A valid Splunk REST API Uniform Resource Identifier (URI) follows a standard structure for accessing endpoints on a Splunk instance. This structure must include the protocol scheme (http or httpss), the hostname or IP address of the Splunk server, the management port number (default is 8089), the /services/ path prefix, and the specific endpoint path. The format scheme://host:port/services/endpoint correctly represents all these required components for a basic REST API call.

A. host:port/endpoint is incorrect because it is missing the required protocol scheme (e.g., httpss://) and the mandatory /services/ path prefix.

B. scheme://host/servicesNS// is incorrect because it omits the mandatory management :port number after the host. While servicesNS is a valid path prefix, the port is not optional.

C. $SPLUNK HOME/services/endpoint is incorrect because this represents a local file system path using an environment variable, not a network URI used for making REST API requests.

1. Splunk Enterprise Documentation

REST API User Manual

"REST API basics". The documentation specifies the URI structure for REST calls as: https://://. This directly validates the format presented in option D. The manual clarifies that is the Splunkd management port (default 8089) and is typically /services/.

Simple XML extensions allow developers to enhance dashboards beyond the standard capabilities by adding custom CSS and JavaScript files. CSS is used to modify the appearance and layout of dashboard elements, enabling custom layouts (A). JavaScript is used to add custom graphics and visualizations (B), often by integrating third-party libraries. JavaScript also enables the implementation of custom interactive behaviors (C), such as dynamic drilldowns, custom event handling, or interactions with external web services, providing a richer user experience than what is available with standard Simple XML.

D. Splunk license consumption is determined by the volume of data indexed per day and is managed at the indexer level, not through dashboard UI customizations.

1. Splunk Enterprise Documentation

Dashboards and Visualizations manual

"Add custom CSS and JavaScript to dashboards": This section explicitly states

"You can use extensions to further customize the appearance and behavior of your dashboards." It details how CSS can change the layout and how JavaScript can be used to add custom visualizations and behaviors. (Covers A

B

C).

2. Splunk Enterprise Documentation

Dashboards and Visualizations manual

"Dashboard examples using Simple XML extensions": This page provides concrete examples of using extensions to create custom layouts

integrate third-party charting libraries (custom graphics)

and implement custom user interactions (custom behaviors). (Covers A

B

C).

3. Splunk Enterprise Documentation

Admin Manual

"How Splunk licensing works": This document details that licensing is based on indexing volume. It makes no mention of dashboard configurations or Simple XML extensions as a method for controlling license usage. (Covers D).

The services/collector path is the base endpoint for the Splunk HTTP Event Collector (HEC) used for data ingestion. The provided data is a structured JSON object, which is specifically handled by the /services/collector/event endpoint. Since /services/collector/event is not an available option, the base path services/collector is the most appropriate choice. This correctly identifies the data collection service, distinguishing it from REST API endpoints used for configuration or endpoints for different data types.

A. data/inputs/http/{name} is a REST API endpoint for configuring a specific HEC token, not for sending event data.

B. services/collector/raw is the HEC endpoint for sending unstructured, raw text data, not structured JSON objects.

D. data/inputs/http is the base REST API endpoint for managing HEC configurations, not for ingesting data.

1. Splunk Enterprise Documentation

Getting Data In Manual

"Set up and use HTTP Event Collector in Splunk Web": This document specifies the different HEC endpoints. It states

"The two types of HEC endpoints are the /services/collector/event endpoint

for JSON-formatted events

and the /services/collector/raw endpoint

for raw text." This confirms that the provided JSON data is intended for an endpoint under the /services/collector path and that the /raw endpoint is incorrect.

2. Splunk Enterprise Documentation

REST API Reference Manual

"data/inputs/http": This reference describes the endpoints for managing HEC tokens. It states

"Use this endpoint to create

view

and edit HTTP Event Collector tokens." This confirms that the data/inputs/http path (options A and D) is for configuration

not data ingestion.

3. Splunk Enterprise Documentation

Getting Data In Manual

"Format events for HTTP Event Collector": This section details the required JSON wrapper for the /event endpoint. It clarifies that structured JSON like the example is the intended format for the event collector

distinguishing it from the /raw endpoint. The base path for this functionality is services/collector.

An HTTP Event Collector (HEC) token is a 32-bit globally unique identifier (GUID) that Splunk uses to authenticate incoming data from clients. It ensures that only authorized applications can send data to the HEC endpoint. Administrators can create and manage these tokens through two primary methods: the user-friendly interface in Splunk Web (under Settings > Data Inputs) or programmatically by making calls to the Splunk REST API endpoints, specifically /services/data/inputs/http.

A. HEC tokens are application-level credentials for data ingestion; they are not associated with or mapped to a specific Splunk user account or its permissions.

B. The HTTP Event Collector is designed exclusively for sending data to Splunk (ingestion). It cannot be used to query, retrieve, or download data from Splunk.

1. Splunk Enterprise Documentation

Getting Data In

"Set up and use HTTP Event Collector in Splunk Web". This document states

"When you enable HEC

Splunk Enterprise or Splunk Cloud Platform creates a token that applications can use to authenticate their connections to HEC." It also details the process of creating tokens in Splunk Web.

2. Splunk Enterprise Documentation

Getting Data In

"About the HTTP Event Collector". This section describes the token as the authentication mechanism for HEC. The example token format shown (11111111-1111-1111-1111-111111111111) is a standard GUID.

3. Splunk Enterprise REST API Reference Manual

"services/data/inputs/http". This reference details the REST endpoints for managing HEC tokens. A POST request to /services/data/inputs/http is used to create a new HEC token

confirming that tokens can be created via the REST API.

The HTTP Event Collector (HEC) token is a 128-bit value used to authenticate data sent to a Splunk HEC endpoint. The intended and required method for using this token is to include it within the Authorization header of the HTTP request. The specific format is Authorization: Splunk . This practice aligns with standard API security protocols, where authentication credentials are passed in the request headers, distinctly separate from the data payload in the request body. This ensures that the client is authenticated before the data is processed.

A. A cookie.

HEC tokens are not used as cookies, which are typically for managing user sessions in a web browser, not for authenticating data streams to an API.

C. A JSON field in the HTTP request.

The JSON payload is reserved for the event data being sent to Splunk; placing the authentication token within the data itself is incorrect and insecure.

D. A password in conjunction with login.

HEC tokens are bearer tokens that serve as the sole authentication mechanism for the request, replacing the need for a traditional username and password login.

1. Splunk Enterprise Documentation

Getting Data In Manual: In the section "Format events for HTTP Event Collector

" the documentation explicitly states

"The HEC token must be sent in an Authorization HTTP header. The token type is Splunk." (Splunk Docs: Getting Data In

"Format events for HTTP Event Collector"

Section: "HEC request headers").

2. Splunk Enterprise Documentation

REST API Tutorials: The tutorial on sending data to HEC provides a cURL example that demonstrates the correct usage: curl -k "https://:/services/collector" -H "Authorization: Splunk " -d '{"event": "hello world"}'. This reinforces that the token is part of the HTTP header. (Splunk Docs: REST API Tutorials

"Send data to HTTP Event Collector on Splunk Enterprise or Splunk Cloud Platform").

There are two primary methods to retrieve a list of search jobs in Splunk. The first is through the Splunk Web user interface by navigating to the Activity > Jobs menu. This page displays a list of running, paused, and completed search jobs initiated by the user (or all users for administrators). The second method is programmatic, using the Splunk REST API. A GET request to the /services/search/jobs endpoint returns a collection of search jobs, providing detailed information about each job's status and properties.

C. The /services/saved/searches endpoint lists saved search configurations (the search string, schedule, etc.), not the running or completed search jobs that result from them.

D. The /services/search/sid/results endpoint is used to retrieve the results of a single, specific search job identified by its Search ID (SID), not to get a list of multiple jobs.

1. Splunk Enterprise Documentation

Search Manual

"Manage search jobs": This document explicitly states the UI path for viewing jobs. "You can view and manage your search jobs from the Jobs page in Splunk Web. To open the Jobs page

click Activity > Jobs." (Splunk Enterprise 9.x

Search Manual

Chapter: "Managing search jobs").

2. Splunk Enterprise Documentation

REST API Reference Manual

"search/jobs": This reference details the /services/search/jobs endpoint. For a GET request

it states its purpose is to "Return the collection of search jobs." (Splunk Enterprise 9.x

REST API Reference Manual

Endpoints: search/jobs).

3. Splunk Enterprise Documentation

REST API Reference Manual

"saved/searches": This reference clarifies the purpose of the /services/saved/searches endpoint is to "access saved searches

" which are the search definitions

not the jobs themselves. (Splunk Enterprise 9.x

REST API Reference Manual

Endpoints: saved/searches).

The Splunk Processing Language (SPL) requires a specific format for specifying absolute time ranges directly in the search string using modifiers like earliest or latest. The officially documented and valid syntax for an absolute time is MM/DD/YYYY:HH:MM:SS. Option A is the only choice that correctly adheres to this format, using slashes to separate the date components (month, day, year) and a colon to separate the date from the time components (hour, minute, second).

B. earliest=01/01/2019T00:00:00

This format incorrectly mixes the MM/DD/YYYY date structure with the 'T' separator, which is characteristic of the ISO-8601 standard (YYYY-MM-DDTHH:MM:SS).

C. earliest=2019-01-01 00:00:00

This syntax is invalid because it uses a space to separate the date and time. The correct, documented separator for this context is a colon.

D. earliest=2019-01-01T00:00:00

While this is the standard ISO-8601 time format, the primary and explicitly documented syntax for the earliest modifier in a search string is MM/DD/YYYY:HH:MM:SS.

1. Splunk Enterprise Documentation

Search Manual

"Specify time ranges in the Search app": In the section "Specify absolute time ranges

" the manual explicitly states

"The absolute time format is MM/DD/YYYY:HH:MM:SS." It provides an example such as earliest="10/5/2021:20:00:00". (Refer to Splunk Enterprise version 9.x documentation).

2. Splunk Enterprise Documentation

Search Reference

"search" command: Under the syntax details for the search command

the description for the earliest argument specifies the valid time format. It states

"For an absolute time

the format is earliest=MM/DD/YYYY:HH:MM:SS." (Refer to Splunk Enterprise version 9.x documentation).

A oneshot search is a synchronous REST call (execmode=oneshot) that waits for the search to finish before returning. When the job completes, every result is delivered in the HTTP response—effectively “streaming” the full result set back to the caller in one shot. The response format is chosen with the outputmode parameter, which explicitly supports csv among other formats. Because a oneshot search never creates a persistent search job, job-oriented controls such as autocancel are not accepted, and the search is not executed asynchronously.

A. Oneshot blocks until completion; asynchronous jobs use normal /search/jobs with execmode=normal or blocking=0.

D. autocancel is a parameter for background search jobs; the /search/jobs/oneshot endpoint does not recognise it.

1. Splunk Enterprise REST API Reference 9.1

endpoint /services/search/jobs/oneshot – Description: “Blocks until the search completes… returns the results.”

2. Ibid.

Parameter list – outputmode: “csv | json | xml …”.

3. Splunk Developer Guide (“Managing Search Jobs”

§ Oneshot Searches)

para 1: “Oneshot searches return all results synchronously in the same response.”

4. Splunk Enterprise REST API Reference 9.1

endpoint /services/search/jobs – parameter autocancel (absent from oneshot spec)

confirming it is only for standard jobs.

The Splunk KV Store REST API provides distinct endpoints for managing records. A DELETE request sent to the endpoint that includes a specific key (e.g., .../storage/collections/data/{collection}/{key}) will delete only that single record. However, if the key is omitted from the endpoint URL, the DELETE request is sent to the collection's base endpoint (e.g., .../storage/collections/data/{collection}). This is a valid and intentional API operation that instructs Splunk to delete all records within that specific collection, effectively clearing its contents.

A. Clean the KV store, deleting all content.

This is incorrect because the DELETE operation is scoped to a specific collection named in the endpoint, not the entire KV store.

B. Produce the syntax error “Key value missing”.

This is incorrect because omitting the key is a valid syntax for a bulk delete operation on the collection and does not result in an error.

D. Mean that the key value must be passed as an argument.

This is incorrect. For single-record deletion, the key is part of the URL path. For collection-wide deletion, no key is required at all.

1. Splunk Enterprise REST API Reference Manual:

Endpoint: storage/collections/data/{collection}

Method: DELETE

Description: "Deletes all records in a collection." This explicitly confirms that a DELETE request to the collection endpoint without a key deletes all records.

Source: Splunk Enterprise 9.2.1

REST API Reference Manual

"storage/collections/data/{collection}" section.

2. Splunk Developer Guide:

Section: Use the KV Store > KV Store REST endpoints

Content: The documentation lists the endpoint DELETE /servicesNS/{user}/{app}/storage/collections/data/{collection} with the description "Deletes all records from the collection." It contrasts this with DELETE /servicesNS/{user}/{app}/storage/collections/data/{collection}/{key}

which "Deletes a single record from the collection."

Source: Splunk Developer Documentation

Developing for Splunk Cloud Platform and Splunk Enterprise

"Use the KV Store" chapter.

Visualization drilldown is a feature in Splunk dashboards that enables interactive responses when a user clicks on a visualization element like a chart or a table. This functionality can be configured to perform several actions, including setting or unsetting tokens. These tokens act as variables within the dashboard's Simple XML source code. By using the or attributes on a panel, its visibility can be tied to the state of a token. Therefore, clicking one visualization can set a token that, in turn, shows or hides another panel on the same form.

A. "Vent drilldown" is not a recognized or standard term within the Splunk platform's official documentation or features.

B. Workflow actions are used to interact with data at the event level, typically to launch secondary searches or link to external resources based on specific field values, not to control dashboard UI elements.

C. While the action is contextual, "contextual drilldown" is a broad term. The specific mechanism for configuring a chart or table to perform an action is the "visualization drilldown" editor in the UI.

1. Splunk Documentation: Dashboards and Visualizations

"Use drilldown for dashboard interactivity". This section details how to configure actions when users click on dashboard elements. It explicitly covers the "Set token" action

which is the core mechanism for the described behavior.

Reference: In the subsection "Use a token to show or hide a panel

" the documentation states: "You can configure a drilldown to set a token that controls whether a panel is hidden or displayed."

2. Splunk Documentation: Simple XML Reference

"Dashboard element options". This reference describes the element and its child elements

including and .

Reference: The documentation for explains that the depends and rejects attributes can be used to "Show or hide this panel depending on the value of a token." This confirms how tokens set by a drilldown action control panel visibility.