Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
What is the limit on the number of properties that an MTS can have?
The correct answer is A. 64.
According to the web search results, the limit on the number of properties that an MTS can have is 64. A property is a key-value pair that you can assign to a dimension of an existing MTS to add more context to the metrics. For example, you can add the property use: QA to the host dimension of your metrics to indicate that the host is used for QA1
Properties are different from dimensions, which are key-value pairs that are sent along with the metrics at the time of ingest. Dimensions, along with the metric name, uniquely identify an MTS. The limit on the number of dimensions per MTS is 362
To learn more about how to use properties and dimensions in Splunk Observability Cloud, you can refer to this documentation2.
1: https://docs.splunk.com/Observability/metrics-and-metadata/metrics-dimensions-mts.html#Custom-properties 2: https://docs.splunk.com/Observability/metrics-and-metadata/metrics-dimensions-mts.html
When writing a detector with a large number of MTS, such as memory. free in a deployment with 30,000 hosts, it is possible to exceed the cap of MTS that can be contained in a single plot. Which of the choices below would most likely reduce the number of MTS below the plot cap?
The correct answer is B. Add a filter to narrow the scope of the measurement.
A filter is a way to reduce the number of metric time series (MTS) that are displayed on a chart or used in a detector. A filter specifies one or more dimensions and values that the MTS must have in order to be included. For example, if you want to monitor the memory.free metric only for hosts that belong to a certain cluster, you can add a filter like cluster:my-cluster to the plot or detector. This will exclude any MTS that do not have the cluster dimension or have a different value for it1
Adding a filter can help you avoid exceeding the plot cap, which is the maximum number of MTS that can be contained in a single plot. The plot cap is 100,000 by default, but it can be changed by contacting Splunk Support2
To learn more about how to use filters in Splunk Observability Cloud, you can refer to this documentation3.
1: https://docs.splunk.com/Observability/gdi/metrics/search.html#Filter-metrics 2: https://docs.splunk.com/Observability/gdi/metrics/detectors.html#Plot-cap 3: https://docs.splunk.com/Observability/gdi/metrics/search.html
Which of the following statements are true about the datatable on a chart? (select all that apply)
With exceptions for transformations or timeshifts, at what resolution do detectors operate?
According to the Splunk Observability Cloud documentation1, detectors operate at the native resolution of the metric or dimension that they monitor, with some exceptions for transformations or timeshifts. The native resolution is the frequency at which the data points are reported by the source. For example, if a metric is reported every 10 seconds, the detector will evaluate the metric every 10 seconds. The native resolution ensures that the detector uses the most granular and accurate data available for alerting.
A customer has a large population of servers. They want to identify the servers where utilization has increased the most since last week. Which analytics function is needed to achieve this?
The correct answer is C. Timeshift.
According to the Splunk Observability Cloud documentation1, timeshift is an analytic function that allows you to compare the current value of a metric with its value at a previous time interval, such as an hour ago or a week ago. You can use the timeshift function to measure the change in a metric over time and identify trends, anomalies, or patterns. For example, to identify the servers where utilization has increased the most since last week, you can use the following SignalFlow code:
timeshift(1w, counters(''server.utilization''))
This will return the value of the server.utilization counter metric for each server one week ago. You can then subtract this value from the current value of the same metric to get the difference in utilization. You can also use a chart to visualize the results and sort them by the highest difference in utilization.
Which component of the OpenTelemetry Collector allows for the modification of metadata?
The component of the OpenTelemetry Collector that allows for the modification of metadata is A. Processors.
Processors are components that can modify the telemetry data before sending it to exporters or other components. Processors can perform various transformations on metrics, traces, and logs, such as filtering, adding, deleting, or updating attributes, labels, or resources. Processors can also enrich the telemetry data with additional metadata from various sources, such as Kubernetes, environment variables, or system information1
For example, one of the processors that can modify metadata is the attributes processor. This processor can update, insert, delete, or replace existing attributes on metrics or traces. Attributes are key-value pairs that provide additional information about the telemetry data, such as the service name, the host name, or the span kind2
Another example is the resource processor. This processor can modify resource attributes on metrics or traces. Resource attributes are key-value pairs that describe the entity that produced the telemetry data, such as the cloud provider, the region, or the instance type3
To learn more about how to use processors in the OpenTelemetry Collector, you can refer to this documentation1.
1: https://opentelemetry.io/docs/collector/configuration/#processors 2: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/attributesprocessor 3: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/resourceprocessor
Exam domains verified against: Official Splunk SPLK-4001 exam guide, last checked September 2026.
Deploy and configure the OTel Collector on Linux systems to ingest metrics. Learn to edit configurations, troubleshoot common errors, and understand general OpenTelemetry concepts for metrics collection.
Understand data resolution and rollups. Master the components of a datapoint and the Splunk IM Data Model including Metrics, MTS (Metric Time Series), and the types of metadata used in observability platforms.
Sample question from this domain above: Q4
Use built-in dashboards and tools to investigate infrastructure issues. Work with the Kubernetes Navigator for node and pod troubleshooting, the Cluster Analyzer for root cause analysis, and built-in Kubernetes dashboards.
Create and manage charts, dashboards, and dashboard groups. Search for metrics, visualize them in appropriate chart types, and apply rollups and analytic functions to interpret data correctly.
Create detectors from charts or as standalone resources. Clone existing detectors and set up muting rules to control alert behavior in your Splunk O11y Cloud environment.
Sample question from this domain above: Q1
Customize dashboards with instructions and data links. Configure alert messages, troubleshoot issues with late datapoints and extrapolation policies, and view events on dashboards.
Combine plots in charts and compare metrics across time periods. Use analytics functions on moving and calendar windows, calculate percentages and ratios, and apply functions to subsets of metric time series.
Identify and fix detector issues and create detectors for specific scenarios. Monitor populations, avoid flapping, handle cyclic patterns, manage large numbers of sources, and monitor ephemeral infrastructure.
Common questions about the exam itself
