10 free Splunk SPLK-1001 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 212 questions. Work through them, then open each answer to check your reasoning.
Get all 212 questions (US$39) · Download these 10 as a PDF
Question 1
Which search string only returns events from hostWWW3?
Show answer and explanation
Correct answer: B. host=WWW3
The search string host=WWW3 returns only events where the host field exactly equals WWW3. Option A uses a wildcard that matches any host value, option C uses a wildcard that matches any host starting with WWW, and option D fails because field names are case-sensitive in Splunk (should be lowercase 'host', not 'Host').
Why the other options are wrong
- A. The wildcard * matches any host value, not just WWW3
- C. The wildcard * matches any host starting with WWW, including WWW1, WWW2, etc.
- D. Field names in Splunk are case-sensitive; 'Host' with a capital H will not match the 'host' field
Question 2
By default, how long does Splunk retain a search job?
Show answer and explanation
Correct answer: A. 10 Minutes
By default, Splunk retains search jobs for 10 minutes. After this time, the job is cleaned up unless it has been saved or explicitly kept. This default setting balances server resource management with reasonable access to recent search results.
Why the other options are wrong
- B. 15 minutes is longer than the actual default retention period
- C. 1 day is much longer than the default retention period
- D. 7 days is much longer than the default retention period
Question 3
What must be done before an automatic lookup can be created? (Choose all that apply.)
Show answer and explanation
Correct answer: B, C
B. The lookup definition must be created. C. The lookup file must be uploaded to Splunk. An automatic lookup needs two things first: the lookup file and the lookup definition. Upload the CSV, then create a definition that points to it and names its fields. Only then can the automatic lookup apply it to matching events at search time.
Why the other options are wrong
- A. The lookup command runs manual lookups in a search; automatic lookups need no command.
- D. inputlookup only previews file contents, never a prerequisite for an automatic lookup.
Question 4
Which of the following Splunk components typically resides on the machines where data originates?
Show answer and explanation
Correct answer: B. Forwarder
Forwarders are lightweight Splunk agents that reside on the machines where data originates and forward that data to indexers for processing and storage. They are designed to be deployed on source systems to collect and transmit log data. Indexers process data after receipt, search heads perform searches, and deployment servers manage configurations.
Why the other options are wrong
- A. Indexers typically reside on dedicated servers separate from data source machines to handle processing and storage
- C. Search heads are typically deployed on separate systems to manage search operations and user queries
- D. Deployment servers are centralized systems that manage configurations across the Splunk infrastructure
Question 5
What determines the scope of data that appears in a scheduled report?
Show answer and explanation
Correct answer: B. All data accessible to the owner of the report will appear in the report.
A scheduled report runs in the background in the report owner's context, so the search returns only the data the owner's roles are permitted to see. Everyone who later views the scheduled results sees that same result set, regardless of what their own roles could search.
Why the other options are wrong
- A. The roles of the person viewing the report do not widen or narrow the scheduled results
- C. Scheduled results never include data beyond what the search that produced them could access
- D. Scheduled runs always dispatch in the owner's context; there is no run-time choice of profile
Question 6
When writing searches in Splunk, which of the following is true about Booleans?
Show answer and explanation
Correct answer: B. They must be uppercase.
In Splunk search syntax, Boolean operators (AND, OR, NOT) must be written in uppercase letters. Using lowercase versions like 'and', 'or', or 'not' will not be recognized as Boolean operators and may be treated as literal search strings instead.
Why the other options are wrong
- A. Booleans must be uppercase, not lowercase
- C. Booleans do not need to be enclosed in quotations to function as operators
- D. Booleans do not need to be in parentheses, though parentheses can be used to clarify precedence
Question 7
Which of the following searches would return events with failure in index netfw or warn or critical in index netops?
Show answer and explanation
Correct answer: B. (index=netfw failure) OR (index=netops (warn OR critical))
The search (index=netfw failure) OR (index=netops (warn OR critical)) correctly returns events with 'failure' from the netfw index OR events with either 'warn' or 'critical' from the netops index. The parentheses ensure that the warn OR critical condition applies only to the netops index, and the outer OR combines results from both index conditions.
Why the other options are wrong
- A. This uses AND between the two index conditions, which would require an event to be in both indexes simultaneously, impossible for a single event
- C. Using AND requires events to match both conditions, but an event cannot simultaneously have 'failure' in netfw and be in netops
- D. This structure fails to properly associate 'warn OR critical' with the netops index and would include any event with warn or critical from any index
Question 8
Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price
Show answer and explanation
Correct answer: B. index=security sourcetype=access_* status=200 | stats count by price
In Splunk, the pipe operator (|) separates the base search from the commands that transform its results. The correct placement is index=security sourcetype=access_* status=200 | stats count by price. Everything before the pipe filters events, and stats count by price then aggregates those filtered results.
Why the other options are wrong
- A. The pipe splits the stats command; count belongs with stats, not on the other side of the pipe
- C. The pipe before 'by' breaks the stats syntax, which must read 'stats count by price' as one command
- D. status=200 is a search term, not a command, so it cannot start a new segment after a pipe
Question 9
Which of the following constraints can be used with the top command?
Show answer and explanation
Correct answer: A. limit
The 'limit' constraint is a valid option for the top command in Splunk, used to specify the maximum number of results to return. This is one of the most commonly used constraints with the top command.
Why the other options are wrong
- B. useperc is not a valid constraint for the top command.
- C. addtotals is a separate Splunk command, not a constraint of top.
- D. fieldcount is not a valid constraint for the top command.
Question 10
When editing a dashboard, which of the following are possible options? (Choose all that apply.)
Show answer and explanation
Correct answer: C, D
C. Modify the chart type displayed in a dashboard panel. D. Drag a dashboard panel to a different location on the dashboard. When editing a dashboard in Splunk, you can modify the chart type displayed in a dashboard panel and drag panels to different locations. These are standard dashboard editing capabilities that allow customization of both content and layout.
Why the other options are wrong
- A. Adding an output is not a dashboard editing function; outputs are separate Splunk objects.
- B. Exporting is not an editing option; you export dashboards from outside the edit mode, not within it.
That was 10 of 212.
The full Splunk SPLK-1001 pack has all 212 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.