• Home
• Splunk Exams
• SPLK-1004 - Splunk Core Certified Advanced Power User

SPLK-1004 Splunk Practice Test Questions and Exam Dumps

Question 1

Which statement about tsidx files is accurate?

A. Splunk updates tsidx files every 30 minutes.
B. Splunk removes outdated tsidx files every 5 minutes.
C. A tsidx file consists of a lexicon and a posting list.
D. Each bucket in each index may contain only one tsidx file.

Correct Answer: C

Explanation
To determine the correct statement about tsidx files in Splunk, we must first understand what tsidx files are and how they function within Splunk’s indexing system.

In Splunk, when data is ingested, it undergoes a process called indexing, where the raw event data is parsed, timestamped, and stored. This process also involves creating tsidx files, which are short for "time-series index" files. These files are crucial to Splunk’s search performance because they store metadata about the data, allowing for rapid search and retrieval without having to scan the full raw data every time.

A tsidx file is essentially an inverted index structure. It contains two main components:

1. Lexicon (Dictionary): This is a list of all unique terms or keywords found in the events within a bucket.

2. Posting List (Offsets List): For each term in the lexicon, the posting list contains pointers or offsets to the exact locations in the raw data files where those terms appear.

This structure significantly improves Splunk’s search speed because when a user searches for a term, Splunk can look it up in the lexicon, then follow the posting list to find the relevant raw events quickly.

Let’s now examine each of the provided options:

• A. Splunk updates tsidx files every 30 minutes.
  This is inaccurate. Splunk creates tsidx files at the time of indexing when data is ingested. Once written, these files are not typically updated on a timed schedule. They are generally immutable unless subjected to re-indexing or data manipulation. Therefore, there's no default 30-minute update cycle for tsidx files.

• B. Splunk removes outdated tsidx files every 5 minutes.
  This statement is incorrect. Splunk does not automatically remove tsidx files every 5 minutes. Instead, old tsidx files are removed as part of index retention policies, which are based on data aging, volume, or time constraints defined by the index configuration (like frozenTimePeriodInSecs). Removal of data, and therefore tsidx files, occurs when data rolls to the frozen stage, not on a five-minute schedule.

• C. A tsidx file consists of a lexicon and a posting list.
  This is the correct answer. This accurately describes the internal structure of a tsidx file. The lexicon helps map searchable terms, while the posting list allows Splunk to quickly locate and retrieve matching raw events from the associated data files in a bucket. This inverted index design underpins Splunk’s powerful and fast search capabilities.

• D. Each bucket in each index may contain only one tsidx file.
  This is false. A single bucket can contain multiple tsidx files, especially in the case of accelerated searches, summary indexing, or tsidx reduction techniques. Additionally, Splunk may split tsidx files across different files (e.g., when optimizing space or due to segmenting) and re-merge or reduce them later. Therefore, a bucket is not limited to just one tsidx file.

In summary, the correct and accurate statement about tsidx files is C: A tsidx file consists of a lexicon and a posting list. This structural design is what makes Splunk’s search operations highly efficient, enabling fast and scalable data analysis across large volumes of machine data.

Question 2

When a single event contains repeating JSON data structures, how will these fields be extracted?

A. Single value
B. Lexicographical
C. Multivalue
D. Mvindex

Correct Answer: C

Explanation:

In log and event data, particularly when dealing with JSON-formatted inputs, it is common for a single event to contain repeating structures, such as arrays or lists of similar objects or values. When such data is ingested by tools like Splunk, these repeating values are not treated as separate events but rather as multivalue fields within a single event.

The correct extraction type in this context is Multivalue, corresponding to option C.

Let’s break down what this means and why it applies here:

When JSON is parsed in systems like Splunk or other log aggregation and analysis tools, each key-value pair becomes a field. If the same key appears multiple times or maps to an array of values (e.g., "errors": ["timeout", "refused", "dropped"]), the field associated with that key does not get overwritten. Instead, the parser retains all values as part of a multivalue field. That means the field errors in this case would have three distinct values: "timeout", "refused", and "dropped", all stored under the same field name.

Here’s a deeper explanation of how the other options relate—and why they are incorrect:

A. Single value – This is the default for most fields when a key has only one associated value. However, when repeating structures or arrays are present, the result is a multivalue field, not a single value field. Selecting this option would be incorrect because it ignores the multiplicity of the values.

B. Lexicographical – This term relates to sorting or ordering strings based on the alphabet (e.g., A-Z), and it has nothing to do with field extraction or how JSON arrays are handled in data events. This term is a distractor in this context.

D. Mvindex – This is actually a function used to access individual values in a multivalue field, not a type of field itself. For instance, in Splunk, if you have a multivalue field called errors, you can use mvindex(errors, 0) to get the first value. While mvindex is useful in working with multivalue fields, it is not the type of field that results from the extraction process. This makes it a tempting but ultimately incorrect answer.

In practical use, multivalue fields are very powerful for analysis. They allow you to work with all the values at once or manipulate them individually using functions like mvindex(), mvcount(), or mvjoin(). Many security and observability platforms recognize this structure and enable you to run statistical or pattern-based queries directly on multivalue fields, which enhances analytical depth without requiring you to restructure the data.

To summarize: when a JSON event contains repeating fields—either as an array or as repeated keys with the same name—the result is a multivalue field. This behavior allows for a more nuanced and complete analysis of complex event data without discarding or flattening nested values.

Therefore, the correct answer is C.

Question 3

Which default Splunk role has permission to use the Log Event alert action?

A. Power
B. User
C. can_delete
D. Admin

Correct answer: A

Explanation:

In Splunk, roles determine what a user is permitted to do, including which actions they can take within the platform. These roles come with predefined capabilities, which administrators can customize if needed. The question here focuses on which of Splunk’s default roles is permitted to use the Log Event alert action.

The Log Event alert action allows a triggered alert to log a custom event into a Splunk index, which can be used for later review, auditing, or even triggering secondary processes. This is a valuable function in operational monitoring, as it helps capture alert history or generate secondary analysis pipelines.

Let's break down each role:

A. Power
The Power role is a default Splunk role that includes extended capabilities compared to the basic User role. By default, the Power role is given permissions to schedule searches, create and manage alerts, and use alert actions such as sending emails or logging events. Specifically, the Power role includes the "schedule_search" and "edit_actions" capabilities, which are essential for using the Log Event alert action. Thus, the Power role has the required permissions and is the correct answer.

B. User
The User role is the most basic role in Splunk and is primarily designed for individuals who need to perform searches and view dashboards. This role does not have the ability to schedule searches or use alert actions like Log Event by default. Users with only this role cannot create or configure alerts that involve complex actions. Therefore, User is not the correct answer.

C. can_delete
This is a special-purpose role in Splunk, primarily used to grant the rare and risky ability to delete indexed data. It is not a general-purpose role for managing alerts or interacting with event actions. It exists specifically to allow users to delete events from indexes under controlled circumstances. It is not related to alert action permissions and hence not the correct answer.

D. Admin
The Admin role has full access to nearly all features and configurations within Splunk, including managing roles, indexes, knowledge objects, and more. While Admin certainly has the permissions to use the Log Event alert action, the question specifically asks for the default role that can use it—not the most powerful one. Because Admin has many more permissions than are strictly required, and because Power is already granted this specific capability by default, Admin is not the best choice as an answer in this context.

Conclusion:
While both Admin and Power roles can use the Log Event alert action, the question seeks the default role that specifically has this permission. The Power role includes alerting and logging capabilities by default and is the most accurate and precise answer.

Correct answer: A

Question 4

When running a search, which Splunk component retrieves the individual results?

A. Indexer
B. Search head
C. Universal forwarder
D. Master node

Correct Answer: A

Explanation
To understand which Splunk component retrieves the individual results during a search, it's important to look at how Splunk's architecture handles data ingestion and search processing. Splunk has a distributed architecture with key components playing distinct roles: the search head, the indexer, the universal forwarder, and the master node (in clustered environments).

Let’s evaluate each component and its role in the search process:

• Search Head
  The search head is responsible for parsing the user's search query and distributing it to the indexers. It acts as the user interface and controls the search process, coordinating with other components to complete distributed searches. However, it does not directly retrieve the raw event data; instead, it aggregates the results fetched by the indexers. So while the search head initiates and manages the search, it doesn't fetch the actual data.

• Indexer
  The indexer is the component that stores, indexes, and retrieves machine data. When a search is initiated, the search head sends the query to the indexers, which then search through the tsidx files and raw data to retrieve individual matching events. The indexers perform the actual heavy lifting: they match terms, apply filters, and return the matching results to the search head, which then consolidates and displays them. Hence, indexers are the components responsible for retrieving the individual results.

• Universal Forwarder
  The universal forwarder is a lightweight Splunk agent installed on source machines. Its only role is to collect and forward data to indexers. It does not store data, run searches, or retrieve any results. It is not involved in the search process once data has been forwarded.

• Master Node
  The master node exists only in an indexer cluster setup. Its primary job is to coordinate activities among indexer peers, such as replication and bucket management. It ensures data availability and cluster integrity but does not participate in the search process by retrieving data. It neither stores nor returns search results.

Therefore, while the search head controls the search and presents the final output, the actual retrieval of the individual events from storage is done by the indexers. They scan the indexed data and raw logs to return results back to the search head.

In conclusion, the correct answer is A: Indexer, as it is the component that physically retrieves the individual search results in Splunk’s distributed architecture.

Question 5

In order to ensure accurate output when using the transaction command, how must incoming events be ordered?

A. Reverse lexicographical order
B. Ascending lexicographical order
C. Ascending chronological order
D. Reverse chronological order

Correct Answer: C

Explanation:

The transaction command in tools like Splunk is used to group a set of related events into a single logical transaction. This is especially helpful in cases where multiple log entries represent a single activity—such as a user login session, a web request lifecycle, or a network connection—spread across time. For the transaction command to function correctly, the events must be provided in a logical and time-consistent sequence. Specifically, they must be in ascending chronological order, which means oldest events first, moving toward the newest.

This order is crucial because the transaction command uses timestamps to determine how events are related, when they start and end, and whether they fall within the configured maxspan or maxpause parameters (which specify time limits for how far apart related events can be). If events are not in chronological order, the command may misinterpret event boundaries, exclude relevant entries, or combine unrelated events into a single transaction.

Here is why ascending chronological order (option C) is correct:

• The transaction command processes events by checking timestamps.

• When events are in ascending chronological order, the system can correctly identify the start and end of a transaction based on time.

• This order aligns with how users expect data to be grouped—start time → end time.

Now, let's look at why the other options are incorrect:

A. Reverse lexicographical order – This refers to sorting strings based on reverse alphabetical order. For example, "zebra" would come before "apple". This has no bearing on event timestamps and would not help the transaction command interpret event relationships based on time. Lexicographical ordering is about string value comparisons and is irrelevant in this use case.

B. Ascending lexicographical order – Similar to the previous point, this means sorting based on normal string order (A to Z). This might apply when sorting log levels or event names, but it does not guarantee that events are in the right time sequence. The transaction command requires temporal order, not string order.

D. Reverse chronological order – While this is a common way to display logs (e.g., showing the most recent events first), it disrupts the transaction command’s logic, which depends on identifying the start of a sequence first. If events are fed to the transaction command in reverse chronological order, the command may misinterpret the session flow, leading to incomplete or invalid transactions.

To illustrate, imagine processing login events:

1. User logs in at 08:00

2. User performs an action at 08:05

3. User logs out at 08:10

In ascending chronological order, this flow makes sense, and the transaction command can group these three events correctly into one session. But in reverse chronological order, the logout event comes first, which breaks the logical sequence and may result in the events being split into different transactions or excluded entirely.

In summary, the correct and required event order for the transaction command is ascending chronological order because it enables accurate evaluation of event sequences based on time, ensuring that the start and end of each transaction are logically and temporally consistent.

Therefore, the correct answer is C.

Question 6

What type of drilldown passes a value from a user click into another dashboard or external page?

A. Visualization
B. Event
C. Dynamic
D. Contextual

Correct answer: D

Explanation:

In Splunk and similar dashboarding or data visualization platforms, drilldowns are an essential interactive feature. They allow users to click on elements like charts, tables, or graphs and navigate to more detailed or filtered views, whether within the same dashboard, a different one, or even an external web resource. The main function of a drilldown is to pass relevant data (like a field value, timestamp, or search term) based on user interaction.

This question asks specifically about the type of drilldown that passes a value from a user click into another dashboard or an external page. Let’s analyze the given options in detail:

A. Visualization
While visualization refers to how data is presented (e.g., bar chart, pie chart, table), it is not a type of drilldown. Visualizations can support drilldowns, but the term “visualization” itself does not define the behavior or mechanism of passing values between dashboards. So, this is not the correct answer.

B. Event
The term event drilldown typically refers to interactions that involve inspecting or expanding specific events in a log or time-series view. It’s more about viewing event details rather than passing values to other dashboards or web pages. Therefore, event drilldowns are not typically used to transfer parameters from a user click to another dashboard or external destination. So, this is also not correct.

C. Dynamic
Dynamic drilldown might sound appropriate because the behavior changes depending on the click context. However, this is a general characteristic, not a specific type of drilldown defined in Splunk terminology. "Dynamic" could refer to adapting to different conditions or clicks, but again, it doesn't specifically imply passing values to another destination. It’s more about internal conditional behavior. So, this is not the best answer.

D. Contextual
Contextual drilldowns are explicitly designed to pass the clicked value (such as a field name or data point) into a new dashboard, panel, or external link, thus making the subsequent content relevant to the context of the user’s selection. In Splunk, for example, you can configure a drilldown on a table row or chart segment to navigate to a different dashboard or external URL, embedding the clicked value using tokens like $click.value$. This type of drilldown ensures that the target page or dashboard can render data specific to what the user clicked, thus maintaining contextual relevance.

For instance, clicking on a server name in a table could pass that server as a token into another dashboard that shows detailed logs, metrics, or health indicators for that specific server. Similarly, clicking on a geographic location could open a web-based map service like Google Maps with the coordinates passed in the URL. All of this constitutes contextual drilldown.

Among the options provided, Contextual drilldowns best fit the requirement of passing clicked values into other dashboards or external pages. This allows for targeted, user-driven navigation and is a core part of making interactive dashboards powerful and intuitive.

Correct answer: D

Question 7

What file types does Splunk use to define geospatial lookups?

A. GPX or GML files
B. TXT files
C. KMZ or KML files
D. CSV files

Correct Answer: D

Explanation
To correctly answer this question, it's essential to understand how Splunk handles geospatial lookups—which are used to associate event data with geographical regions such as countries, cities, or custom-defined zones.

Geospatial lookups in Splunk are a type of lookup table that adds location-based context to data, typically used in conjunction with Choropleth maps or Cluster maps in Splunk visualizations. These lookups allow Splunk to overlay data on a map by matching geographic identifiers (like country names or ZIP codes) with latitude and longitude or polygon boundary definitions.

Splunk primarily supports geospatial lookups in the form of CSV (Comma-Separated Values) files. These CSV files contain structured data with specific field names, including:

• featureId: a unique identifier for each region

• coordinates: which can include latitude and longitude data or references to shapes

• Optional fields: names, codes, and region identifiers (e.g., state, zipcode, country)

Now let’s examine each of the options:

• Option A: GPX or GML files
  These file formats are common in GPS and GIS systems for storing location and mapping data. GPX (GPS Exchange Format) is used for sharing GPS data, while GML (Geography Markup Language) is an XML-based format for geographic data. However, Splunk does not natively support these formats for geospatial lookups.

• Option B: TXT files
  Plain text (TXT) files can contain data in an unstructured format, but they are not suitable for structured lookup operations in Splunk. While technically Splunk can read text files, it requires structured tabular data for lookups—making CSV the standard, not TXT.

• Option C: KMZ or KML files
  KML (Keyhole Markup Language) and KMZ (compressed KML) are widely used in tools like Google Earth to define geographical shapes and placemarks. While these are standard geospatial formats, Splunk does not directly use KML/KMZ for geospatial lookups. It requires conversion into CSV format with proper fields to be usable.

• Option D: CSV files
  This is the correct answer. Splunk uses CSV files for geospatial lookups, as they provide the necessary structured format for mapping data. These files are uploaded to the Splunk lookup definitions and can be used with commands like geostats or geom to create visualizations.

In summary, the standard and supported file type for defining geospatial lookups in Splunk is CSV. It offers structured fields that Splunk can parse and associate with map visualizations, enabling users to add geographic context to their machine data effectively. Thus, the correct answer is D.

Question 8

How do form inputs influence dashboard panels that rely on inline searches?

A. A token in a search can be replaced by a form input value.
B. Panels powered by an inline search require a minimum of one form input.
C. Form inputs can not impact panels using inline searches.
D. Adding a form input to a dashboard converts all panels to prebuilt panels.

Correct Answer: A

Explanation:

Form inputs in dashboards—especially in tools like Splunk—are interactive elements such as drop-down menus, text boxes, time pickers, or radio buttons that allow users to modify how data is queried and displayed. These inputs do not inherently change the structure of a dashboard, but they influence the behavior of searches by setting or modifying tokens.

A token is a dynamic placeholder in a search string that gets replaced with a user-selected or default value from a form input. This is crucial in dashboards that rely on inline searches, which are searches written directly within the panel’s configuration instead of referencing an external saved search.

Here’s why option A is correct:

• Inline searches can include tokens such as $field$, which will be replaced with the actual value selected or entered through a form input at runtime.

• For example, if a user chooses a specific host from a drop-down form input, that value can be used to dynamically filter results in a panel using an inline search.

• This makes the dashboard interactive and adaptable to user input, enabling parameterized searches that respond to different criteria without modifying the underlying search structure.

Let’s explore why the other options are incorrect:

B. Panels powered by an inline search require a minimum of one form input.
This is false. Panels with inline searches do not require any form inputs. You can have a completely static dashboard with hardcoded inline searches, and it will work without any form input elements. Form inputs are optional features used for interactivity, not a structural requirement.

C. Form inputs can not impact panels using inline searches.
This is the exact opposite of what is true. Form inputs directly impact inline searches by setting tokens that the inline search references. This is, in fact, one of their primary use cases—making dashboards more dynamic by letting users influence search behavior.

D. Adding a form input to a dashboard converts all panels to prebuilt panels.
This is misleading and incorrect. Adding a form input doesn’t convert anything automatically. Panels remain inline or saved search-based, depending on how they were built. There is no automatic conversion mechanism that changes panels into "prebuilt panels" simply by including a form input. Form inputs are UI elements that interact with panel definitions but don’t transform their underlying type.

Real-world example:

If a dashboard includes a text input labeled “Username” that populates a token called $user$, then an inline search like:

index=auth_logs user=$user$

will dynamically search for the user specified by the viewer of the dashboard. If "jdoe" is entered, the search becomes:

index=auth_logs user=jdoe

This is a flexible and powerful mechanism to enable custom analysis without changing the dashboard code.

Conclusion: Form inputs enhance dashboards by providing dynamic interactivity through token substitution. Inline searches can seamlessly incorporate these tokens to adjust results based on user input, which makes dashboards both powerful and user-friendly.

Therefore, the correct answer is A.

Question 9

How can a lookup be referenced in an alert?

A. Use the lookup dropdown in the alert configuration window.
B. Follow a lookup with an alert command in the search bar.
C. Run a search that uses a lookup and save as an alert.
D. Upload a lookup file directly to the alert.

Correct answer: C

Explanation:

Lookups in Splunk are a powerful mechanism for enriching or correlating your event data with external information such as usernames, asset tags, threat intelligence feeds, or known locations. Alerts in Splunk are triggered based on the results of a saved search that runs on a scheduled basis. The key concept here is that alerts are built around searches, and anything you can use in a search — such as lookups — can be used in an alert, provided it’s embedded in the search logic.

Let’s break down each option:

A. Use the lookup dropdown in the alert configuration window.
There is no such "lookup dropdown" in the alert configuration window in Splunk. When creating or editing an alert, Splunk does not offer a GUI-based dropdown to pick a lookup file. Instead, lookups must be referenced directly within the SPL (Search Processing Language) query that defines the alert condition. Therefore, this option is incorrect.

B. Follow a lookup with an alert command in the search bar.
This answer is misleading. While Splunk allows combining various commands in a search string, there is no "alert" command in SPL. Alerts are created from a search query that evaluates to some condition (e.g., returns results or exceeds a threshold). The search can include lookup, inputlookup, outputlookup, etc., but you don’t follow a lookup with an "alert" command. Hence, this is also incorrect.

C. Run a search that uses a lookup and save as an alert.
This is the correct answer. In Splunk, if you want to use a lookup in an alert, you simply write a search query that includes the lookup, then save that search as an alert. For example:

index=network_traffic sourcetype=firewall_logs 

| lookup threat_list ip AS src_ip OUTPUT threat_level 

| search threat_level=high 

This search uses a lookup (threat_list) to check whether a source IP is listed as a high-level threat. Once this search is tested and returns appropriate results, you can go to Save As → Alert, define the triggering conditions (e.g., number of results), set the frequency, and configure actions like email or script execution. This method seamlessly integrates lookup logic into alert behavior.

D. Upload a lookup file directly to the alert.
This is inaccurate. Uploading lookup files is done via Settings → Lookups, where you define lookup tables or definitions. While lookups can be updated or uploaded as CSV files to Splunk, this action is not part of the alert creation process. The alert simply consumes the lookup as part of its search — it does not accept lookup file uploads within its own configuration. So this option is incorrect.

Lookups are referenced in alerts by using them inside the SPL query that defines the alert condition. Once the search is validated and returns the desired result set, it can be saved as an alert. This is a standard method in Splunk for combining enrichment (via lookups) with proactive monitoring (via alerts).

Correct answer: C

Question 10

What is an example of the simple XML syntax for a base search and its post-process search?

A. <search id="myBaseSearch">, <search base="myBaseSearch">
B. <search globalsearch="myBaseSearch">, <search globalsearch>
C. <panel id="myBaseSearch">, <panel base="myBaseSearch">
D. <search id="myGlobalSearch">, <search base="myBaseSearch">

Correct Answer: A

Explanation
In Splunk, Simple XML is used to define the structure and behavior of dashboards, including layout, panels, searches, visualizations, and inputs. One of the features that helps optimize dashboard performance is the use of base searches and post-process searches.

A base search is a reusable search that runs once and can serve multiple visualizations or post-process searches. A post-process search refers to an additional search that runs on top of the results of a base search, typically used to refine or filter the original data for different visualizations—without re-running the same base search multiple times.

To implement this in Splunk using Simple XML:

The base search is declared with a unique id, such as:
<search id="myBaseSearch">

    <query>index=web sourcetype=access_combined | stats count by status</query>

</search>

A post-process search then references this base search using the base attribute:
<search base="myBaseSearch">

    <query>search status=200</query>

</search>

This is the correct and Splunk-supported syntax. Let’s now evaluate the other options:

• Option A: This is the correct format. It shows a base search with id="myBaseSearch" and a post-process search that correctly references it with base="myBaseSearch".

• Option B: There is no globalsearch attribute in Simple XML for dashboards. This option uses non-existent or incorrect syntax, so it is invalid.

• Option C: Panels in Simple XML are containers for visualizations and do not define searches directly with id or base. The id and base attributes belong to the <search> tag, not <panel>. Therefore, this is syntactically incorrect.

• Option D: Although it uses the correct search and base attributes, it incorrectly refers to an ID that doesn't match. The base search is declared as myGlobalSearch but referenced as myBaseSearch, which would break the linkage. The base attribute must exactly match the id of the defined base search.

Therefore, the most accurate and functional example of Simple XML syntax for implementing a base and post-process search is:

A: <search id="myBaseSearch">, <search base="myBaseSearch">.

This setup allows Splunk to execute the base search once and reuse its results across multiple post-process searches, improving dashboard efficiency and performance.