Certified Developer Practice Questions

A developer needs to create a new HEC (HTTP Event Collector) token programmatically. Which REST endpoint should they send a POST request to?

Case Study: A healthcare company uses Splunk to monitor patient portal access logs. They have a requirement to build a 'Doctor Activity' dashboard.

Scenario:
The dashboard has a dropdown input for 'Department'. When a department is selected, a token $dept$ is set. The dashboard contains a table showing doctor logins. The team wants to ensure that if a user clicks on a doctor's name in the table, a second panel opens below showing that specific doctor's recent actions.

Requirement:
The second panel must only appear after the click. The click must set a token $doctor_id$. The second panel's search uses $doctor_id$.

Which XML configuration correctly implements the drilldown logic in the first table?

When using the /services/search/jobs endpoint to dispatch a search, which parameter would you set to 0 to ensure the search runs asynchronously (does not block the connection while waiting for completion)?

A developer wants to include a custom JavaScript file named custom_behavior.js in a Simple XML dashboard. The file is located in $SPLUNK_HOME/etc/apps/MyApp/appserver/static/. Which attribute must be added to the or root element?

You are reviewing the inputs.conf file for a custom app. You see the following stanza:

[script://./bin/get_metrics.py]
interval = 60
sourcetype = custom_metrics

What does this configuration define?

Which of the following describes the correct order of precedence for configuration files in Splunk (from highest priority to lowest)?

A developer needs to ensure that a specific configuration file in their app is NOT overwritten during an app upgrade, but also that their local changes persist. Where should they make their custom changes?

Which REST endpoint provides information about the Splunk server, including version, license keys, and OS information?

Suppose the following query in a Simple XML dashboard returns a table including hyperlinks:

index news sourcetype web_proxy | table sourcetype title link

Which of the following is a valid dynamic drilldown element to allow a user of the dashboard to visit the hyperlinks contained in the link field?

When updating a knowledge object via REST, which of the following are valid values for the sharing Access Control List property?

Which of the following are ways to get a list of search jobs? (Select all that apply.)

Which of the following are benefits from using Simple XML Extensions? (Select all that apply.)