SPLK-2001 Splunk Certified Developer Exam Questions and Answers

 Auto-refresh applies to inline searches and saved searches, and post-processing searches are refreshed when their base searches are refreshed. Enabling auto-refresh for a report does not require editing XML, but rather using the Edit Schedule option in the report menu. Each post-processing search using the same base search cannot have a different refresh time, but rather inherits the refresh time of the base search. For more information, see Set up auto-refresh for dashboard panels.

When the same search is required from a REST API call, all the fields will be given, including _raw, name, sourcetype, and instantaneous_kbps. This is because the default output mode for the REST API is XML, which returns all the fields and values for each event. To limit the fields returned, you can use the output_mode parameter with a value of json_cols, json_rows, or csv. For more information, see Access Splunk data using feeds.

 By using visualization drilldown, you can hide or show a panel by clicking on a chart or a table on the same form. Visualization drilldown lets you define a drilldown action that affects a different panel on the same dashboard. You can use the set or unset tokens to control the visibility of the target panel. For more information, see Visualization drilldown.

The correct answer is A, B, and D, because they are all items that can be configured in inputs.conf. Inputs.conf is a configuration file that defines how Splunk ingests data from various sources, such as files, directories, network ports, scripts, or modular inputs. A modular input written in Python is a type of input that allows Splunk to ingest data from a custom source using a Python script. A file input monitoring a JSON file is a type of input that allows Splunk to monitor a file or directory for new or updated data in JSON format. An HTTP Event Collector as receiver of data from an app is a type of input that allows Splunk to receive data from an app via HTTP or HTTPS requests. A custom search command written in Python is not an item that can be configured in inputs.conf, but in commands.conf.

The correct answer is D, because defining an alternative search or target view to use is a customization option for the Open in Search panel link button. The Open in Search panel link button is a feature that allows the user to open the search results of a panel in a new search page. The alternative search or target view option allows the user to specify a different search string or a different view name to use when opening the search page4. The other options are not customization options for the Open in Search panel link button, but for the panel itself. Displaying the refresh time, showing the Export Results button, and showing link buttons at the bottom of a panel are all attributes that can be configured for a panel.

The correct answer is A because the namespace is a type of token filter. The namespace is a parameter that can be used to filter the tokens returned by the REST API. The namespace consists of the user and the app context, which determine the scope and visibility of the knowledge objects in Splunk. Option B is incorrect because the namespace can include a wildcard (*) for the app attribute, which means it will return tokens from all apps. Option C is incorrect because the namespace does not filter the knowledge objects returned by the REST API, but rather the tokens that reference them. Option D is incorrect because the namespace does filter the tokens returned by the REST API, based on the user and app context. You can find more information about the namespace and the token filter in the Splunk REST API Reference Manual.

 The reserved field names in a KV Store are _key and _user. The _key field is a unique identifier for each record in a KV Store collection, and the _user field is the owner of the record. The other fields are not reserved, and can be used as custom fields in a KV Store collection. For more information, see KV Store field names.

 The element in a successful Splunk REST call response contains metadata encapsulating the element. The metadata includes information such as the title, author, updated time, and links of the entry. The content element contains the fields and values of the entry, such as the name, description, and configuration. The other options are either incorrect or not part of the element. For more information, see Access Splunk data using feeds.

The correct answer is C, because omitting the value of _key from the REST endpoint would cause all records in a collection to be deleted. The _key is a unique identifier for each record in a KV Store collection. The REST endpoint for deleting a record from a collection is /storage/collections/data//, where is the name of the collection and is the value of _key. If the is omitted, the REST endpoint becomes /storage/collections/data/, which deletes all records in the collection. The other options are incorrect because they are not the consequences of omitting the value of _key from the REST endpoint. Cleaning the KV store, deleting all content would require deleting all collections, not just one. Producing the syntax error “Key value missing” would not happen, because the REST endpoint is valid without the value. Meaning that the _key value must be passed as an argument would not make sense, because the argument is the same as the value in the REST endpoint.

 The correct answer is A, C, and D because these are the application security best practices that should be adhered to while developing an app for Splunk. Option A is correct because reviewing the OWASP Top Ten List can help you identify and avoid the most common web application security risks. Option C is correct because reviewing the OWASP Secure Coding Practices Quick Reference Guide can help you learn and apply the best practices for secure coding. Option D is correct because ensuring that third-party libraries that the app depends on have no outstanding CVE vulnerabilities can help you prevent potential exploits and attacks. Option B is incorrect because storing passwords in clear text in .conf files is a bad practice that can compromise the security and privacy of your app and your data. You can find more information about the application security best practices in the Splunk Developer Guide.

The correct answer is B, because the tstats command can be used to perform statistical queries on indexed fields in TSIDX files. TSIDX files are files that store the index data for Splunk, such as the events, timestamps, and fields. Indexed fields are fields that are extracted and stored in the TSIDX files at index time, which makes them faster to search than non-indexed fields. The tstats command is a search command that performs statistical calculations on indexed fields, such as count, sum, avg, and so on. The tstats command is faster than the stats command, which performs statistical calculations on any fields, because it does not need to retrieve the events from the index, but only the fields from the TSIDX files. The other options are not search commands that can be used to perform statistical queries on indexed fields in TSIDX files. The stats command performs statistical calculations on any fields, not just indexed fields. The tscollect command collects the results of a transforming search and writes them to a TSIDX file. The transaction command groups events into transactions based on common values.

The correct answer is A because the namespace is a combination of the user and the app. The namespace determines the scope and visibility of the knowledge objects in Splunk. The role, the sharing level, and the permissions are not part of the namespace, but they affect the access to the knowledge objects. You can find more information about the namespace and the knowledge objects in the Splunk Developer Guide.

The correct answer is C and D, because they are both statements that describe an HEC token. An HEC token is a unique identifier that is used to authenticate and authorize data sent to Splunk via the HTTP Event Collector (HEC). An HEC token is a GUID (globally unique identifier), which is a 32-character hexadecimal string that is randomly generated. An HEC token can be created in Splunk Web or using REST endpoints, depending on the preference of the user. An HEC token does not map to a Splunk user, but to a specific index or set of indexes where the data will be stored. An HEC token cannot be used to download data, but only to send data to Splunk.

 The correct answer is A, B, and C because these are the possible reasons why the dashboard is not seen after moving myApp to a different Splunk instance. Option A is correct because if the dashboard’s permissions were set to private, only the owner of the dashboard can see it on the new instance. Option B is correct because if the user role permissions are different on the new instance, the user may not have access to the dashboard. Option C is correct because if the admin deleted the myApp/local directory before packaging, the dashboard configuration may have been lost. Option D is incorrect because changes placed in $SPLUNK_HOME/etc/apps/search/default/data/ui/nav do not affect the visibility of the dashboard. You can find more information about dashboard permissions and configuration in the Splunk Developer Guide.

 The correct answer is B, C, and D, because they are all valid parent elements for the event action shown below. The event action is a element, which is used to set the value of a token based on a user interaction, such as a click or a change. The element can be nested inside a , a , or a element, depending on the type and context of the event. The element is not a valid parent element for the element, but a sibling element that can be used to evaluate an expression and set the value of a token.

The URL that could be used to construct a REST request to search the employee KV Store collection to find records with a rating greater than or equal to 2 and less than 5 is ‘https://localhost:8089/servicesNS/nobody/search/storage/collections/data/ employees?query={%22$and%22:[{%22rating%22:{%22$gte%22:2}},{%22rating%22:{% 22$lt%22:5}}]} &output_mode=json’. This URL uses the query parameter with a valid JSON expression that specifies the rating criteria, and the output_mode parameter with a value of json to return the results in JSON format. The other URLs are either invalid or use incorrect syntax for the query parameter. For more information, see Search a KV Store collection.

The Splunk REST endpoint that is used to create a KV store collection is /storage/collections/config. This endpoint lets you create, update, or delete a KV store collection. The other endpoints are either invalid or used for different purposes. For more information, see Use the Splunk REST API to access the KV Store.

The correct answer is C and D because these are the valid post-processing searches. A post-processing search is a type of search that applies additional filters or transformations to the results of a base search. A post-processing search can use any SPL command that does not require access to the raw data, such as stats, search, eval, and chart. Option C is correct because it uses the stats command to aggregate the count by log level. Option D is correct because it uses the search command to filter the results by log level and then uses the stats command to aggregate the count by component. Option A is incorrect because it uses the tstats command, which is not a valid post-processing command, as it requires access to the raw data. Option B is incorrect because it uses the sourcetype field, which is not available in the results of the base search, as it only returns the component and log_level fields. You can find more information about the post-processing searches in the Splunk Developer Guide.