Troubleshooting practice questions

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2hardmultiple choice

A team has created a data model based on sourcetypes from different sources. Some fields are not populating correctly in Pivot. Which of the following is the most effective troubleshooting step?

Trap 1: Rebuild the data model acceleration.

Rebuilding acceleration may not fix field population issues.

Trap 2: Increase the acceleration time range.

Acceleration time range affects data retention, not field population.

Trap 3: Check the field extractions in transforms.conf.

Field extractions are important but not the most effective first step.

A
Use the `| datamodel <model> search` command to preview data and identify missing fields.
This command shows raw data and field values, helping to pinpoint missing fields.
B
Rebuild the data model acceleration.
Why wrong: Rebuilding acceleration may not fix field population issues.
C
Increase the acceleration time range.
Why wrong: Acceleration time range affects data retention, not field population.
D
Check the field extractions in transforms.conf.
Why wrong: Field extractions are important but not the most effective first step.

Question 3hardmulti select

Which THREE are valid considerations when troubleshooting data model acceleration? (Choose three.)

Trap 1: Too many fields in the data model can cause acceleration to fail.

Many fields may reduce performance but do not cause failure.

Trap 2: The data model must be based on a real-time search to be…

Acceleration works on historical time ranges, not only real-time.

A
The summary index must be writable and have enough disk space.
Acceleration writes summaries to a summary index; it must be writable.
B
Too many fields in the data model can cause acceleration to fail.
Why wrong: Many fields may reduce performance but do not cause failure.
C
The data model must be based on a real-time search to be accelerated.
Why wrong: Acceleration works on historical time ranges, not only real-time.
D
Insufficient memory on the indexer for the summary build process.
Memory shortage can halt acceleration builds.
E
The base search for the data model must be efficient and not timeout.
A slow or timing out base search prevents acceleration from completing.

Question 4hardmultiple choice

A Splunk admin is troubleshooting a slow report that uses an accelerated data model. The report uses tstats commands and filters on a field that is not a constraint field in the data model. Which of the following best explains why the report is slow?

Trap 1: The acceleration summary for that data model has not been rebuilt…

Outdated summary would affect accuracy, not speed.

Trap 2: The report is using the data model incorrectly; it should use…

tstats is the recommended way to search accelerated data models.

Trap 3: The time range is too broad, causing the acceleration summary to…

Broad time range might be slower but not specifically due to field type.

A
The acceleration summary for that data model has not been rebuilt recently, causing outdated data.
Why wrong: Outdated summary would affect accuracy, not speed.
B
The report is using the data model incorrectly; it should use |datamodel instead of |tstats.
Why wrong: tstats is the recommended way to search accelerated data models.
C
The field used in the filter is not defined as a constraint field in the data model, so tstats cannot use acceleration for that filter.
Filtering on non-constraint fields forces full event search.
D
The time range is too broad, causing the acceleration summary to include too many events.
Why wrong: Broad time range might be slower but not specifically due to field type.

Question 5hardmulti select

A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)

Trap 1: The lookup table must have exactly one row per unique time value

Multiple rows may have the same time value, but only one should match the event's time range for a proper match.

Trap 2: The lookup must be defined as an automatic lookup in props.conf

Automatic lookups are optional; you can use the lookup command in searches.

A
The lookup table must have exactly one row per unique time value
Why wrong: Multiple rows may have the same time value, but only one should match the event's time range for a proper match.
B
The lookup must be defined as an automatic lookup in props.conf
Why wrong: Automatic lookups are optional; you can use the lookup command in searches.
C
The lookup definition must specify the time format used in the time_field column
The time_format must match the format in the lookup file for correct parsing.
D
The event's timestamp (or a specified time field) must fall between the start_time and the end_time of a row
Time-based lookups match if the event time is within the row's time range.
E
The event must match at most one row in the lookup table for the given time range
If multiple rows match, the behavior is undefined; the lookup should be designed to yield a single match.

Question 6hardmultiple choice

A Splunk administrator is troubleshooting a slow search on firewall logs. The index is 'firewall', sourcetype is 'cisco:asa', and there is about 500 GB of data per day. The search is: index=firewall sourcetype=cisco:asa action=block | stats count by src_ip | where count > 1000. This search takes over 5 minutes to return results. The administrator needs the same results faster. The index has a data model named 'firewall_dm' that is accelerated with a summary range of 7 days. Which change to the search will improve performance the most while still returning the same results?

Trap 1: Add | stats count by src_ip, _time to the search

Adding _time increases the number of groups and slows down the search.

Trap 2: Add | fields src_ip before the stats command

Limiting fields can help, but the main bottleneck is scanning raw data; this provides minimal improvement.

Trap 3: | search action=block instead of placing action=block in the base…

This is a syntax change; it does not affect performance significantly.

A
Add | stats count by src_ip, _time to the search
Why wrong: Adding _time increases the number of groups and slows down the search.
B
Change to | tstats count from datamodel=firewall_dm where action=block by src_ip | where count > 1000
tstats uses the accelerated data model, drastically reducing the amount of data scanned.
C
Add | fields src_ip before the stats command
Why wrong: Limiting fields can help, but the main bottleneck is scanning raw data; this provides minimal improvement.
D
| search action=block instead of placing action=block in the base search
Why wrong: This is a syntax change; it does not affect performance significantly.

Question 7easymultiple choice

A support technician is troubleshooting a user who cannot see the 'Field sidebar' and 'Timeline' in the Search & Reporting app. The user says that when they run a search, they only see the results in a table format, but no side panels or timeline below the search bar. The technician checks the user's settings and finds that the user's default app is set to 'Search & Reporting'. The technician then looks at the user's browser and notices that the user has a very small browser window. What is the most likely cause of the missing panels?

Trap 1: The user's default app is set incorrectly.

Incorrect: It's set to Search & Reporting.

Trap 2: The user has disabled the timeline in their preferences.

Incorrect: There is no such user preference.

Trap 3: The user's role does not have permission to view the timeline.

Incorrect: The timeline is not permission-based.

A
The user's default app is set incorrectly.
Why wrong: Incorrect: It's set to Search & Reporting.
B
The user has disabled the timeline in their preferences.
Why wrong: Incorrect: There is no such user preference.
C
The browser window is too small, causing panels to be hidden by the responsive interface.
Correct: Small windows hide side panels in Splunk Web.
D
The user's role does not have permission to view the timeline.
Why wrong: Incorrect: The timeline is not permission-based.