Free SPLK-2001 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

A valid Splunk REST API Uniform Resource Identifier (URI) follows a standard structure for accessing endpoints on a Splunk instance. This structure must include the protocol scheme (http or httpss), the hostname or IP address of the Splunk server, the management port number (default is 8089), the /services/ path prefix, and the specific endpoint path. The format scheme://host:port/services/endpoint correctly represents all these required components for a basic REST API call.

A. host:port/endpoint is incorrect because it is missing the required protocol scheme (e.g., httpss://) and the mandatory /services/ path prefix.

B. scheme://host/servicesNS// is incorrect because it omits the mandatory management :port number after the host. While servicesNS is a valid path prefix, the port is not optional.

C. $SPLUNK HOME/services/endpoint is incorrect because this represents a local file system path using an environment variable, not a network URI used for making REST API requests.

1. Splunk Enterprise Documentation

REST API User Manual

"REST API basics". The documentation specifies the URI structure for REST calls as: https://://. This directly validates the format presented in option D. The manual clarifies that is the Splunkd management port (default 8089) and is typically /services/.

Simple XML extensions allow developers to enhance dashboards beyond the standard capabilities by adding custom CSS and JavaScript files. CSS is used to modify the appearance and layout of dashboard elements, enabling custom layouts (A). JavaScript is used to add custom graphics and visualizations (B), often by integrating third-party libraries. JavaScript also enables the implementation of custom interactive behaviors (C), such as dynamic drilldowns, custom event handling, or interactions with external web services, providing a richer user experience than what is available with standard Simple XML.

D. Splunk license consumption is determined by the volume of data indexed per day and is managed at the indexer level, not through dashboard UI customizations.

1. Splunk Enterprise Documentation

Dashboards and Visualizations manual

"Add custom CSS and JavaScript to dashboards": This section explicitly states

"You can use extensions to further customize the appearance and behavior of your dashboards." It details how CSS can change the layout and how JavaScript can be used to add custom visualizations and behaviors. (Covers A

B

C).

2. Splunk Enterprise Documentation

Dashboards and Visualizations manual

"Dashboard examples using Simple XML extensions": This page provides concrete examples of using extensions to create custom layouts

integrate third-party charting libraries (custom graphics)

and implement custom user interactions (custom behaviors). (Covers A

B

C).

3. Splunk Enterprise Documentation

Admin Manual

"How Splunk licensing works": This document details that licensing is based on indexing volume. It makes no mention of dashboard configurations or Simple XML extensions as a method for controlling license usage. (Covers D).

The services/collector path is the base endpoint for the Splunk HTTP Event Collector (HEC) used for data ingestion. The provided data is a structured JSON object, which is specifically handled by the /services/collector/event endpoint. Since /services/collector/event is not an available option, the base path services/collector is the most appropriate choice. This correctly identifies the data collection service, distinguishing it from REST API endpoints used for configuration or endpoints for different data types.

A. data/inputs/http/{name} is a REST API endpoint for configuring a specific HEC token, not for sending event data.

B. services/collector/raw is the HEC endpoint for sending unstructured, raw text data, not structured JSON objects.

D. data/inputs/http is the base REST API endpoint for managing HEC configurations, not for ingesting data.

1. Splunk Enterprise Documentation

Getting Data In Manual

"Set up and use HTTP Event Collector in Splunk Web": This document specifies the different HEC endpoints. It states

"The two types of HEC endpoints are the /services/collector/event endpoint

for JSON-formatted events

and the /services/collector/raw endpoint

for raw text." This confirms that the provided JSON data is intended for an endpoint under the /services/collector path and that the /raw endpoint is incorrect.

2. Splunk Enterprise Documentation

REST API Reference Manual

"data/inputs/http": This reference describes the endpoints for managing HEC tokens. It states

"Use this endpoint to create

view

and edit HTTP Event Collector tokens." This confirms that the data/inputs/http path (options A and D) is for configuration

not data ingestion.

3. Splunk Enterprise Documentation

Getting Data In Manual

"Format events for HTTP Event Collector": This section details the required JSON wrapper for the /event endpoint. It clarifies that structured JSON like the example is the intended format for the event collector

distinguishing it from the /raw endpoint. The base path for this functionality is services/collector.

An HTTP Event Collector (HEC) token is a 32-bit globally unique identifier (GUID) that Splunk uses to authenticate incoming data from clients. It ensures that only authorized applications can send data to the HEC endpoint. Administrators can create and manage these tokens through two primary methods: the user-friendly interface in Splunk Web (under Settings > Data Inputs) or programmatically by making calls to the Splunk REST API endpoints, specifically /services/data/inputs/http.

A. HEC tokens are application-level credentials for data ingestion; they are not associated with or mapped to a specific Splunk user account or its permissions.

B. The HTTP Event Collector is designed exclusively for sending data to Splunk (ingestion). It cannot be used to query, retrieve, or download data from Splunk.

1. Splunk Enterprise Documentation

Getting Data In

"Set up and use HTTP Event Collector in Splunk Web". This document states

"When you enable HEC

Splunk Enterprise or Splunk Cloud Platform creates a token that applications can use to authenticate their connections to HEC." It also details the process of creating tokens in Splunk Web.

2. Splunk Enterprise Documentation

Getting Data In

"About the HTTP Event Collector". This section describes the token as the authentication mechanism for HEC. The example token format shown (11111111-1111-1111-1111-111111111111) is a standard GUID.

3. Splunk Enterprise REST API Reference Manual

"services/data/inputs/http". This reference details the REST endpoints for managing HEC tokens. A POST request to /services/data/inputs/http is used to create a new HEC token

confirming that tokens can be created via the REST API.

The HTTP Event Collector (HEC) token is a 128-bit value used to authenticate data sent to a Splunk HEC endpoint. The intended and required method for using this token is to include it within the Authorization header of the HTTP request. The specific format is Authorization: Splunk . This practice aligns with standard API security protocols, where authentication credentials are passed in the request headers, distinctly separate from the data payload in the request body. This ensures that the client is authenticated before the data is processed.

A. A cookie.

HEC tokens are not used as cookies, which are typically for managing user sessions in a web browser, not for authenticating data streams to an API.

C. A JSON field in the HTTP request.

The JSON payload is reserved for the event data being sent to Splunk; placing the authentication token within the data itself is incorrect and insecure.

D. A password in conjunction with login.

HEC tokens are bearer tokens that serve as the sole authentication mechanism for the request, replacing the need for a traditional username and password login.

1. Splunk Enterprise Documentation

Getting Data In Manual: In the section "Format events for HTTP Event Collector

" the documentation explicitly states

"The HEC token must be sent in an Authorization HTTP header. The token type is Splunk." (Splunk Docs: Getting Data In

"Format events for HTTP Event Collector"

Section: "HEC request headers").

2. Splunk Enterprise Documentation

REST API Tutorials: The tutorial on sending data to HEC provides a cURL example that demonstrates the correct usage: curl -k "https://:/services/collector" -H "Authorization: Splunk " -d '{"event": "hello world"}'. This reinforces that the token is part of the HTTP header. (Splunk Docs: REST API Tutorials

"Send data to HTTP Event Collector on Splunk Enterprise or Splunk Cloud Platform").

There are two primary methods to retrieve a list of search jobs in Splunk. The first is through the Splunk Web user interface by navigating to the Activity > Jobs menu. This page displays a list of running, paused, and completed search jobs initiated by the user (or all users for administrators). The second method is programmatic, using the Splunk REST API. A GET request to the /services/search/jobs endpoint returns a collection of search jobs, providing detailed information about each job's status and properties.

C. The /services/saved/searches endpoint lists saved search configurations (the search string, schedule, etc.), not the running or completed search jobs that result from them.

D. The /services/search/sid/results endpoint is used to retrieve the results of a single, specific search job identified by its Search ID (SID), not to get a list of multiple jobs.

1. Splunk Enterprise Documentation

Search Manual

"Manage search jobs": This document explicitly states the UI path for viewing jobs. "You can view and manage your search jobs from the Jobs page in Splunk Web. To open the Jobs page

click Activity > Jobs." (Splunk Enterprise 9.x

Search Manual

Chapter: "Managing search jobs").

2. Splunk Enterprise Documentation

REST API Reference Manual

"search/jobs": This reference details the /services/search/jobs endpoint. For a GET request

it states its purpose is to "Return the collection of search jobs." (Splunk Enterprise 9.x

REST API Reference Manual

Endpoints: search/jobs).

3. Splunk Enterprise Documentation

REST API Reference Manual

"saved/searches": This reference clarifies the purpose of the /services/saved/searches endpoint is to "access saved searches

" which are the search definitions

not the jobs themselves. (Splunk Enterprise 9.x

REST API Reference Manual

Endpoints: saved/searches).

The Splunk Processing Language (SPL) requires a specific format for specifying absolute time ranges directly in the search string using modifiers like earliest or latest. The officially documented and valid syntax for an absolute time is MM/DD/YYYY:HH:MM:SS. Option A is the only choice that correctly adheres to this format, using slashes to separate the date components (month, day, year) and a colon to separate the date from the time components (hour, minute, second).

B. earliest=01/01/2019T00:00:00

This format incorrectly mixes the MM/DD/YYYY date structure with the 'T' separator, which is characteristic of the ISO-8601 standard (YYYY-MM-DDTHH:MM:SS).

C. earliest=2019-01-01 00:00:00

This syntax is invalid because it uses a space to separate the date and time. The correct, documented separator for this context is a colon.

D. earliest=2019-01-01T00:00:00

While this is the standard ISO-8601 time format, the primary and explicitly documented syntax for the earliest modifier in a search string is MM/DD/YYYY:HH:MM:SS.

1. Splunk Enterprise Documentation

Search Manual

"Specify time ranges in the Search app": In the section "Specify absolute time ranges

" the manual explicitly states

"The absolute time format is MM/DD/YYYY:HH:MM:SS." It provides an example such as earliest="10/5/2021:20:00:00". (Refer to Splunk Enterprise version 9.x documentation).

2. Splunk Enterprise Documentation

Search Reference

"search" command: Under the syntax details for the search command

the description for the earliest argument specifies the valid time format. It states

"For an absolute time

the format is earliest=MM/DD/YYYY:HH:MM:SS." (Refer to Splunk Enterprise version 9.x documentation).

A oneshot search is a synchronous REST call (execmode=oneshot) that waits for the search to finish before returning. When the job completes, every result is delivered in the HTTP response—effectively “streaming” the full result set back to the caller in one shot. The response format is chosen with the outputmode parameter, which explicitly supports csv among other formats. Because a oneshot search never creates a persistent search job, job-oriented controls such as autocancel are not accepted, and the search is not executed asynchronously.

A. Oneshot blocks until completion; asynchronous jobs use normal /search/jobs with execmode=normal or blocking=0.

D. autocancel is a parameter for background search jobs; the /search/jobs/oneshot endpoint does not recognise it.

1. Splunk Enterprise REST API Reference 9.1

endpoint /services/search/jobs/oneshot – Description: “Blocks until the search completes… returns the results.”

2. Ibid.

Parameter list – outputmode: “csv | json | xml …”.

3. Splunk Developer Guide (“Managing Search Jobs”

§ Oneshot Searches)

para 1: “Oneshot searches return all results synchronously in the same response.”

4. Splunk Enterprise REST API Reference 9.1

endpoint /services/search/jobs – parameter autocancel (absent from oneshot spec)

confirming it is only for standard jobs.

The Splunk KV Store REST API provides distinct endpoints for managing records. A DELETE request sent to the endpoint that includes a specific key (e.g., .../storage/collections/data/{collection}/{key}) will delete only that single record. However, if the key is omitted from the endpoint URL, the DELETE request is sent to the collection's base endpoint (e.g., .../storage/collections/data/{collection}). This is a valid and intentional API operation that instructs Splunk to delete all records within that specific collection, effectively clearing its contents.

A. Clean the KV store, deleting all content.

This is incorrect because the DELETE operation is scoped to a specific collection named in the endpoint, not the entire KV store.

B. Produce the syntax error “Key value missing”.

This is incorrect because omitting the key is a valid syntax for a bulk delete operation on the collection and does not result in an error.

D. Mean that the key value must be passed as an argument.

This is incorrect. For single-record deletion, the key is part of the URL path. For collection-wide deletion, no key is required at all.

1. Splunk Enterprise REST API Reference Manual:

Endpoint: storage/collections/data/{collection}

Method: DELETE

Description: "Deletes all records in a collection." This explicitly confirms that a DELETE request to the collection endpoint without a key deletes all records.

Source: Splunk Enterprise 9.2.1

REST API Reference Manual

"storage/collections/data/{collection}" section.

2. Splunk Developer Guide:

Section: Use the KV Store > KV Store REST endpoints

Content: The documentation lists the endpoint DELETE /servicesNS/{user}/{app}/storage/collections/data/{collection} with the description "Deletes all records from the collection." It contrasts this with DELETE /servicesNS/{user}/{app}/storage/collections/data/{collection}/{key}

which "Deletes a single record from the collection."

Source: Splunk Developer Documentation

Developing for Splunk Cloud Platform and Splunk Enterprise

"Use the KV Store" chapter.

Visualization drilldown is a feature in Splunk dashboards that enables interactive responses when a user clicks on a visualization element like a chart or a table. This functionality can be configured to perform several actions, including setting or unsetting tokens. These tokens act as variables within the dashboard's Simple XML source code. By using the or attributes on a panel, its visibility can be tied to the state of a token. Therefore, clicking one visualization can set a token that, in turn, shows or hides another panel on the same form.

A. "Vent drilldown" is not a recognized or standard term within the Splunk platform's official documentation or features.

B. Workflow actions are used to interact with data at the event level, typically to launch secondary searches or link to external resources based on specific field values, not to control dashboard UI elements.

C. While the action is contextual, "contextual drilldown" is a broad term. The specific mechanism for configuring a chart or table to perform an action is the "visualization drilldown" editor in the UI.

1. Splunk Documentation: Dashboards and Visualizations

"Use drilldown for dashboard interactivity". This section details how to configure actions when users click on dashboard elements. It explicitly covers the "Set token" action

which is the core mechanism for the described behavior.

Reference: In the subsection "Use a token to show or hide a panel

" the documentation states: "You can configure a drilldown to set a token that controls whether a panel is hidden or displayed."

2. Splunk Documentation: Simple XML Reference

"Dashboard element options". This reference describes the element and its child elements

including and .

Reference: The documentation for explains that the depends and rejects attributes can be used to "Show or hide this panel depending on the value of a token." This confirms how tokens set by a drilldown action control panel visibility.

The Splunk REST API provides specific endpoints for interacting with the KV Store. To manipulate individual records (data) within a collection, the endpoint path must include /storage/collections/data/. The complete endpoint for deleting a specific record is DELETE /storage/collections/data/{collection}/{key}. For this question, the collection is sales and the key is smith, which correctly forms the endpoint /storage/collections/data/sales/smith. This structure distinguishes data manipulation from collection configuration management.

A. This endpoint is incorrect because it omits the required /data/ path segment, which is necessary to specify an operation on the records within the collection.

B. This endpoint is invalid. The standard KV Store data access path begins with /storage/collections/ and does not include a /kvstore/ segment.

D. This endpoint is invalid. It incorrectly includes /kvstore/ and omits the mandatory /data/ segment needed to access collection records.

1. Splunk Enterprise REST API Reference Manual: The documentation for the storage/collections/data/{collection}/{key} endpoint explicitly details its usage.

Reference: Splunk Enterprise Documentation

REST API Reference Manual

"Endpoints: storage/collections/data/{collection}/{key}".

Details: This section states

"Use the DELETE method to delete a specific record in a collection

specified by key." This confirms that the correct path structure for deleting a record with a specific key is /storage/collections/data/{collection}/{key}.

2. Splunk Developer Documentation: The developer guide on using the KV Store API provides examples that reinforce the correct endpoint structure.

Reference: Splunk Developer Documentation

Develop with the Splunk platform

"Use the KV Store API".

Details: In the section "Manage KV Store records

" the examples for deleting a single record consistently use the DELETE method with the URI format /services/storage/collections/data/{collection}/{keyid}. (Note: /services is the standard prefix for Splunk REST API calls).

A Splunk add-on is a reusable component designed to provide specific capabilities, such as data collection or knowledge object mapping, to other apps. Each add-on is installed in its own directory under $SPLUNKHOME/etc/apps, which serves as its unique namespace within the Splunk instance, preventing naming conflicts. Add-ons can also be designed with dependencies on other add-ons. For example, a technology-specific add-on might require the Splunk Common Information Model (CIM) Add-on to be installed for proper data normalization and functionality. This modularity allows for building complex solutions by combining different components.

A. A navigation file (nav.xml) defines the user interface navigation bar. Add-ons typically lack a graphical user interface, so this file is not a requirement.

D. This statement describes a standalone app. Add-ons are specifically designed as reusable components intended to be used by other apps across the Splunk environment.

1. Splunk Enterprise Documentation

Develop Apps and Add-ons for Splunk Enterprise

"Overview of Splunk apps and add-ons". This document distinguishes between apps and add-ons

stating

"An add-on is a type of app that provides specific capabilities to other apps... it is a reusable component that supports other apps." This supports the rejection of option D and the concept of dependencies (C).

2. Splunk Enterprise Documentation

Admin Manual

"app.conf". The specification for app.conf under the [package] stanza details the dependencies setting

which allows an app or add-on to declare its dependency on other apps. This directly supports option C.

3. Splunk Enterprise Documentation

Develop Apps and Add-ons for Splunk Enterprise

"Splunk app file structure". This section describes the required directory structure for any app or add-on

where the top-level directory name under etc/apps must be unique

establishing its namespace. This supports option B.

The inputs.conf configuration file specifies the data inputs for a Splunk instance. This includes file and directory monitoring stanzas ([monitor://...]), which are used for any file type, including JSON. Modular inputs, which are custom data inputs often written in Python, are also defined and configured within inputs.conf using a stanza named after the input (e.g., [mypythoninput://...]). The HTTP Event Collector (HEC) is a fast and scalable way to send data to Splunk. The HEC endpoint (the receiver) is enabled and configured on an indexer or heavy forwarder using the [http] stanza in inputs.conf.

C. A custom search command written in Python.

Custom search commands extend the Splunk Processing Language (SPL) and are configured in commands.conf, not inputs.conf.

1. Splunk Enterprise Documentation

inputs.conf: This specification file details all possible stanzas for configuring data inputs.

Section: [monitor://]: "Monitor files and directories. This is the most common way to get data into Splunk Enterprise." This confirms option B.

Section: [http]: "Enable the HTTP Event Collector (HEC) input. Configure global settings for HEC." This confirms option D.

Section: Modular inputs: The documentation notes that modular inputs define their own configuration schemes

which are then implemented as stanzas within inputs.conf. This confirms option A.

Source: Splunk Enterprise Documentation

spec files

inputs.conf.

2. Splunk Enterprise Documentation

Getting Data In Manual

"Create custom data inputs": This section describes how to create and configure modular inputs.

Chapter: "Modular inputs overview": "To implement a modular input

you provide an executable script... You also add a stanza for the input to the inputs.conf file..."

Source: Splunk Enterprise Documentation

Getting Data In

"Create custom data inputs".

3. Splunk Enterprise Documentation

Search Manual

"About custom search commands": This section explains the configuration file for custom commands.

Chapter: "Write custom search commands": "To configure a custom search command

you must create a commands.conf file..."

Source: Splunk Enterprise Documentation

Search Manual

"About custom search commands".

The serviceNS endpoint in the Splunk REST API is specifically designed to access resources within a defined namespace. This namespace is composed of a user and an application context. To correctly call this endpoint, the user and app context must be explicitly included as part of the URI path, following the structure .../servicesNS/{user}/{app}/.... This allows for precise targeting of configuration files, saved searches, and other knowledge objects that are context-dependent. The user can be a specific username or a wildcard (-), and the app can be a specific app name or a wildcard.

A. Authenticate with an admin user.

Authentication is required, but it does not have to be an admin user. Any user with the appropriate capabilities for the target resource can use the endpoint.

C. Authenticate with the user of the required context.

While common, it is not mandatory. A user with sufficient permissions (like an admin) can access resources in another user's namespace by specifying that user in the URI.

D. Pass the user and app context in the request payload.

The namespace context is a fundamental part of the resource's location and is therefore specified in the URI path, not within the request body or payload.

1. Splunk Enterprise Documentation

REST API Reference Manual

"REST API access" section.

This section details the structure of Splunk REST API URIs. It explicitly states: "The /servicesNS endpoint prefix lets you declare a namespace in the URI. The namespace is a user and app context." It provides the syntax https://:/servicesNS///...

directly supporting that the user and app context are specified in the URI.

2. Splunk Enterprise Documentation

REST API Tutorials

"Start using the Splunk REST API" section

"Namespaces" subsection.

This tutorial explains: "In the Splunk platform

a namespace is defined by a user and an app. To access a resource using a namespace

use the /servicesNS endpoint... The general syntax for the /servicesNS endpoint is: https://:/servicesNS///". This confirms the URI structure is the method for specifying the context.

There are three primary reasons why the dashboard might not be visible on the new instance. First, if the dashboard's permissions were set to "Private," it would be saved in the user's specific directory (etc/users//myApp/local), not the app's main directory (etc/apps/myApp/). Consequently, it would not be included when the app is packaged and moved. Second, deleting the myApp/local directory before packaging would discard all UI-driven changes and customizations, including the updated dashboard. Finally, even if the dashboard is moved correctly, the user's role on the new instance might lack the necessary permissions to view objects within myApp, making the dashboard invisible to that user.

D. This path points to the default navigation file for the Search & Reporting app, not a dashboard view within myApp. Changes to a dashboard in myApp would not be saved here.

1. For Answer A: Splunk Enterprise Documentation

Knowledge Manager Manual

"Manage knowledge object permissions". This section explains that private objects are user-and-app-specific and are not available to other users. It also details that these configurations are stored in $SPLUNKHOME/etc/users///local

which is outside the standard app directory ($SPLUNKHOME/etc/apps/) used for packaging.

2. For Answer C: Splunk Enterprise Documentation

Admin Manual

"Configuration file directories". This document outlines the configuration file system

stating that user-level changes made through Splunk Web are saved in local directories. Deleting the local directory within an app effectively reverts it to its default state

removing any customizations.

3. For Answer B: Splunk Enterprise Documentation

Securing Splunk Enterprise

"About users and roles". This manual describes how roles define a user's access to Splunk resources. A user's role must grant read access to an app and its knowledge objects for them to be visible. If the user's role on the new instance is configured differently

access can be denied.