Splunk SPLK-1001 Practice Test

SPLK-1001 practice test: what's covered

• SPL
• Search
• Reports
• Dashboards

Free SPLK-1001 sample questions

1. A Splunk administrator is architecting an enterprise deployment. Which primary functions are performed by the Indexer component within this architecture?

   • A. Runs the web interface and coordinates distributed search queries across all forwarders
   • B. Parses incoming raw machine data, writes indexed data to disk, and executes search requests
   • C. Only collects log files from endpoints and forwards them without disk storage
   • D. Manages user access control lists, active directory integration, and license master allocation
   Show answer

   Correct: B. Indexers handle parsing, indexing (writing data to tsidx and rawdata files on disk), and responding to search queries from search heads. Option A describes the Search Head role. Option C describes a Universal Forwarder. Option D describes the Deployment Server and License Manager roles.

2. A security engineer is inspecting parsed log events in the search interface. Which TWO default metadata fields are automatically assigned by Splunk during data ingestion? (Select TWO)

   • A. _time (timestamp of the event)
   • B. sourcetype (format and structure definition of the data)
   • C. _user (authenticated user executing the search)
   • D. _severity (calculated threat score of the log entry)
   Show answer

   Correct: A and B. Every event indexed by Splunk receives four core metadata fields: _time, host, source, and sourcetype. Options C (_user) and D (_severity) are wrong because they are not default index-time metadata fields; user and severity must be extracted via search-time field extractions or lookups.

3. A SOC analyst investigating a brute-force attack needs to group failed authentication events by target username and calculate the total count per user. Which SPL command should be used?

   • A. table user count (formats output columns without performing aggregation)
   • B. stats count by user (aggregates events by grouping target user values)
   • C. dedup user (removes duplicate events while preserving raw log records)
   • D. rename user as count (modifies field names in search results)
   Show answer

   Correct: B. The stats command is a transforming command that aggregates data by specified fields. Option A (table) is incorrect because it only specifies column display order without aggregating. Option C (dedup) is wrong because it filters out duplicate rows rather than calculating counts. Option D (rename) only renames field headers.

4. A Splunk user executes the query `index=web status=500 | stats count by uri_path`. What will this search return in the statistics tab?

   • A. A raw log list of every HTTP 500 error event sorted chronologically
   • B. A table listing each distinct URI path alongside the count of HTTP 500 error events for that path
   • C. An averaged calculation of HTTP 500 status response latency per web server
   • D. The overall total count of all web events across every HTTP status code
   Show answer

   Correct: B. `stats count by uri_path` groups events filtered by `status=500` and counts occurrences per unique `uri_path`. Option A is wrong because transforming commands return tabular aggregates, not raw logs. Option C is wrong because count measures event frequency, not response latency. Option D is incorrect because the status=500 filter restricts results exclusively to 500 errors.

5. A system administrator wants to convert an event's file size field from bytes to megabytes within a search pipeline. Which command should be used?

   • A. eval mb = bytes / 1024 / 1024 (computes a new field value using an expression)
   • B. where mb = bytes / 1024 / 1024 (filters events based on boolean expressions)
   • C. fields mb = bytes / 1024 (selects or removes fields from search display)
   • D. rename bytes as mb (relabels an existing field name without modifying its value)
   Show answer

   Correct: A. The eval command creates or updates fields by evaluating mathematical or logical expressions. Option B (where) is wrong because where is a filtering command, not a field assignment operator. Option C (fields) is incorrect because fields keeps or drops existing columns. Option D (rename) only alters the display header.

Last updated: 2026-10-19

SPLK-1001 practice test FAQ

Related practice tests

• Splunk SPLK-1002 practice test
• Splunk Splunk Admin practice test
• Splunk Splunk ES Admin practice test
• Splunk SOAR-DEV practice test