hardMultiple ChoiceObjective-mapped
SPLK-1001 Practice Question: A Splunk administrator at a financial services…
You are a Splunk administrator at a financial services company. The company has a distributed Splunk environment with 10 indexers and 2 search heads. You have created a data model named 'transaction_analytics' to analyze financial transactions. The data model is accelerated with a summary range of 7 days. Recently, users have reported that dashboards using this data model are extremely slow, sometimes timing out. You check the acceleration status and see that the summary is 'Building' but never completes. The splunkd.log on the search head shows repeated messages: 'Data model acceleration: query timed out after 300 seconds.' The base search for the data model is: index=transactions sourcetype=fin_events | eval risk_score=if(amount>10000, 'high', 'low') | fields transaction_id, user, amount, risk_score, _time. The data model has one root event with two child datasets: one for high-risk transactions and one for low-risk transactions. The total data volume is about 500 GB per day. The indexer where the summary is built has 16 GB of RAM and the search head has 32 GB. What is the best course of action to resolve the acceleration build timeout?
⚠ Common exam trap
The trap here is that candidates often focus on increasing timeouts or reducing data volume (options B and D) instead of recognizing that expensive eval operations in the base search are the true bottleneck, and that index-time field extraction is the proper Splunk best practice for acceleration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the base search to remove the eval statement and instead use a lookup or index-time field for risk_score.
The eval statement in the base search forces the acceleration to process every raw event during the summary build, which is computationally expensive and causes the 300-second timeout. By moving the risk_score calculation to index time (e.g., using a calculated field or lookup), the acceleration can use the pre-computed field directly from the indexed data, drastically reducing CPU load and allowing the summary to complete within the timeout window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the base search to remove the eval statement and instead use a lookup or index-time field for risk_score.
Why this is correct
Removing the expensive eval reduces search-time computation, allowing the acceleration build to complete within the timeout period.
- ✗
Reduce the summary range to 1 day to limit the amount of data processed.
Why it's wrong here
Reducing summary range reduces data but the underlying slow eval will still cause timeout on the remaining data; not a robust solution.
- ✗
Disable acceleration and rely on real-time searches for the dashboards.
Why it's wrong here
Real-time searches on 500 GB/day will be extremely slow and cause dashboard timeouts.
- ✗
Increase the acceleration.max_time to 600 seconds to allow more time for the build.
Why it's wrong here
Increasing timeout may cause the build to consume more resources and potentially fail again; it does not address the slow base search.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.