Splunk Basics and Interface Navigation →hardMultiple ChoiceObjective-mapped

SPLK-1001 Splunk Basics and Interface Navigation Practice Question

Exhibit

Refer to the exhibit.

```
2018-03-12 14:23:45,123 INFO  SearchJobManager - Starting search job: sid=1234567890.1
2018-03-12 14:23:45,456 INFO  SearchJobExecutor - Search 'error_count' started
2018-03-12 14:23:50,789 INFO  SearchJobExecutor - Search 'error_count' completed: 1000 events scanned, 10 results
2018-03-12 14:23:55,012 WARN  SearchJobManager - Search job 'error_count' consumed 80% CPU on search head
2018-03-12 14:24:00,123 INFO  SearchJobManager - Starting search job: sid=1234567890.2
2018-03-12 14:24:02,456 INFO  SearchJobExecutor - Search 'login_failures' started
2018-03-12 14:24:10,789 INFO  SearchJobExecutor - Search 'login_failures' completed: 50000 events scanned, 200 results
2018-03-12 14:24:15,012 INFO  SearchJobManager - Search job 'login_failures' consumed 20% CPU
```

The exhibit shows log output from a Splunk search head. What is the most likely performance issue indicated?

⚠ Common exam trap

In Splunk, a search that scans a large number of events but returns a small number of results is a sign of inefficiency. Such searches often lack proper indexing or use unoptimized commands like 'search' without time bounds. This is a common performance issue tested on the Splunk Core Certified User exam.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The 'error_count' search is inefficient, consuming high CPU for few results.

The 'error_count' search is inefficient because it likely uses a large, unoptimized search over many events to produce a small count, consuming high CPU. This is a classic case of a search that scans too much data for minimal output, often due to missing index-time optimizations or using inefficient commands like 'search error_count' without narrowing the time range or using indexed fields.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The 'error_count' search is inefficient, consuming high CPU for few results.
Why this is correct
80% CPU for 1000 events is excessive.
✗
The 'login_failures' search is scanning too many events.
Why it's wrong here
Scanned 50000 events is normal; only 20% CPU.
✗
The search head is overloaded due to multiple simultaneous searches.
Why it's wrong here
Only two searches, not overloaded.
✗
There are duplicate search job IDs (SIDs) conflicting.
Why it's wrong here
SIDs are different.

Go deeper

SPLK-1001 Splunk Basics and Interface Navigation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question