Courseiva
← Back to Splunk Core Certified User SPLK-1002 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Splunk Core Certified User SPLK-1002 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
SPLK-1001
exam code
Splunk
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related SPLK-1001 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Splunk Basics and Interface Navigation practice questions

Sharpen your SPLK-1001 knowledge of Splunk Basics and Interface Navigation.

Basic Searching and Transforming Commands practice questions

Sharpen your SPLK-1001 knowledge of Basic Searching and Transforming Commands.

Using Fields and Lookups practice questions

Work through SPLK-1001 questions on Using Fields and Lookups.

Creating Reports, Dashboards and Visualizations practice questions

Practise SPLK-1001 questions linked to Creating Reports, Dashboards and Visualizations.

SPLK-1001 fundamentals practice questions

Practise SPLK-1001 questions linked to SPLK-1001 fundamentals.

SPLK-1001 scenario practice questions

Sharpen your SPLK-1001 knowledge of SPLK-1001 scenario.

SPLK-1001 troubleshooting practice questions

Work through SPLK-1001 questions on SPLK-1001 troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice
Full question →

Refer to the exhibit. An admin sees that the Web_Traffic data model is accelerated but shows 'Summaries require rebuild'. What does this status indicate?

Exhibit

| datamodel list
Data model  App       Type   Accelerated?  Status
Web_Traffic  search   root   Yes           Summaries require rebuild
Error_Logs   search   root   No            -
Question 2hardmultiple choice
Full question →

Refer to the exhibit. A security analyst runs a search to identify HTTP 500 errors over time. Which time period shows the highest count of 500 errors?

Exhibit

index=web sourcetype=access_combined status=500 | timechart count by status span=1h

Time, count
2023-01-01 00:00:00, 23
2023-01-01 01:00:00, 45
2023-01-01 02:00:00, 12
2023-01-01 03:00:00, 67
2023-01-01 04:00:00, 89
2023-01-01 05:00:00, 34
2023-01-01 06:00:00, 56
2023-01-01 07:00:00, 78
Question 3easymultiple choice
Full question →

Refer to the exhibit. The user wants to display the count over time for each source. However, the chart shows only one line labeled 'MyCount'. What is the problem?

Exhibit

index=apache | timechart count by source | rename count as "MyCount"
Question 4mediummultiple choice
Full question →

Refer to the exhibit. The search returns no results from the lookup. What is the most likely issue?

Exhibit

Refer to the exhibit.

props.conf:
[apache_error]
FIELDALIAS-error_code = error_id AS error_code

Transforms.conf:
[error_code_lookup]
filename = error_codes.csv

Search:
index=web sourcetype=apache_error | lookup error_code_lookup error_id OUTPUT error_description

The search returns no results from the lookup. What is the most likely issue?
Question 5mediummultiple choice
Full question →

Refer to the exhibit. A user runs the search shown. The search returns results, but the user wants to use a data model to make future searches faster and more consistent. Which data model should the user select and what is the correct acceleration setting?

Exhibit

Refer to the exhibit.

index=web sourcetype=access_combined | stats count by status | where count > 1000
Question 6hardmultiple choice
Full question →

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Exhibit

| inputlookup app_errors.csv | where severity > 3 | stats count by app, error_type | sort -count | head 10
Question 7easymultiple choice
Full question →

Refer to the exhibit. A Splunk user is building a data model for Apache error logs. The configuration above extracts an error_type field. However, when previewing data in the data model, the error_type field is not available. What is the most likely cause?

Exhibit

Refer to the exhibit.

# props.conf
[apache_error]
TRANSFORMS-set = set_error_type

# transforms.conf
[set_error_type]
REGEX = \[(error|warn|info)\]
FORMAT = error_type::$1
DEST_KEY = _meta
Question 8hardmultiple choice
Full question →

Refer to the exhibit. The search returns zero results. What is a likely cause?

Exhibit

index=app sourcetype=json_logs
 | spath input=raw_data path=response.status
 | search response.status=200
 | stats count by response.status
Question 9hardmultiple choice
Full question →

Refer to the exhibit. An analyst runs this search and expects to see a table of status codes with their counts, filtered to those with count greater than 100. The search returns zero results even though there are many events. What is the most likely reason?

Exhibit

index=weblogic sourcetype=accesslog
| rex "status=(?<status_code>\d+)"
| stats count by status_code
| where count > 100
Question 10hardmultiple choice
Full question →

Refer to the exhibit. The search runs but the user field is not modified. What is the most likely cause?

Exhibit

Refer to the exhibit.
index=main | eval user=lowercase(user)
Question 11easymultiple choice
Full question →

Refer to the exhibit. The report returns 0 results even though there are error events in the data. What is the most likely issue?

Exhibit

| inputlookup user_activity.csv
| search error=*
| stats count by user
| sort - count
| head 10
Question 12hardmultiple choice
Full question →

Refer to the exhibit. What will be the output of this search?

Exhibit

index=web sourcetype=access status=200 | stats count by productId | sort - count | head 10
Question 13easymultiple choice
Full question →

Refer to the exhibit. Which visualization is most appropriate for this data?

Exhibit

index=security sourcetype=linux_secure | stats count by action | sort -count
Question 14hardmultiple choice
Full question →

Refer to the exhibit. The search returns no results. What is the most likely reason?

Exhibit

index=security sourcetype=linux_secure
 | regex _raw="Failed password for .* from (?<src_ip>\d+\.\d+\.\d+\.\d+)"
 | top 5 src_ip
Question 15hardmultiple choice
Full question →

Refer to the exhibit. A user scheduled a report but it never runs. Which of the following is the most likely reason?

Exhibit

[saved_search_name]
search = index=main sourcetype=access | stats count by status
cron_schedule = * * * *

These SPLK-1001 practice questions are part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style SPLK-1001 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.