Free SPLK-1004 sample questions

Correct answer: Implement a base search that runs the initial data retrieval (`index=transactions earliest=-15m`) and use post-process searches in each panel to perform the specific aggregations.

The most efficient solution is to use a base search with post-processing. A single base search retrieves the raw data once, and its results are cached. Each panel's post-process search then runs against this small, cached result set, which is significantly faster than each panel running a full search against the entire index. This design pattern minimizes the load on the indexers and dramatically improves dashboard performance, especially when multiple panels query the same base data.

Correct answer: `sourcetype=vpn_logs | stats earliest(_time) as start_time, latest(_time) as end_time, values(action) as actions by session_id | eval is_complete=if(mvfind(actions, "logout")>=0, "Yes", "No")`

Using the `stats` command is significantly more performant than `transaction` for this type of grouping. `stats` is a transforming command that operates efficiently on the indexers. It can group by `session_id`, capture the start and end times, and list all actions. A subsequent `eval` command can then easily check for the presence of 'logout' in the multivalued `actions` field to determine if the session is complete. The `transaction` command is much more resource-intensive as it involves stateful processing on the search head.

Correct answers: A CSV lookup for mapping product IDs to product names.; A KV Store lookup for the list of malicious IP addresses.; A scripted lookup that connects to a live inventory database for server location data.

A CSV lookup is ideal for static or infrequently changing data, such as mapping product IDs to their names. It's simple to manage and efficient for this purpose.

The KV Store is the best choice for data that is frequently updated, such as a threat intelligence feed of malicious IPs. It allows for programmatic updates via REST API without needing to upload new files, making it highly suitable for dynamic data.

An external (scripted) lookup is required to interface with an external system like a live inventory database in real-time. This provides the most current location data based on the server's hostname.

Correct answer: `| tstats summariesonly=true allow_old_summaries=true sum(All_Traffic.bytes) as total_bytes from datamodel=Network_Traffic where All_Traffic.dest_ip="10.0.0.0/8" AND (date_hour>=17 OR date_hour<9) by All_Traffic.src_ip | sort 5 -total_bytes`

This is the correct and most performant query. It uses `tstats` to query the accelerated data directly. `summariesonly=true` ensures only the accelerated data is used. It correctly filters by CIDR notation for `dest_ip` and uses the indexed `date_hour` field for efficient time filtering. Finally, it groups by `src_ip` and uses `| sort 5 -total_bytes` which is a highly efficient way to get the top 5 results without needing a subsequent `head` command.

Correct answer: `... | eval combined=zip(page_sequence, timestamp_sequence) | mvexpand combined | eval page=mvindex(combined,0), time=mvindex(combined,1) | streamstats current=f last(time) as prev_time by session_id | eval duration=time-prev_time | stats avg(duration) by page`

This query correctly solves the problem by first using `zip` to combine the parallel multivalued fields into a single field. `mvexpand` then creates a separate event for each page view in the session. `streamstats` is used to get the timestamp of the previous event within the same session (`by session_id`). Finally, `eval` calculates the duration, and `stats` computes the average duration per page. This is the standard and correct pattern for analyzing sequences within multivalued fields.

Correct answer: False

The statement is false. A fundamental Splunk search optimization principle is to filter data as early as possible. Filtering commands should be placed before transforming commands to reduce the number of events that the resource-intensive transforming command needs to process. This significantly improves search performance.

Correct answer: `... | eventstats p(cpu_usage) as cpu_percentile by service`

The `eventstats` command is the correct choice because it calculates a statistical result (like percentile) across a dataset and appends that result to every event without altering the original event structure. By using `by service`, it calculates the percentile within each service group and adds the `cpu_percentile` field to each corresponding event. `stats` would remove the original events, and `streamstats` would calculate a running percentile, which is not what was requested. pie title CPU Usage Distribution by Service "Service A" : 40 "Service B" : 25 "Service C" : 35

Correct answer: `| kvform field=_raw prefix="[" suffix="]" pair_delim=": "`

While `rex` could work, Splunk provides a more specialized and efficient command, `kvform`, for exactly this type of extraction. `kvform` is designed to extract key-value pairs from structured text formats. This approach is more robust and performant than a general-purpose regex because it's optimized for this specific task and doesn't require crafting a complex regex pattern. It correctly defines the delimiters and will extract all pairs present in the event.

Correct answer: The `host` input's search query is missing a dependency on the region token, such as `region="$tok_region$"`.

For cascading inputs to work, the search for the dependent input (host) must use the token set by the parent input (region). The most common error is that the search populating the host dropdown does not filter based on the selected region token (e.g., `$tok_region$`). Without this filter, the search doesn't know how to narrow down the host list. The ` ` handler on the region input is necessary to trigger the update, but the host search itself must be correctly configured to use the token.

Correct answer: `index=web (status=404 OR status=503) | stats dc(status) as status_count by host | where status_count=2`

This is the most performant alternative. Using multiple subsearches or a `join` is very inefficient. This `stats`-based approach filters for all relevant events in a single pass (`status=404 OR status=503`), then uses `stats dc(status) by host` to count the number of unique statuses for each host. A final `where status_count=2` filters this small statistical result set to only the hosts that have experienced both types of errors. This avoids the overhead of subsearches and is a core optimization pattern.