How many Troubleshooting Scenario Questions questions are on this page?

This page has 8 Troubleshooting Scenario Questions scenario questions for the SPLK-1002 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SPLK-1002 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Splunk Core Certified User SPLK-1002 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Splunk Core Certified User SPLK-1002 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SPLK-1002

exam code

Splunk

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

A
Data Summary
Why wrong: Data Summary lists sourcetypes and indexes, not search results.
B
Dashboard panel
Why wrong: Dashboards display saved searches, not ad-hoc queries.
C
Alert action
Why wrong: Alerts send notifications based on saved searches, not immediate investigation.
D
Search bar in the Search & Reporting app
The search bar allows running a query across all data.

Full breakdown with real-world context →

Question 2mediumdrag order

Full question →

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3hardmultiple choice

Full question →

A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?

A
Use the `| datamodel <model> search` command to preview data and identify missing fields.
This command shows raw data and field values, helping to pinpoint missing fields.
B
Rebuild the data model acceleration.
Why wrong: Rebuilding acceleration may not fix field population issues.
C
Increase the acceleration time range.
Why wrong: Acceleration time range affects data retention, not field population.
D
Check the field extractions in transforms.conf.
Why wrong: Field extractions are important but not the most effective first step.

Full breakdown with real-world context →

Question 4hardmulti select

Full question →

Which THREE are valid considerations when troubleshooting data model acceleration? (Choose three.)

A
The summary index must be writable and have enough disk space.
Acceleration writes summaries to a summary index; it must be writable.
B
Too many fields in the data model can cause acceleration to fail.
Why wrong: Many fields may reduce performance but do not cause failure.
C
The data model must be based on a real-time search to be accelerated.
Why wrong: Acceleration works on historical time ranges, not only real-time.
D
Insufficient memory on the indexer for the summary build process.
Memory shortage can halt acceleration builds.
E
The base search for the data model must be efficient and not timeout.
A slow or timing out base search prevents acceleration from completing.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A Splunk admin is troubleshooting a slow report that uses an accelerated data model. The report uses tstats commands and filters on a field that is not a constraint field in the data model. Which of the following best explains why the report is slow?

A
The acceleration summary for that data model has not been rebuilt recently, causing outdated data.
Why wrong: Outdated summary would affect accuracy, not speed.
B
The report is using the data model incorrectly; it should use |datamodel instead of |tstats.
Why wrong: tstats is the recommended way to search accelerated data models.
C
The field used in the filter is not defined as a constraint field in the data model, so tstats cannot use acceleration for that filter.
Filtering on non-constraint fields forces full event search.
D
The time range is too broad, causing the acceleration summary to include too many events.
Why wrong: Broad time range might be slower but not specifically due to field type.

Full breakdown with real-world context →

Question 6hardmulti select

Full question →

A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)

A
The lookup table must have exactly one row per unique time value
Why wrong: Multiple rows may have the same time value, but only one should match the event's time range for a proper match.
B
The lookup must be defined as an automatic lookup in props.conf
Why wrong: Automatic lookups are optional; you can use the lookup command in searches.
C
The lookup definition must specify the time format used in the time_field column
The time_format must match the format in the lookup file for correct parsing.
D
The event's timestamp (or a specified time field) must fall between the start_time and the end_time of a row
Time-based lookups match if the event time is within the row's time range.
E
The event must match at most one row in the lookup table for the given time range
If multiple rows match, the behavior is undefined; the lookup should be designed to yield a single match.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

A Splunk administrator is troubleshooting a slow search on firewall logs. The index is 'firewall', sourcetype is 'cisco:asa', and there is about 500 GB of data per day. The search is: index=firewall sourcetype=cisco:asa action=block | stats count by src_ip | where count > 1000. This search takes over 5 minutes to return results. The administrator needs the same results faster. The index has a data model named 'firewall_dm' that is accelerated with a summary range of 7 days. Which change to the search will improve performance the most while still returning the same results?

A
Add | stats count by src_ip, _time to the search
Why wrong: Adding _time increases the number of groups and slows down the search.
B
Change to | tstats count from datamodel=firewall_dm where action=block by src_ip | where count > 1000
tstats uses the accelerated data model, drastically reducing the amount of data scanned.
C
Add | fields src_ip before the stats command
Why wrong: Limiting fields can help, but the main bottleneck is scanning raw data; this provides minimal improvement.
D
| search action=block instead of placing action=block in the base search
Why wrong: This is a syntax change; it does not affect performance significantly.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A company uses Splunk to monitor web server logs. They have a lookup table that maps IP addresses to geographic locations (city, country). The lookup is defined as a CSV file with fields: ip, city, country. The lookup definition is named 'geo'. The team wants to automatically add city and country to every web event at index time, so that all future searches have this enrichment without adding the lookup command. The team tries to set up an automatic lookup in props.conf for the sourcetype 'web_access', but the city and country fields still do not appear in the events. They verify that the lookup file exists and that the lookup definition works when used manually with the lookup command. What is the most likely cause of the automatic lookup not working?

A
Index-time lookups are not supported; enrichment can only be done at search time
Why wrong: Splunk does support index-time lookups via automatic lookups in props.conf, though search-time is more common.
B
The lookup file must be in KV Store format for index-time lookups
Why wrong: CSV files are acceptable for index-time lookups.
C
The lookup must be invoked with the 'lookup' command in the search to populate the fields
Why wrong: Automatic lookups are designed to work without explicit commands.
D
The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype
If the props.conf stanza does not match the sourcetype, the lookup will not be applied.

Full breakdown with real-world context →

These SPLK-1002 practice questions are part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style SPLK-1002 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SPLK-1002 topic practice pages

Splunk Basics and Interface Navigation practice questions

Basic Searching and Transforming Commands practice questions

Using Fields and Lookups practice questions

Creating Reports, Dashboards and Visualizations practice questions

Data Models and Best Practices practice questions

SPLK-1002 fundamentals practice questions

SPLK-1002 scenario practice questions

SPLK-1002 troubleshooting practice questions

Practice scenarios

A security analyst wants to investigate a suspicious IP address that appeared in multiple log sources. Which Splunk feature is best suited to quickly find all events containing that IP across all indexed data?

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?

Which THREE are valid considerations when troubleshooting data model acceleration? (Choose three.)

A Splunk admin is troubleshooting a slow report that uses an accelerated data model. The report uses tstats commands and filters on a field that is not a constraint field in the data model. Which of the following best explains why the report is slow?