SPLK-4001 sample questions

Question 1

During a configuration audit of a newly deployed Splunk Distribution of the OpenTelemetry Collector on a Linux server, a site reliability engineer inspects how components and pipelines are wired in the YAML configuration file. Which TWO statements accurately describe valid pipeline configuration rules in the Collector? (Select TWO)

Accepted Answer

A single receiver or exporter definition can be reused across multiple pipelines in `service.pipelines`.

Accepted Answer

A single pipeline under `service.pipelines` can include multiple receivers and multiple exporters.

Answer

Any component defined under top-level `receivers`, `processors`, or `exporters` automatically processes telemetry even if omitted from `service.pipelines`.

Answer

Extensions defined in the top-level `extensions` block must be listed inside each individual pipeline under `service.pipelines` to take effect.

Answer

The default trace pipeline only permits a single receiver (`otlp`) and cannot coexist with `jaeger` or `zipkin` receivers in the same pipeline.

Question 2

In the default Linux configuration of the Splunk Distribution of the OpenTelemetry Collector, the default trace pipeline includes the `Jaeger gRPC`, `OTLP`, and `Zipkin` receivers, processes data through the `Memory Limiter`, `Batch`, and `Resource detection` processors, and exports telemetry using the `OTLP/HTTP exporter` and the `_____` exporter.

Accepted Answer

SignalFx

Answer

Prometheus

Answer

Fluent Forward

Answer

Syslog RFC5424

Question 3

An infrastructure architect configures a custom telemetry script to emit standard-resolution gauge datapoints for `system.cpu.utilization` every 2 seconds to Splunk Infrastructure Monitoring. When an operator later views this metric over a 7-day window in a chart with a custom SignalFlow analytics function applied, how does Splunk Observability Cloud process the resolution and rollup of these datapoints?

Accepted Answer

Standard-resolution datapoints arriving more frequently than every 10 seconds are rolled up to an effective native resolution of 10 seconds, and when rendering the chart, the `average()` rollup is applied to each individual MTS after fetching from storage and before the SignalFlow analytics function runs.

Answer

Standard-resolution datapoints are stored at their 2-second native resolution, and the SignalFlow analytics function runs across all MTSs before the `sum()` rollup condenses the datapoints to the chart resolution.

Answer

Datapoints arriving faster than 10 seconds are dropped down to 1-minute resolution at ingest, and the `latest()` rollup is applied after the SignalFlow analytics function completes.

Answer

All datapoints are stored at 1-second resolution by default, and rollups are only computed when the user explicitly selects `Minimum chart resolution` of `One hour (1h)` in Chart Options.

Question 4

While tuning the visual granularity of a dashboard chart in Splunk Observability Cloud, a performance analyst navigates to the `Chart Options` tab to adjust the `Minimum chart resolution` setting. Which set of selectable values is available for `Minimum chart resolution`?

Accepted Answer

`Auto`, `One second (1s)`, `Five seconds (5s)`, `Ten seconds (10s)`, `Thirty seconds (30s)`, `One minute (1m)`, and `One hour (1h)`

Answer

`Native`, `Ten seconds (10s)`, `One minute (1m)`, `Five minutes (5m)`, `Fifteen minutes (15m)`, and `One day (1d)`

Answer

`Default (10s)`, `Thirty seconds (30s)`, `Five minutes (5m)`, `One hour (1h)`, and `Seven days (7d)`

Answer

`Auto`, `One millisecond (1ms)`, `One second (1s)`, `One minute (1m)`, and `Twenty-four hours (24h)`

Question 5

True or False: When Splunk Infrastructure Monitoring stores datapoints for a metric time series (MTS), it pre-computes interval rollups including `Sum`, `Min`, `Max`, and `Count`.

Accepted Answer

True

Answer

False

Question 6

FinServ Global operates a hybrid-cloud payment gateway monitored with Splunk Observability Cloud. Every microservice host emits metrics with ingest-time metadata such as `host`, `aws_availability_zone`, and `service_version`. Recently, the Cloud FinOps team requested that all existing host metrics be enriched with a mutable `cost_center` key-value pair (for example, `cost_center: retail-banking`) and a simple classification label `pci_scope` without restarting any OpenTelemetry Collectors, altering the underlying metric time series (MTS) identity, or increasing MTS cardinality.

Furthermore, dashboard authors need the ability to both filter and group charts (`Group by`) using the `cost_center` metadata, whereas security auditors only need to filter detectors and charts using the `pci_scope` label. The architecture team also wants to ensure their metadata design respects Splunk Observability Cloud's per-dimension metadata limits.

Which metadata strategy satisfies all of FinServ Global's technical and operational requirements?

Accepted Answer

Attach `cost_center` as a custom property (up to 75 custom properties per dimension) and apply `pci_scope` as a tag (stored under `sf_tags`, up to 50 tags per dimension), because custom properties support both filtering and `Group by` without creating new MTSs, while tags support filtering but cannot be used in `Group by` operations.

Answer

Configure `cost_center` and `pci_scope` as span attributes on the Collector's `host_metrics` receiver, because custom properties alter MTS identity and tags are limited to 10 characters in length.

Answer

Add both `cost_center` and `pci_scope` as new ingest-time dimensions via the REST API, because dimensions can be modified after ingest without creating new MTSs and support up to 256 tags per dimension.

Answer

Apply `cost_center` as a tag under `sf_tags` so dashboard authors can use `Group by sf_tags`, and define `pci_scope` as a custom property because custom properties cannot be used for grouping.

Free SPLK-4001 sample questions

While tuning the visual granularity of a dashboard chart in Splunk Observability Cloud, a performance analyst navigates to the `Chart Options` tab to adjust the `Minimum chart resolution` setting. Which set of selectable values is available for `Minimum chart resolution`?

True or False: When Splunk Infrastructure Monitoring stores datapoints for a metric time series (MTS), it pre-computes interval rollups including `Sum`, `Min`, `Max`, and `Count`.

6 more free samples are waiting