SPLK-1001 Creating Reports, Dashboards and Visualizations — 25 Questions

Question 1

Which THREE of the following are valid ways to add a visualization to a dashboard?

Accepted Answer

Paste a search query in the dashboard editor.. Option A is correct because pasting a search query directly into the dashboard editor creates a new panel whose visualization is driven by that query. Option C is correct because the 'Add Panel' > 'New from Search' workflow is the standard UI path for building a panel from an ad-hoc search and adding it to the dashboard. Option D is correct because cloning an existing panel and editing its search reuses the panel's visualization settings while pointing it at a different query, which is a supported way to add a visualization. Option B is not a valid method because reports are scheduled exports/deliverables, not draggable dashboard objects. Option E is not valid because uploading a CSV and picking a visualization type creates a dataset/lookup or a standalone visualization, not a dashboard panel added through the dashboard's panel-creation flow.

Answer

Create a report and then drag it onto the dashboard.

Answer

Upload a CSV file and select visualization type.

Question 2

Which THREE actions are possible when editing a dashboard in Studio?

Accepted Answer

Set a custom time range for the dashboard.. In Studio, a dashboard editor supports setting a custom time range for the dashboard (A), which controls the time window applied to the panels' searches, and it also allows adding custom CSS to style the dashboard (C) so you can override default visual styling. Additionally, Studio lets you convert a static panel into a form input (D), turning a visualization into an interactive input control that drives other panels. Editing the underlying search of a report used in a panel (B) is not a dashboard-editing action in Studio, since searches are edited in the search/report editor rather than from the dashboard canvas. Exporting the dashboard as a PDF from the editor (E) is also not supported there; PDF export is a viewing/sharing action performed outside the Studio editing interface.

Answer

Edit the underlying search of a report used in a panel.

Answer

Export the dashboard as a PDF from the editor.

Question 3

A user wants to create a report that shows the top 5 most frequent error messages from the last 7 days. The search results should be sorted by count. Which search is correct?

Accepted Answer

error | top limit=5 message. The `top` command automatically counts the occurrences of each distinct value of the `message` field, sorts the results in descending order by count, and limits the output to the top 5 results. This directly fulfills the requirement of showing the top 5 most frequent error messages from the last 7 days, sorted by count.

Answer

error | top 5 message

Answer

error | rare message | head 5

Answer

error | stats count by message | sort -count

Question 4

Refer to the exhibit. A user runs this search and the resulting timechart shows multiple lines, one for each host. The user wants to show only the top 3 hosts by total count. Which modification achieves this?

Accepted Answer

Add | top 3 host before timechart. The `top 3 host` command, when placed before `timechart`, calculates the top 3 hosts by total count across the entire search timeframe, then passes only those three hosts to the `timechart` command. This ensures the timechart displays exactly three lines, one for each of the top hosts, based on their overall event count.

Answer

Add | top 3 host after timechart

Answer

Add | where host in (select top 3) after timechart

Answer

Add | head 3 after timechart

Question 5

A dashboard includes a single value visualization showing the total number of login failures. The number seems too high. Which common mistake could cause inflated counts?

Accepted Answer

Using `count` instead of `sum` when each event holds multiple failures. When a single event contains multiple login failures (e.g., a log line like 'Failed logins: 5'), using `count` merely counts the number of events, not the total failures. The `sum` command is required to aggregate the numeric field representing failures across events, giving the true total. This is a classic pitfall in Splunk where `count` (event count) is confused with `sum` (field value summation).

Answer

Using `dedup` before counting

Answer

Splitting by user without combining

Answer

Setting a too narrow time range

Question 6

A team creates a dashboard that uses a drop-down input to select a server. The dashboard slows down significantly when the input changes. What is the most likely cause?

Accepted Answer

The input's search is not using a summary index or accelerated data. A drop-down input that triggers a search each time the user selects a new value can cause significant performance degradation if the underlying search is not optimized. Using a summary index or accelerated data allows the dashboard to retrieve pre-computed results instead of running a full raw data search on every selection, reducing load on the search head and indexers.

Answer

The input is based on a report that runs every hour

Answer

The token name is too long

Answer

The input's results are cached too aggressively

Question 7

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup table in Splunk. The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Answer

The time range is set to a period with no data

Answer

The sort command requires a field name

Answer

The where clause is incorrectly formatted

Question 8

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Accepted Answer

Add the dashboard to a dashboard group with view permissions. Option C is correct because placing a dashboard into a dashboard group configured with view-only permissions lets other users see the dashboard while preventing them from editing it, since the group's permission level governs their access. Option D is correct because sharing the dashboard's URL with users who already have read access allows them to open and view the dashboard without granting any edit rights, as their existing read permission is sufficient and no write permission is conveyed. Option A is not correct because embedding a dashboard in an external website is a publishing/distribution mechanism, not a permission-based sharing method that controls edit rights for internal users. Option B is not correct because cloning a dashboard creates a separate copy, and giving the clone to users typically transfers ownership or edit control over that copy rather than sharing the original read-only. Option E is not correct because exporting to PDF and emailing is a static snapshot distribution, not a method of sharing the live dashboard with controlled permissions.

Answer

Embed the dashboard in an external website

Answer

Clone the dashboard and give the clone to users

Answer

Export the dashboard as a PDF and email it

Question 9

Which THREE are essential components of a Splunk dashboard?

Accepted Answer

Panels (e.g., charts, tables). Panels (A) are essential because a Splunk dashboard is fundamentally a collection of visualizations such as charts, tables, single-value displays, and maps that render search results for the user. Inputs (B) are essential because they let users dynamically control the dashboard, for example via dropdowns, text boxes, checkboxes, and time pickers that feed tokens into the underlying searches. Searches (E) are essential because every panel's visualization is driven by an embedded or referenced search (inline SPL, a saved search, or a base search with post-processing) that retrieves the data to display. Reports (C) are not required, since a panel can use an inline or ad hoc search rather than a saved report, and Alerts (D) are not required because scheduled alert actions are a separate monitoring feature and play no role in rendering a dashboard.

Answer

Reports (saved searches)

Answer

Alerts (scheduled actions)

Question 10

You are a Splunk administrator at a large e-commerce company. The operations team has created a real-time dashboard to monitor website performance. The dashboard includes multiple panels: a line chart showing page load times over the last 60 minutes, a single value showing the number of active users, and a table listing the top 10 slowest pages. The dashboard refreshes every 30 seconds. Recently, users have reported that the dashboard is very slow to load and sometimes times out. The underlying searches are not accelerated. The dashboard uses a shared time range picker set to 'Last 60 minutes'. The index for web logs receives about 2 GB of data per hour. The team wants to improve performance without losing real-time capability. Which approach best addresses the problem?

Accepted Answer

Reduce the time range to 'Last 15 minutes' and keep the 30-second refresh.. Reducing the time range to 'Last 15 minutes' significantly decreases the volume of data each search must scan, which directly reduces search execution time and dashboard load time. Since the dashboard refreshes every 30 seconds, a shorter time range still provides near-real-time visibility while preventing timeouts. The underlying searches are not accelerated, so limiting the data scanned is the most effective immediate performance improvement.

Answer

Increase the refresh interval to 5 minutes to reduce search frequency.

Answer

Implement summary indexing for the searches and run them every 5 minutes.

Answer

Remove the single value panel to reduce the number of searches.

Question 11

You are a Splunk analyst for a financial services firm. You need to create a weekly report for management showing the total transaction value and number of transactions per day, broken down by transaction type (credit, debit, transfer). The data is in index=transactions with fields: trans_date, trans_type, amount. The report should be sent via email every Monday morning at 8 AM. You have created a report with the search: `index=transactions | timechart sum(amount) by trans_type`. However, the timechart shows only one series because the trans_type field has multiple values. You need to fix the search so that it correctly separates by trans_type. Additionally, you need to schedule the report. What should you do?

Accepted Answer

Use `| eval trans_type=split(trans_type, ",") | mvexpand trans_type | timechart sum(amount) by trans_type`.. The trans_type field contains multiple values in a single field (e.g., 'credit,debit,transfer'), so you must first split the values using `split()` and then expand them with `mvexpand` before using `timechart` to correctly separate the series. This ensures each transaction type is treated as an individual event for the aggregation.

Answer

Add `| stats sum(amount) by _time, trans_type` before timechart.

Answer

Use `| chart sum(amount) by trans_type` instead of timechart.

Answer

Use `| makemv trans_type | timechart sum(amount) by trans_type`.

Question 12

A security analyst has created a report that shows the count of failed login attempts by user. The analyst now wants to display this data as a column chart on a dashboard. Which Splunk feature should be used to convert the report into a visualization?

Accepted Answer

Use the 'Save As Dashboard Panel' option on the report.. The 'Save As Dashboard Panel' option on a report directly converts the report's search and visualization settings into a dashboard panel, preserving the column chart configuration. This is the intended workflow in Splunk for turning a saved report into a reusable dashboard visualization without manual reconfiguration.

Answer

Schedule the report to run and then export the results as a PDF.

Answer

Convert the report to an alert and then add it to the dashboard.

Answer

Copy the report's search string and paste it into a new dashboard panel.

Question 13

A dashboard includes a time range picker. When a user selects 'Last 7 days', one panel does not update its data accordingly. What is the most likely cause?

Accepted Answer

The panel's search uses a hard-coded time range like earliest=-30d.. When a dashboard has a time range picker, each panel's search must reference the picker's time tokens (e.g., `$time$` or `$earliest$`/`$latest$`) to dynamically inherit the selected range. Option B is correct because a hard-coded time range like `earliest=-30d` overrides the picker, causing the panel to ignore the user's selection of 'Last 7 days' and always show data from the last 30 days.

Answer

The panel has insufficient permissions to access the data.

Answer

The dashboard time picker is set to 'All time'.

Answer

The panel is based on a scheduled report.

Question 14

Which TWO of the following are valid ways to add a visualization to a dashboard in Splunk?

Accepted Answer

Create a new panel in the dashboard editor and select a visualization type.. Option B is correct because in the Splunk dashboard editor (Classic or Dashboard Studio) you can add a new panel and choose a visualization type such as column chart, pie chart, single value, or table, which is the standard way to add a visualization to a dashboard. Option D is correct because Splunk lets you take an existing saved report and use 'Save As > Dashboard Panel' (or Add to Dashboard) to convert that report into a dashboard panel with its visualization intact. Option A is not a valid method because the Edit button on a panel changes the panel's search, title, or formatting, not its fundamental visualization type in the way described. Option C is not valid because exporting a report as a PDF and uploading it as an image panel is not a supported Splunk dashboard workflow. Option E is not valid because alerts can trigger actions like email, webhook, or script, but they cannot be configured to add a panel to a dashboard.

Answer

Use the 'Edit' button on an existing panel to change it to a new visualization.

Answer

Export a report as a PDF and upload it as an image panel.

Answer

Set up an alert and configure it to add a panel to the dashboard.

Question 15

Refer to the exhibit. The search is expected to produce a count of HTTP status codes grouped into categories. However, the results show a column 'status' instead of 'status_category'. What is the problem?

Accepted Answer

The first 'stats count by status' is unnecessary; the eval should be applied first, then stats.. The search pipeline first uses `stats count by status`, which consumes the raw `status` field and outputs only the `status` and `count` fields. The subsequent `eval` command then tries to create `status_category` from `status`, but `status` still exists after the first `stats` (it is the group-by field). The real issue is that the `eval` should be placed before the first `stats` so that the categorization happens on the raw `status` values, and then `stats count by status_category` can aggregate by the new field. The first `stats` is unnecessary and disrupts the intended flow.

Answer

The eval command references a field 'status' that does not exist after the first stats.

Answer

The second stats command should be 'stats count by status'.

Answer

The eval command should use 'if' instead of 'case'.

Question 16

Which TWO of the following are valid methods to convert a saved search into a report in Splunk?

Accepted Answer

Click 'Reports' in the app bar, then 'Create New Report', and select 'From an existing saved search'.. Option C is correct because Splunk's Reports listing page provides a 'Create New Report' workflow that lets you build a report 'From an existing saved search', which is a documented way to promote a saved search to a report. Option D is correct because the Settings > Searches, reports, and alerts (Saved Searches) page exposes an 'Edit' action for a saved search whose 'Save As' menu includes 'Save As Report', converting the saved search into a report. Option A is wrong because the 'Save As' button on the search results page offers 'Report' only for an unsaved ad-hoc search, not for converting an already saved search. Option B is wrong because 'Convert to Dashboard Panel' creates a dashboard panel, not a report. Option E is wrong because the Job Manager only lets you inspect, share, or delete search jobs; it has no 'Convert to Report' action.

Answer

On the search results page, click the 'Save As' button and select 'Report'.

Answer

Open the saved search, click 'Edit', then select 'Convert to Dashboard Panel'.

Answer

From the 'Job Manager', select the job and click 'Convert to Report'.

Question 17

You are a Splunk administrator for a large e-commerce company. The operations team uses a dashboard to monitor server health, which includes a single-value panel showing the current number of active users, a bar chart of error counts by service, and a table of recent critical log entries. Recently, users have reported that the dashboard loads very slowly, sometimes taking over 30 seconds to display all panels. The dashboard uses base search and post-process searches to reduce duplication. The base search retrieves all logs from the last 24 hours, and each panel runs a post-process search to filter and aggregate data. The dashboard is scheduled to refresh every 60 seconds. There are approximately 10 million events per day. After investigating, you notice that the base search returns a large amount of data, and each post-process search still processes a significant subset. Which approach would most effectively improve dashboard performance without significantly altering the dashboard's functionality?

Accepted Answer

Create a summary index that pre-aggregates logs by hour and service, then modify the base search to use the summary index and adjust post-process searches accordingly.. Creating a summary index that pre-aggregates logs by hour and service drastically reduces the volume of data the base search must process. Instead of scanning 10 million raw events per 60-second refresh, the base search queries pre-computed hourly summaries, and each post-process search operates on a much smaller, aggregated dataset. This approach preserves all dashboard panels and their functionality while addressing the root cause of slow performance: excessive data volume in the base search.

Answer

Remove the table of critical log entries to reduce the number of post-process searches.

Answer

Change the base search to a real-time search so that the data is streamed continuously.

Answer

Increase the dashboard refresh interval to 300 seconds to reduce the frequency of searches.

Question 18

Which three of the following are valid approaches for creating a dashboard in Splunk Web? (Choose three.)

Accepted Answer

Import a dashboard definition from a saved XML file.. These three options are correct because Splunk Web provides direct, supported methods for creating dashboards. Converting an existing report into a dashboard panel is a standard workflow from the report's 'Edit' menu. The Dashboard Studio editor is the modern, built-in interface for creating dashboards from scratch. Importing a dashboard definition from a saved XML file is supported via the 'Create New Dashboard' dialog, which allows you to upload a dashboard XML definition.

Answer

Use the REST API to create a dashboard from a CSV lookup file.

Answer

Clone a dashboard from the Settings > Knowledge menu.

Answer

Generate a dashboard automatically from a search job's statistics tab.

Question 19

Which three options correctly describe characteristics or behaviors of Splunk reports and visualizations? (Choose three.)

Accepted Answer

The trellis layout in a chart divides data into multiple smaller charts based on a field.. Options A, B, C, and D are all correct. Option A is correct because Splunk reports can be scheduled to run at specific times and send results via email. Option B is correct because the trellis layout splits a chart into multiple smaller charts based on a field. Option C is correct because a single report can be reused as a data source for multiple dashboard panels via its SID. Option D is correct because the Single Value visualization can display trend indicators and sparklines. Options E and F are incorrect: radial gauges are not the default visualization; time series charts do support the 'stacked' mode.

Answer

The Single Value visualization can display trend indicators and sparklines.

Answer

Time series charts cannot be used with the 'stacked' mode option.

Answer

Radial gauges are the default visualization type for all statistical reports.

Question 20

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

Accepted Answer

Step 1: Check the time range; Step 2: Check the search syntax; Step 3: Verify that data is being indexed; Step 4: Check internal Splunk logs (e.g., _internal).. Troubleshooting no results involves checking time range, syntax, data existence, and logs.

Answer

Step 1: Check the search syntax; Step 2: Check the time range; Step 3: Verify that data is being indexed; Step 4: Check internal Splunk logs.

Answer

Step 1: Check internal Splunk logs; Step 2: Verify that data is being indexed; Step 3: Check the search syntax; Step 4: Check the time range.

Answer

Step 1: Verify that data is being indexed; Step 2: Check the time range; Step 3: Check the search syntax; Step 4: Check internal Splunk logs.