SPLK-2001 Sample Questions & Answers

Which of the following statements describe oneshot searches? (Select all that apply.)

Which of the following options would be the best way to identify processor bottlenecks of a search?

Which of the following is true of a namespace?

What must be done when calling the serviceNS endpoint?

A developer is building a custom application for a logistics company. The app requires a dashboard that displays shipment statuses. The developer needs to initialize a token named default_region to the value "NorthAmerica" as soon as the dashboard loads, before any user interaction occurs. Which Simple XML element should be used to achieve this?

A security operations team needs to export a large volume of search results (approx. 500,000 events) from a Splunk search job using a Python script. They want to minimize memory usage on the client side by processing results as they stream. Which REST endpoint and output_mode combination is optimal for this requirement?

A developer is creating a KV Store collection named device_inventory to store hardware asset details. The collection must support a hierarchy of users where only the admin role can write data, but power users can read it. Which configuration file must be modified to define the collection structure, and which file handles the access control list (ACL)? (Select TWO)

While developing a dashboard for a financial application, you need to pass a token named account_id to a drilldown URL. The account_id value might contain spaces or special characters that could break the URL structure. Which token filter should be applied to ensuring the value is properly URL-encoded?

A developer needs to programmatically retrieve the list of all saved searches that belong to the app FinanceOps and are owned by the user jdoe. Which REST API endpoint correctly targets this specific namespace?

You are optimizing a dashboard that contains five different panels. All panels utilize the same base search logic but visualize the data differently. To improve performance and reduce the load on the search head, which strategy should you implement?

A developer writes a script to interact with the Splunk REST API. The script sends a POST request to /services/search/jobs with the argument search='search index=web | stats count'. The script receives an HTTP 201 response. What does this response indicate?

When creating a Splunk App for release on Splunkbase, which configuration file is used to define the app's version, author, and description visible in the Splunk UI?

A developer is configuring a 'Single Value' visualization to change color based on the returned numerical value. The requirement is: Values below 50 are green, 50-80 are yellow, and above 80 are red. Which Simple XML element is used to define these thresholds?

A developer needs to delete a specific record from a KV Store collection named user_sessions. The record has a _key value of sess_12345. Which REST operation and endpoint are correct?

Which of the following statements about the tstats command is TRUE?

You have a dashboard panel that relies on a token $selected_host$. You want to completely hide this panel from the dashboard when the user has not yet selected a host (i.e., when the token is unset). Which attribute should you add to the or element?