SPLK-2001 Splunk Certified Developer Question and Answers

The valid format for a Splunk REST URI is scheme://host:port/services/endpoint. This format specifies the scheme (http or https), the host (the Splunk server name or IP address), the port (the Splunk management port, usually 8089), the services prefix (which indicates a Splunk REST endpoint), and the endpoint (the specific resource or action to access). The other formats are either incomplete or invalid. For more information, see About the Splunk REST API.

The correct answer is A because the /servicesNS/-/data/saved/searches/mySearch endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role. The /servicesNS/-/data/saved/searches endpoint returns information about saved searches in a specific namespace. The - symbol in the URI means that the user and app context are inherited from the current session. Therefore, a power user can access the saved search information by using the - symbol, assuming the permissions are set appropriately. The other options are incorrect because they either use invalid endpoints or do not specify the user and app context correctly. You can find more information about the /servicesNS endpoint and the namespace in the Splunk REST API Reference Manual.

The types of event handlers are set token and form input. Set token event handlers let you set or unset tokens based on user interactions, such as clicking on a chart or selecting a value from a dropdown. Form input event handlers let you create interactive forms that use tokens to pass values between inputs and searches. The other options are not event handlers, but rather components of a dashboard. For more information, see Event handlers overview.

When the same search is required from a REST API call, all the fields will be given, including _raw, name, sourcetype, and instantaneous_kbps. This is because the default output mode for the REST API is XML, which returns all the fields and values for each event. To limit the fields returned, you can use the output_mode parameter with a value of json_cols, json_rows, or csv. For more information, see Access Splunk data using feeds.

 The correct answer is A, B, and C because these are the possible reasons why the dashboard is not seen after moving myApp to a different Splunk instance. Option A is correct because if the dashboard’s permissions were set to private, only the owner of the dashboard can see it on the new instance. Option B is correct because if the user role permissions are different on the new instance, the user may not have access to the dashboard. Option C is correct because if the admin deleted the myApp/local directory before packaging, the dashboard configuration may have been lost. Option D is incorrect because changes placed in $SPLUNK_HOME/etc/apps/search/default/data/ui/nav do not affect the visibility of the dashboard. You can find more information about dashboard permissions and configuration in the Splunk Developer Guide.

 By using visualization drilldown, you can hide or show a panel by clicking on a chart or a table on the same form. Visualization drilldown lets you define a drilldown action that affects a different panel on the same dashboard. You can use the set or unset tokens to control the visibility of the target panel. For more information, see Visualization drilldown.

The correct answer is B, because the element will unset a token named my_token. The element is used to remove the value of a token based on a user interaction, such as a click or a change. The token attribute specifies the name of the token to be unset. The other options are incorrect because they will not unset a token named my_token. The myt​oken element is invalid, because the token name should not be enclosed in dollar signs. The false and disabled elements will not unset the token, but set its value to false or disabled, respectively.

The URL that could be used to construct a REST request to search the employee KV Store collection to find records with a rating greater than or equal to 2 and less than 5 is ‘http://localhost:8089/servicesNS/nobody/search/storage/collections/data/ employees?query={%22$and%22:[{%22rating%22:{%22$gte%22:2}},{%22rating%22:{% 22$lt%22:5}}]} &output_mode=json’. This URL uses the query parameter with a valid JSON expression that specifies the rating criteria, and the output_mode parameter with a value of json to return the results in JSON format. The other URLs are either invalid or use incorrect syntax for the query parameter. For more information, see Search a KV Store collection.

The correct answer is A because the namespace is a combination of the user and the app. The namespace determines the scope and visibility of the knowledge objects in Splunk. The role, the sharing level, and the permissions are not part of the namespace, but they affect the access to the knowledge objects. You can find more information about the namespace and the knowledge objects in the Splunk Developer Guide.

The log file that contains logs that are most relevant to Splunk Web is web_service.log. This log file records information about the web server that runs Splunk Web, such as requests, responses, errors, and performance. The other log files contain logs that are related to other aspects of Splunk, such as audit.log for security events, metrics.log for performance metrics, and splunkd.log for Splunk daemon activity. For more information, see [About Splunk log files].

 The correct answer is B and D, because they are the files within an app that contain permissions information. Permissions information refers to the access control settings for the app, such as who can read and write to the app, and whether the app is visible to all users or only to the app owner. The files that contain permissions information are the metadata/local.meta and metadata/default.meta files, which are located in the metadata folder of the app. The local/metadata.conf and default/metadata.conf files do not exist, and are not valid configuration files for an app.

The correct answer is A, because data can be added to a KV Store collection only in JSON format. KV Store is a feature that allows Splunk to store and manage data in collections of key-value pairs. A KV Store collection is a logical grouping of key-value pairs that can be accessed and manipulated by Splunk apps. Data can be added to a KV Store collection either by using the Splunk Web interface, the Splunk REST API, or the Splunk SDKs. In all cases, the data must be formatted as JSON objects, which are collections of name-value pairs enclosed in curly braces1. The other formats, such as XML, CSV, and TXT, are not supported by KV Store.

The correct answer is A, because the correct post-process syntax for the base search shown below is var mypostproc1 = new PostProcessManager {{ id: “post1”, managerid: “base-search”, search: “| stats count by sourcetype” }}. The PostProcessManager is a JavaScript object that creates a post-process search that runs on the results of a base search. The PostProcessManager requires three parameters: id, managerid, and search. The id is a unique identifier for the post-process search. The managerid is the id of the base search that the post-process search depends on. The search is the post-process search string that runs on the base search results. The other options are incorrect because they either use the wrong managerid, the wrong object name, or the wrong search string.

The correct answer is A, B, and C because these are the benefits of using Simple XML Extensions. Simple XML Extensions allow you to customize the appearance and behavior of your dashboards by adding custom layouts, graphics, and behaviors. You can also use JavaScript and CSS to enhance your dashboards. Option D is incorrect because Simple XML Extensions do not affect the Splunk license consumption based on host. You can find more information about Simple XML Extensions in the Splunk Developer Guide.

 The valid syntax for specifying an absolute time range modifier in a search is earliest=01/01/2019T00:00:00. The T character separates the date and time components. The other options are invalid because they use either a colon or a space instead of a T. For more information, see Specify time modifiers in your search.

 The correct answer is A, B, and C, because they are all ways to monitor app performance. App performance refers to how well an app performs its intended functions, such as data ingestion, search, visualization, and alerting. Monitoring app performance helps to identify and troubleshoot issues, optimize performance, and improve user experience. Using Splunk logs, using the search job inspector, and using the Monitoring Console are all methods to monitor app performance by collecting and analyzing various metrics and data related to the app. Using the storage/collections/config REST endpoint is not a way to monitor app performance, but a way to configure the KV Store collections for an app.

When added to an app’s default.meta file, export = system makes one of its views available to other apps. This means that the view is visible and searchable by all users. The other options are invalid because export = app means that the view is visible and searchable only within the app, export = none means that the view is not visible or searchable by any user, and export = view is not a valid value for the export attribute. For more information, see About configuration file structure and inheritance.

The token filter that encodes URL values is tokenn​ame∣u. This filter applies the URL encoding to the token value, which replaces special characters with percent-encoded characters. This is useful for passing token values as query parameters in a drilldown. The other token filters are either invalid or used for different purposes. For more information, see [Token filters].