SPLK-2001 Practice Exam Questions with Answers Splunk Certified Developer Exam Certification

The correct answer is C and D because these are the valid post-processing searches. A post-processing search is a type of search that applies additional filters or transformations to the results of a base search. A post-processing search can use any SPL command that does not require access to the raw data, such as stats, search, eval, and chart. Option C is correct because it uses the stats command to aggregate the count by log level. Option D is correct because it uses the search command to filter the results by log level and then uses the stats command to aggregate the count by component. Option A is incorrect because it uses the tstats command, which is not a valid post-processing command, as it requires access to the raw data. Option B is incorrect because it uses the sourcetype field, which is not available in the results of the base search, as it only returns the component and log_level fields. You can find more information about the post-processing searches in the Splunk Developer Guide.

 The correct answer is A, B, and C because these are the possible reasons why the dashboard is not seen after moving myApp to a different Splunk instance. Option A is correct because if the dashboard’s permissions were set to private, only the owner of the dashboard can see it on the new instance. Option B is correct because if the user role permissions are different on the new instance, the user may not have access to the dashboard. Option C is correct because if the admin deleted the myApp/local directory before packaging, the dashboard configuration may have been lost. Option D is incorrect because changes placed in $SPLUNK_HOME/etc/apps/search/default/data/ui/nav do not affect the visibility of the dashboard. You can find more information about dashboard permissions and configuration in the Splunk Developer Guide.

The log file that contains logs that are most relevant to Splunk Web is web_service.log. This log file records information about the web server that runs Splunk Web, such as requests, responses, errors, and performance. The other log files contain logs that are related to other aspects of Splunk, such as audit.log for security events, metrics.log for performance metrics, and splunkd.log for Splunk daemon activity. For more information, see [About Splunk log files].

 The element in a successful Splunk REST call response contains metadata encapsulating the element. The metadata includes information such as the title, author, updated time, and links of the entry. The content element contains the fields and values of the entry, such as the name, description, and configuration. The other options are either incorrect or not part of the element. For more information, see Access Splunk data using feeds.

The correct answer is B, C, and D, because they are all ways to reduce the results size in the results when the search/jobs REST endpoint is called to execute a search. The search/jobs REST endpoint is used to create, manage, and control search jobs in Splunk. The results size in the results refers to the amount of data returned by the search job, which can affect the performance and efficiency of the search. Removing unneeded fields, truncating the data using selective functions, and summarizing the data using analytic commands are all methods to reduce the results size by filtering, limiting, or aggregating the data. Using a generating search is not a way to reduce the results size, but a way to create a search job that does not use the index, but instead generates its own data3.

The correct answer is B, because the tstats command can be used to perform statistical queries on indexed fields in TSIDX files. TSIDX files are files that store the index data for Splunk, such as the events, timestamps, and fields. Indexed fields are fields that are extracted and stored in the TSIDX files at index time, which makes them faster to search than non-indexed fields. The tstats command is a search command that performs statistical calculations on indexed fields, such as count, sum, avg, and so on. The tstats command is faster than the stats command, which performs statistical calculations on any fields, because it does not need to retrieve the events from the index, but only the fields from the TSIDX files. The other options are not search commands that can be used to perform statistical queries on indexed fields in TSIDX files. The stats command performs statistical calculations on any fields, not just indexed fields. The tscollect command collects the results of a transforming search and writes them to a TSIDX file. The transaction command groups events into transactions based on common values.

 The reserved field names in a KV Store are _key and _user. The _key field is a unique identifier for each record in a KV Store collection, and the _user field is the owner of the record. The other fields are not reserved, and can be used as custom fields in a KV Store collection. For more information, see KV Store field names.

 The correct answer is B and D, because they are the ways to optimize the searches in the dashboard. A dashboard is a user interface that displays data from one or more searches in various panels, such as charts, tables, or maps. Optimizing the searches in the dashboard helps to improve the dashboard performance, reduce the load on the Splunk server, and enhance the user experience. Restricting the time range of the search as much as possible and converting the common SPL into a Global Search and converting the other searches to post-processing searches are both methods to optimize the searches in the dashboard by limiting the amount of data to be searched or processed. Converting searches to include NOT expressions and replacing | stats command with | transaction command wherever possible are not methods to optimize the searches in the dashboard, but rather ways to change the search logic or functionality, which might not produce the desired results.

 Auto-refresh applies to inline searches and saved searches, and post-processing searches are refreshed when their base searches are refreshed. Enabling auto-refresh for a report does not require editing XML, but rather using the Edit Schedule option in the report menu. Each post-processing search using the same base search cannot have a different refresh time, but rather inherits the refresh time of the base search. For more information, see Set up auto-refresh for dashboard panels.

The requirements for arguments sent to the data/indexes endpoint are to specify the datatype and include the name argument. The datatype argument specifies the type of data that is being indexed, such as event, metric, or http. The name argument specifies the name of the index that is being created or updated. The other arguments are either optional or invalid. For more information, see Create an index.

The correct answer is A because the /servicesNS/-/data/saved/searches/mySearch endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role. The /servicesNS/-/data/saved/searches endpoint returns information about saved searches in a specific namespace. The - symbol in the URI means that the user and app context are inherited from the current session. Therefore, a power user can access the saved search information by using the - symbol, assuming the permissions are set appropriately. The other options are incorrect because they either use invalid endpoints or do not specify the user and app context correctly. You can find more information about the /servicesNS endpoint and the namespace in the Splunk REST API Reference Manual.

 By using visualization drilldown, you can hide or show a panel by clicking on a chart or a table on the same form. Visualization drilldown lets you define a drilldown action that affects a different panel on the same dashboard. You can use the set or unset tokens to control the visibility of the target panel. For more information, see Visualization drilldown.

The correct answer is A, B, and C because these are the benefits of using Simple XML Extensions. Simple XML Extensions allow you to customize the appearance and behavior of your dashboards by adding custom layouts, graphics, and behaviors. You can also use JavaScript and CSS to enhance your dashboards. Option D is incorrect because Simple XML Extensions do not affect the Splunk license consumption based on host. You can find more information about Simple XML Extensions in the Splunk Developer Guide.

 The correct answer is A because using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in the $SPLUNK_HOME/etc/apps/myApp/local directory. The local directory is where Splunk stores the configuration files that are modified by the user, either through Splunk Web or by editing the files directly. The local directory has the highest priority in the configuration layering scheme, which means it overrides the settings in the default directory. The other options are incorrect because they either use the wrong directory or the wrong priority. You can find more information about the configuration files and the configuration layering scheme in the Splunk Developer Guide.

When the same search is required from a REST API call, all the fields will be given, including _raw, name, sourcetype, and instantaneous_kbps. This is because the default output mode for the REST API is XML, which returns all the fields and values for each event. To limit the fields returned, you can use the output_mode parameter with a value of json_cols, json_rows, or csv. For more information, see Access Splunk data using feeds.