Splunk Core Advanced Power User (SPLK-1004) Certification Sample Questions

01. Door-controller events have no badge field extracted; the badge number appears only in the raw text. A subsearch against the HR index produces the numbers of up to 20 revoked badges, in a field named badge_id. Which ending makes the subsearch pass those numbers to the outer search as bare search terms?
a) | return 20 badge_id
b) | fields badge_id
c) | return badge_id
d) | return 20 $badge_id

02. A capacity form has a region_tok dropdown whose static choices include one with the label North America and the value na. The dropdown carries a <change> handler that stores a panel title in one token and, for the North America choice only, sets a second token that reveals a regional-notes panel.
Which two statements about this handler are accurate?
(Choose two.)
a) A <condition value="na"> block runs its actions only when na is the selected value
b) Inside the handler, $value$ returns North America and $label$ returns na
c) Inside the handler, $label$ returns North America, the text of the selected choice
d) A <condition> block inside <change> matches the label only and never the value

03. To prototype a bar chart of order totals by region, a developer backs the panel with this search.
| makeresults | eval region="North,South,East,West", total=250 | table region total
The chart shows one bar, labeled with all four region names run together. What explains this?
a) eval splits a comma-separated string into a multivalue field, and a chart draws a multivalue field as a single bar
b) Without a count argument makeresults generates one result, so the whole string became the region value of that one row
c) The chart needs a stats command before the search, so it can split the rows into bars
d) makeresults produced four rows, one per region, but the chart merged them into one bar because every row holds the same total

04. A ticketing form's source opens with an <init> block containing <set token="queue">service_desk</set>. Which two statements describe how that block behaves?
(Choose two.)
a) It must contain a search, whose first result row supplies the token's value
b) It runs again each time a viewer changes any input on the form
c) It can hold token actions such as <set>, <unset> and <eval>
d) It runs once when the dashboard loads, so queue has a value at first render

05. A DLP team wants proxy events for every user its high-severity alerts flagged. Each proxy event carries a single-value user field, and the analyst writes:
index=proxy [search index=dlp severity=high | <ending>]
Which two endings make the outer search return proxy events for any of the flagged users?
(Choose two.)
a) stats values(user) AS user
b) stats count by user | fields user
c) stats values(user) AS user | nomv user
d) stats values(user) AS user | eval user=mvjoin(user, " OR ")

06. Every ticketing event needs an owner_team field, taken from a CSV file of about 500 service names and their owning teams. The ticket index receives millions of events each day. Which approach adds the field most appropriately?
a) lookup service_owners.csv service OUTPUT owner_team, matching each event on service
b) | inputlookup append=true service_owners.csv, reading the table into the ticket search
c) append [| inputlookup service_owners.csv], adding the table's rows below the events
d) join service [| inputlookup service_owners.csv], matching each event to the table on service

07. A firewall dashboard's table lists blocked connections. The team wants a number shown against each row, and wants 50 rows on each page of the table. Which two options on the <table> element achieve this?
(Choose two.)
a) <option name="wrap">true</option>
b) <option name="rowNumbers">true</option>
c) <option name="drilldown">row</option>
d) <option name="count">50</option>

08. A web operations panel runs index=web sourcetype=access_combined | timechart count AS requests avg(response_ms) AS avg_ms as a column chart. Requests run into the thousands per bucket while response time sits in the tens of milliseconds, so avg_ms barely shows.
Which pair of chart options draws avg_ms as a line on its own scale over the request columns?
a) charting.axisTitleY.text set to avg_ms and charting.axisY.scale set to log
b) charting.fieldColors giving avg_ms a bright color and charting.legend.placement set to top
c) charting.chart.overlayFields set to avg_ms and charting.axisY2.enabled set to true
d) charting.chart set to line and charting.chart.stackMode set to stacked

09. A sales form has a region dropdown that sets region_tok, with no default. Clicking a bar in a product chart sets product_tok through the drilldown <set token="product_tok">$click.value$</set>. The region dropdown carries <change><unset token="product_tok"></unset></change>, and a detail panel is declared as <panel depends="$region_tok$,$product_tok$">.
A viewer has chosen a region, clicked a product bar and is looking at the detail panel. What happens to that panel when the viewer then picks a different region?
a) It is hidden, and it reappears only once a product bar is clicked again
b) It stays visible and reruns with the new region and the previously clicked product
c) It stays hidden until the dashboard is reloaded, because a token cleared by unset cannot be set again
d) It stays visible, because depends needs only one of its listed tokens to hold a value

10. A column chart on a VPN dashboard runs index=vpn | timechart count by outcome, where outcome is normally failure, success or timeout. The chart carries <option name="charting.seriesColors">[0xDC4E41,0x53A051,0xF8BE34]</option>, which draws failures red and successes green. Since the VPN began logging a fourth outcome, error, failures have been appearing in green.
Which change keeps each outcome on the same color whichever series are present?
a) Set charting.legend.placement to right so that the legend fixes each series to the color it was first given
b) Reorder the hex values in charting.seriesColors so that they follow the alphabetical order of the outcome values
c) Add | fillnull value=0 to the search so that every outcome column is always present in the results
d) Replace it with charting.fieldColors, mapping each outcome name to its own color