Free SPLK-1004 sample questions

Correct answers: A CSV lookup for mapping product IDs to product names.; A KV Store lookup for the list of malicious IP addresses.; A scripted lookup that connects to a live inventory database for server location data.

A CSV lookup is ideal for static or infrequently changing data, such as mapping product IDs to their names. It's simple to manage and efficient for this purpose.

The KV Store is the best choice for data that is frequently updated, such as a threat intelligence feed of malicious IPs. It allows for programmatic updates via REST API without needing to upload new files, making it highly suitable for dynamic data.

An external (scripted) lookup is required to interface with an external system like a live inventory database in real-time. This provides the most current location data based on the server's hostname.

Correct answer: `| tstats summariesonly=true allow_old_summaries=true sum(All_Traffic.bytes) as total_bytes from datamodel=Network_Traffic where All_Traffic.dest_ip="10.0.0.0/8" AND (date_hour>=17 OR date_hour<9) by All_Traffic.src_ip | sort 5 -total_bytes`

This is the correct and most performant query. It uses `tstats` to query the accelerated data directly. `summariesonly=true` ensures only the accelerated data is used. It correctly filters by CIDR notation for `dest_ip` and uses the indexed `date_hour` field for efficient time filtering. Finally, it groups by `src_ip` and uses `| sort 5 -total_bytes` which is a highly efficient way to get the top 5 results without needing a subsequent `head` command.

Correct answer: `... | eval combined=zip(page_sequence, timestamp_sequence) | mvexpand combined | eval page=mvindex(combined,0), time=mvindex(combined,1) | streamstats current=f last(time) as prev_time by session_id | eval duration=time-prev_time | stats avg(duration) by page`

This query correctly solves the problem by first using `zip` to combine the parallel multivalued fields into a single field. `mvexpand` then creates a separate event for each page view in the session. `streamstats` is used to get the timestamp of the previous event within the same session (`by session_id`). Finally, `eval` calculates the duration, and `stats` computes the average duration per page. This is the standard and correct pattern for analyzing sequences within multivalued fields.

Correct answer: False

The statement is false. A fundamental Splunk search optimization principle is to filter data as early as possible. Filtering commands should be placed before transforming commands to reduce the number of events that the resource-intensive transforming command needs to process. This significantly improves search performance.

Correct answer: `... | eventstats p(cpu_usage) as cpu_percentile by service`

The `eventstats` command is the correct choice because it calculates a statistical result (like percentile) across a dataset and appends that result to every event without altering the original event structure. By using `by service`, it calculates the percentile within each service group and adds the `cpu_percentile` field to each corresponding event. `stats` would remove the original events, and `streamstats` would calculate a running percentile, which is not what was requested. pie title CPU Usage Distribution by Service "Service A" : 40 "Service B" : 25 "Service C" : 35

Correct answer: `| kvform field=_raw prefix="[" suffix="]" pair_delim=": "`

While `rex` could work, Splunk provides a more specialized and efficient command, `kvform`, for exactly this type of extraction. `kvform` is designed to extract key-value pairs from structured text formats. This approach is more robust and performant than a general-purpose regex because it's optimized for this specific task and doesn't require crafting a complex regex pattern. It correctly defines the delimiters and will extract all pairs present in the event.

Correct answer: The `host` input's search query is missing a dependency on the region token, such as `region="$tok_region$"`.

For cascading inputs to work, the search for the dependent input (host) must use the token set by the parent input (region). The most common error is that the search populating the host dropdown does not filter based on the selected region token (e.g., `$tok_region$`). Without this filter, the search doesn't know how to narrow down the host list. The ` ` handler on the region input is necessary to trigger the update, but the host search itself must be correctly configured to use the token.

Correct answer: `index=web (status=404 OR status=503) | stats dc(status) as status_count by host | where status_count=2`

This is the most performant alternative. Using multiple subsearches or a `join` is very inefficient. This `stats`-based approach filters for all relevant events in a single pass (`status=404 OR status=503`), then uses `stats dc(status) by host` to count the number of unique statuses for each host. A final `where status_count=2` filters this small statistical result set to only the hosts that have experienced both types of errors. This avoids the overhead of subsearches and is a core optimization pattern.

Correct answer: `... | eval numeric_amount = tonumber(replace(raw_amount, "[^\d\.]", "")) | eval amount_usd = case(match(raw_amount, "USD"), numeric_amount, match(raw_amount, "EUR"), numeric_amount * 1.1, match(raw_amount, "JPY"), numeric_amount * 0.007, 1=1, null())`

This is the correct approach. It first creates a clean numeric field `numeric_amount` by stripping all non-digit and non-decimal point characters. Then, it uses the `case` function to apply the correct conversion factor based on the currency symbol found in the original `raw_amount` field. This multi-step process is robust and handles the data cleaning and conditional logic correctly. The `tonumber` function ensures the final field is numeric.

Correct answer: Search: `index=prod sourcetype=app_logs level=critical | stats count, values(service) as affected_services` Alert Condition: `search count > 10` Webhook Payload: `{"total_errors": $result.count$, "top_services": $result.affected_services$}`

This is the most appropriate configuration. The search `... | stats count, values(service) as affected_services` aggregates the total count and collects the names of the services. The alert condition `search count > 10` correctly triggers the alert based on the aggregated count. The webhook payload `{"total_errors": $result.count$, "top_services": $result.affected_services$}` correctly uses the `$result. $` token syntax to populate the JSON payload with the values from the single result row generated by the `stats` command. The quotes around the tokens are removed to ensure the values are inserted correctly as a number and an array.