hardMultiple ChoiceObjective-mapped
SPLK-1001 Practice Question: An admin for a large healthcare organization that…
You are an admin for a large healthcare organization that uses Splunk for compliance monitoring. You have a data model named 'Patient_Access' that tracks access to patient records. The data model includes fields like 'employee_id', 'patient_id', 'access_time', and 'action'. The data model is accelerated with a 30-day summary. Recently, a new compliance report requires filtering on a field named 'department', which is not currently part of the data model. You add 'department' as a new field to the root event of the data model. After this change, reports using the data model become slower. The data model's acceleration summary size has significantly increased. What is the most likely reason for the slowdown?
⚠ Common exam trap
A common mix-up: candidates assume high cardinality (Option C) is the culprit, but the real issue is the lack of a constraint on the new field, which forces the summary to store data for all events, regardless of cardinality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adding the field required the acceleration summary to be rebuilt, and the new field increased the summary size because it is not constrained.
When a new field is added to the root event of an accelerated data model, the acceleration summary must be rebuilt to include that field. Because the 'department' field is not constrained (i.e., it is not part of a constraint that limits which events are included), the summary now stores values for this field across all events, significantly increasing the summary size. This larger summary takes more time to scan and process, causing queries to become slower.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adding the field required the acceleration summary to be rebuilt, and the new field increased the summary size because it is not constrained.
Why this is correct
Adding a field increases the data stored in acceleration summaries.
- ✗
The data model must be re-accelerated manually after adding a field, and the admin did not do so.
Why it's wrong here
Splunk automatically rebuilds acceleration after a data model change.
- ✗
The 'department' field has a high number of unique values, and the acceleration summary cannot handle high-cardinality fields efficiently.
Why it's wrong here
While high cardinality can affect performance, the primary issue is summary size.
- ✗
The new field caused the root event constraint to become more inclusive, adding more events.
Why it's wrong here
Constraints are unchanged; only a field was added.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.