SPLK-2001 Splunk Certified Developer Exam Questions and Answers

The valid format for a Splunk REST URI is scheme://host:port/services/endpoint. This format specifies the scheme (http or https), the host (the Splunk server name or IP address), the port (the Splunk management port, usually 8089), the services prefix (which indicates a Splunk REST endpoint), and the endpoint (the specific resource or action to access). The other formats are either incomplete or invalid. For more information, see About the Splunk REST API.

 The correct answer is D, because ensuring components have no Common Vulnerabilities and Exposures (CVE) vulnerabilities is a security best practice for developing Splunk apps. CVE is a list of publicly disclosed information security vulnerabilities and exposures1. Splunk recommends using tools such as npm audit, retire.js, and snyk to scan your app components for CVE vulnerabilities2.

 The correct answer is B because when calling the serviceNS endpoint, you must specify the user and app context in the URI. The serviceNS endpoint is a REST endpoint that allows you to access the Splunk service for a specific namespace. The namespace is a combination of the user and the app context, which determine the scope and visibility of the knowledge objects in Splunk. The serviceNS endpoint requires you to specify the user and app context in the URI, such as /servicesNS/{user}/{app}. Option A is incorrect because you do not need to authenticate with an admin user, but rather with the user of the required context. Option C is incorrect because you do not need to authenticate with the user of the required context, but rather with any valid user. Option D is incorrect because you do not need to pass the user and app context in the request payload, but rather in the URI. You can find more information about the serviceNS endpoint and the namespace in the Splunk REST API Reference Manual.

The correct answer is B, C, and D, because they are all ways to reduce the results size in the results when the search/jobs REST endpoint is called to execute a search. The search/jobs REST endpoint is used to create, manage, and control search jobs in Splunk. The results size in the results refers to the amount of data returned by the search job, which can affect the performance and efficiency of the search. Removing unneeded fields, truncating the data using selective functions, and summarizing the data using analytic commands are all methods to reduce the results size by filtering, limiting, or aggregating the data. Using a generating search is not a way to reduce the results size, but a way to create a search job that does not use the index, but instead generates its own data3.

The Simple XML elements that configure panel link buttons are and true. The title element specifies the text that appears on the link button, and the option element enables the link button to be visible. The other elements are either irrelevant or used for different options. For more information, see Drilldown to a URL.

 The correct answer is A and B, because for a KV Store, a lookup stanza in the transforms.conf file must contain the collection and fields_list attributes. A lookup stanza is a configuration section in the transforms.conf file that defines the properties of a lookup, such as the lookup type, the lookup file or collection, the input and output fields, and the match type. A lookup is a feature that allows Splunk to enrich the events with additional data from an external source, such as a CSV file or a KV Store collection. For a KV Store lookup, the lookup stanza must have the collection attribute, which specifies the name of the KV Store collection to use, and the fields_list attribute, which specifies the fields to return from the KV Store collection2. The external_type and internal_type attributes are not required for a KV Store lookup, but for a scripted lookup, which is a type of lookup that uses an external script to perform the lookup operation.

The log file that contains logs that are most relevant to Splunk Web is web_service.log. This log file records information about the web server that runs Splunk Web, such as requests, responses, errors, and performance. The other log files contain logs that are related to other aspects of Splunk, such as audit.log for security events, metrics.log for performance metrics, and splunkd.log for Splunk daemon activity. For more information, see [About Splunk log files].

It uses the $row.field|n$ syntax to reference the value of the link field in each row of the table. This syntax is used to create dynamic links in Simple XML dashboards. The other options are incorrect because they either use invalid syntax or do not reference the link field correctly. You can find more information about dynamic drill-downs and link syntax in the Splunk Developer Guide.

When output_mode is not used, the title element of a feed is a human readable name for a returned entry. The title element contains the name of the object, such as the name of a saved search or a dashboard. The other elements are not human readable names, but rather identifiers, links, or authors of the entry. For more information, see Access Splunk data using feeds.

The correct answer is C, because the snippet should be placed in the $APP_HOME/metadata/local.meta file. This file contains the app-level permissions for the app, such as who can read and write to the app, and whether the app is visible to all users or only to the app owner. The $APP_HOME/default/app.conf file contains the app-level settings, such as the app name, description, version, and dependencies. The $APP_HOME/local/default.meta file does not exist, and the $SPLUNK_HOME/etc/system/local/server.conf file contains the server-level settings, such as the hostname, port, SSL, and clustering.

A KV store collection can be associated with a namespace for users in the admin, power, and splunk-system-user roles. These roles have the capability to create and manage KV store collections. The nobody user cannot access any KV store collection, and the users in the admin and power roles alone cannot access the collections in the splunk-system-user namespace. For more information, see KV Store namespaces.

The token filter that encodes URL values is tokenn​ame∣u. This filter applies the URL encoding to the token value, which replaces special characters with percent-encoded characters. This is useful for passing token values as query parameters in a drilldown. The other token filters are either invalid or used for different purposes. For more information, see [Token filters].

 The correct answer is B, C, and D because these are the characteristics of an add-on. An add-on is a Splunk app that provides reusable components or technology for other apps. Option B is correct because an add-on occupies a unique namespace within Splunk, which means it has its own app directory and configuration files. Option C is correct because an add-on can depend on other add-ons for correct operation, such as the Common Information Model Add-on. Option D is correct because an add-on contains technology or components that are not intended for reuse by other apps, such as data inputs, field extractions, lookups, and modular inputs. Option A is incorrect because an add-on does not require a navigation file, as it does not have any user interface elements. You can find more information about add-ons in the Splunk Developer Guide.

The correct answer is A, B, and D because these are the examples of a Splunk KV store use case. A Splunk KV store is a service that allows you to store and manage custom data in Splunk, using key-value pairs. A Splunk KV store can be used for various purposes, such as storing checkpoint data, tracking workflow, and storing application state. Option A is correct because a Splunk KV store can store checkpoint data for modular inputs, which are custom data inputs that use external scripts or binaries to collect and send data to Splunk. Checkpoint data is used to keep track of the data collection progress and resume from the last point in case of interruption. Option B is correct because a Splunk KV store can track workflow in an incident-review system, which is a system that allows you to review and manage the incidents that occur in your environment. Workflow data is used to store the status, priority, and assignee of each incident. Option D is correct because a Splunk KV store can store application state as a user interacts with an app, which is a custom interface that allows you to access and analyze the data in Splunk. Application state data is used to store the user preferences, settings, and selections for the app. Option C is incorrect because a Splunk KV store cannot index metrics data from remote HTTP sources, which are sources that send numerical data to Splunk via HTTP or HTTPS. Metrics data is not stored in the Splunk KV store, but rather in the metrics index, which is a special type of index that optimizes the storage and retrieval of metrics data. You can find more information about the Splunk KV store and its use cases in the Splunk Developer Guide.

The correct answer is A because the /servicesNS/-/data/saved/searches/mySearch endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role. The /servicesNS/-/data/saved/searches endpoint returns information about saved searches in a specific namespace. The - symbol in the URI means that the user and app context are inherited from the current session. Therefore, a power user can access the saved search information by using the - symbol, assuming the permissions are set appropriately. The other options are incorrect because they either use invalid endpoints or do not specify the user and app context correctly. You can find more information about the /servicesNS endpoint and the namespace in the Splunk REST API Reference Manual.

The type of vulnerability in the Python code snippet is CWE-404: Improper Resource Shutdown or Release. This vulnerability occurs when a resource is not released or closed properly after use, which can lead to resource exhaustion or unexpected behavior. In this case, the open() and readline() commands could fail to close the file handle, which could prevent other processes from accessing the file or cause a memory leak. The other types of vulnerabilities are not relevant to this scenario. For more information, see CWE-404: Improper Resource Shutdown or Release.

 The correct answer is A, C, and D because these are the application security best practices that should be adhered to while developing an app for Splunk. Option A is correct because reviewing the OWASP Top Ten List can help you identify and avoid the most common web application security risks. Option C is correct because reviewing the OWASP Secure Coding Practices Quick Reference Guide can help you learn and apply the best practices for secure coding. Option D is correct because ensuring that third-party libraries that the app depends on have no outstanding CVE vulnerabilities can help you prevent potential exploits and attacks. Option B is incorrect because storing passwords in clear text in .conf files is a bad practice that can compromise the security and privacy of your app and your data. You can find more information about the application security best practices in the Splunk Developer Guide.

The correct answer is A, because tokenn​ame∣s ensures that quotation marks surround the value referenced by the token. The |s modifier is used to escape special characters in the token value, such as quotation marks, commas, and colons. This is useful when the token value is used in a search string or a drilldown action1. The other options are incorrect because they either do not escape the special characters or add extra quotation marks.