong: The number of fields is not the issue; it is the cardinality of those fields.
An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?
A
The lookup is configured as time-based and is out of range
Why wrong: KV Store lookups are not time-based.
B
The IP addresses are case-sensitive and messy
Why wrong: IPs are case-insensitive; case not an issue.
C
The search does not include the _raw field
Why wrong: _raw is not needed for lookup matching.
D
The KV Store lookup is cached and not refreshed between searches
Caching can cause latency; disable caching or force refresh.
A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?
A
Use the `| datamodel <model> search` command to preview data and identify missing fields.
This command shows raw data and field values, helping to pinpoint missing fields.
B
Rebuild the data model acceleration.
Why wrong: Rebuilding acceleration may not fix field population issues.
C
Increase the acceleration time range.
Why wrong: Acceleration time range affects data retention, not field population.
D
Check the field extractions in transforms.conf.
Why wrong: Field extractions are important but not the most effective first step.
Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?
Exhibit
| inputlookup app_errors.csv | where severity > 3 | stats count by app, error_type | sort -count | head 10
A
The time range is set to a period with no data
Why wrong: Inputlookup is not time-bound.
B
The lookup file is not defined as a lookup table in Splunk
A newly created dashboard panel is not displaying data, showing only 'No results found'. The search query works correctly in the Search app. What is the most likely cause?
A
The dashboard has not been shared with the user's role.
Why wrong: Permissions affect visibility, not data display.
B
The search contains a syntax error that is not caught by the dashboard editor.
Why wrong: If the search works in Search app, there is no syntax error.
C
The dashboard's time range picker is set to a different range than the search was tested with.
Time range mismatch is a common cause of 'No results' in dashboard panels.
D
The panel is not based on a saved report.
Why wrong: Panels can use inline searches; saved reports are optional.
These SPLK-1001 practice questions are part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style SPLK-1001 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.