SPLK-1002 Creating Reports, Dashboards and Visualizations — 30 Questions

Question 1

A security team needs to create a report that shows the number of distinct users who triggered a firewall block each day for the past 30 days. Which search and visualization combination should be used?

Accepted Answer

Use `dc(user)` with `timechart` and a column chart. Option C is correct because `dc(user)` calculates the distinct count of users, and `timechart` automatically groups results by time (e.g., per day) over the specified 30-day range. A column chart is the appropriate visualization for displaying discrete daily counts, as it clearly shows trends over time.

Answer

Use `dc(user)` with `chart` and a column chart

Answer

Use `top user` with `timechart` and a pie chart

Answer

Use `count` with `chart` and a bar chart

Question 2

A user wants to create a dashboard panel that refreshes automatically every 60 seconds. Which setting must be configured in the panel's edit mode?

Accepted Answer

Set the Refresh Interval to 60 seconds. Option B is correct because the dashboard panel's edit mode includes a 'Refresh Interval' setting that allows you to specify an automatic refresh period in seconds. Setting this to 60 causes the panel to re-run its underlying search and update the visualization every 60 seconds without manual intervention.

Answer

Add | delay 60 to the search

Answer

Schedule the search to run every 60 seconds

Answer

Set the Time Range to Last 60 seconds

Question 3

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Option C is correct because setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 4

Which TWO statements are true about saved reports in Splunk?

Accepted Answer

Saved reports can be used as data sources for dashboard panels.. Option C is correct because saved reports in Splunk can be used as data sources for dashboard panels. When you create a dashboard panel, you can select a saved report as its data source, which allows the panel to display the report's results. This enables reuse of report logic across multiple dashboards without rewriting the search.

Answer

All saved reports automatically send email alerts.

Answer

Saved reports are created exclusively from dashboard panels.

Answer

Saved reports cannot be edited after creation.

Question 5

Which THREE of the following are valid ways to add a visualization to a dashboard?

Accepted Answer

Paste a search query in the dashboard editor.. Option A is correct because pasting a search query directly into the dashboard editor is a standard method for creating a new panel. When you paste a search in the editor, Splunk automatically generates a visualization based on the search results, allowing you to configure the chart type and formatting within the dashboard context.

Answer

Create a report and then drag it onto the dashboard.

Answer

Upload a CSV file and select visualization type.

Question 6

Which TWO chart types are best suited for showing the distribution of categorical data?

Accepted Answer

Pie chart. Pie charts and column charts are both effective for displaying the distribution of categorical data because they visually compare parts of a whole or the frequency of distinct categories. In Splunk, the `pie` and `column` chart types are commonly used with the `chart` or `timechart` commands to aggregate event counts or statistical values by a categorical field, making it easy to see relative proportions or rankings.

Answer

Scatter chart

Answer

Line chart

Answer

Area chart

Question 7

Which THREE actions are possible when editing a dashboard in Studio?

Accepted Answer

Set a custom time range for the dashboard.. Option A is correct because in Splunk Dashboard Studio, you can set a custom time range for the entire dashboard via the 'Time Range' picker in the editor. This overrides the default time range and applies to all panels that do not have their own explicit time range set, allowing consistent temporal scoping across the dashboard.

Answer

Edit the underlying search of a report used in a panel.

Answer

Export the dashboard as a PDF from the editor.

Question 8

A user wants to create a report that shows the top 5 most frequent error messages from the last 7 days. The search results should be sorted by count. Which search is correct?

Accepted Answer

error | top limit=5 message. Option D is correct because the `top` command automatically counts the occurrences of each distinct value of the `message` field, sorts the results in descending order by count, and limits the output to the top 5 results. This directly fulfills the requirement of showing the top 5 most frequent error messages from the last 7 days, sorted by count.

Answer

error | top 5 message

Answer

error | rare message | head 5

Answer

error | stats count by message | sort -count

Question 9

Refer to the exhibit. A user runs this search and the resulting timechart shows multiple lines, one for each host. The user wants to show only the top 3 hosts by total count. Which modification achieves this?

Accepted Answer

Add | top 3 host before timechart. Option A is correct because the `top 3 host` command, when placed before `timechart`, calculates the top 3 hosts by total count across the entire search timeframe, then passes only those three hosts to the `timechart` command. This ensures the timechart displays exactly three lines, one for each of the top hosts, based on their overall event count.

Answer

Add | top 3 host after timechart

Answer

Add | where host in (select top 3) after timechart

Answer

Add | head 3 after timechart

Question 10

A dashboard includes a single value visualization showing the total number of login failures. The number seems too high. Which common mistake could cause inflated counts?

Accepted Answer

Using `count` instead of `sum` when each event holds multiple failures. Option A is correct because when a single event contains multiple login failures (e.g., a log line like 'Failed logins: 5'), using `count` merely counts the number of events, not the total failures. The `sum` command is required to aggregate the numeric field representing failures across events, giving the true total. This is a classic pitfall in Splunk where `count` (event count) is confused with `sum` (field value summation).

Answer

Using `dedup` before counting

Answer

Splitting by user without combining

Answer

Setting a too narrow time range

Question 11

A team creates a dashboard that uses a drop-down input to select a server. The dashboard slows down significantly when the input changes. What is the most likely cause?

Accepted Answer

The input's search is not using a summary index or accelerated data. Option B is correct because a drop-down input that triggers a search each time the user selects a new value can cause significant performance degradation if the underlying search is not optimized. Using a summary index or accelerated data allows the dashboard to retrieve pre-computed results instead of running a full raw data search on every selection, reducing load on the search head and indexers.

Answer

The input is based on a report that runs every hour

Answer

The token name is too long

Answer

The input's results are cached too aggressively

Question 12

A user wants to create a report that shows the average response time for each web endpoint over the past week. The data has fields: endpoint, response_time. Which search correctly calculates the average?

Accepted Answer

... | stats avg(response_time) by endpoint. Option A is correct because the `stats avg(response_time) by endpoint` command calculates the average (mean) of the response_time field for each unique endpoint value. This directly meets the requirement of showing average response time per web endpoint over the past week, assuming the time range is set in the search bar or via an earliest/latest constraint.

Answer

... | stats mean(response_time) by endpoint

Answer

... | stats avg(response_time) by _time

Answer

... | eval avg=sum(response_time)/count | stats values(avg) by endpoint

Question 13

Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?

Accepted Answer

Stacked column chart. A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.

Answer

Line chart

Answer

Pie chart

Answer

Scatter chart

Question 14

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup table in Splunk. The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Answer

The time range is set to a period with no data

Answer

The sort command requires a field name

Answer

The where clause is incorrectly formatted

Question 15

A user creates a dashboard with multiple panels. Some panels share the same search. To improve performance, what should the user do?

Accepted Answer

Define a base search and use post-process for each panel. Option D is correct because defining a base search and using post-process searches allows the dashboard to run the common search once and then apply different post-processing transformations on the same result set. This reduces the overall search load on the indexers and search head, improving performance by avoiding redundant data retrieval and aggregation for each panel.

Answer

Use post-process searches without a base search

Answer

Create separate searches for each panel with same query

Answer

Increase the time range to include more data

Question 16

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Accepted Answer

Add the dashboard to a dashboard group with view permissions. Option C is correct because Splunk allows you to add a dashboard to a dashboard group and set the group's permissions to 'read' (view) only. This grants users access to view the dashboard without the ability to edit it, as edit permissions are controlled separately via roles and object-level ACLs.

Answer

Embed the dashboard in an external website

Answer

Clone the dashboard and give the clone to users

Answer

Export the dashboard as a PDF and email it

Question 17

Which THREE are essential components of a Splunk dashboard?

Accepted Answer

Panels (e.g., charts, tables). Panels are the fundamental visual building blocks of a Splunk dashboard. Each panel displays data using a visualization type such as a chart, table, single value, or map, and is powered by either an inline search or a referenced saved search. Without panels, a dashboard would have no content to present to the user.

Answer

Reports (saved searches)

Answer

Alerts (scheduled actions)

Question 18

You are a Splunk administrator at a large e-commerce company. The operations team has created a real-time dashboard to monitor website performance. The dashboard includes multiple panels: a line chart showing page load times over the last 60 minutes, a single value showing the number of active users, and a table listing the top 10 slowest pages. The dashboard refreshes every 30 seconds. Recently, users have reported that the dashboard is very slow to load and sometimes times out. The underlying searches are not accelerated. The dashboard uses a shared time range picker set to 'Last 60 minutes'. The index for web logs receives about 2 GB of data per hour. The team wants to improve performance without losing real-time capability. Which approach best addresses the problem?

Accepted Answer

Reduce the time range to 'Last 15 minutes' and keep the 30-second refresh.. Option A is correct because reducing the time range to 'Last 15 minutes' significantly decreases the volume of data each search must scan, which directly reduces search execution time and dashboard load time. Since the dashboard refreshes every 30 seconds, a shorter time range still provides near-real-time visibility while preventing timeouts. The underlying searches are not accelerated, so limiting the data scanned is the most effective immediate performance improvement.

Answer

Increase the refresh interval to 5 minutes to reduce search frequency.

Answer

Implement summary indexing for the searches and run them every 5 minutes.

Answer

Remove the single value panel to reduce the number of searches.

Question 19

You are a Splunk analyst for a financial services firm. You need to create a weekly report for management showing the total transaction value and number of transactions per day, broken down by transaction type (credit, debit, transfer). The data is in index=transactions with fields: trans_date, trans_type, amount. The report should be sent via email every Monday morning at 8 AM. You have created a report with the search: `index=transactions | timechart sum(amount) by trans_type`. However, the timechart shows only one series because the trans_type field has multiple values. You need to fix the search so that it correctly separates by trans_type. Additionally, you need to schedule the report. What should you do?

Accepted Answer

Use `| eval trans_type=split(trans_type, ",") | mvexpand trans_type | timechart sum(amount) by trans_type`.. Option B is correct because the trans_type field contains multiple values in a single field (e.g., 'credit,debit,transfer'), so you must first split the values using `split()` and then expand them with `mvexpand` before using `timechart` to correctly separate the series. This ensures each transaction type is treated as an individual event for the aggregation.

Answer

Add `| stats sum(amount) by _time, trans_type` before timechart.

Answer

Use `| chart sum(amount) by trans_type` instead of timechart.

Answer

Use `| makemv trans_type | timechart sum(amount) by trans_type`.

Question 20

A security analyst has created a report that shows the count of failed login attempts by user. The analyst now wants to display this data as a column chart on a dashboard. Which Splunk feature should be used to convert the report into a visualization?

Accepted Answer

Use the 'Save As Dashboard Panel' option on the report.. The 'Save As Dashboard Panel' option on a report directly converts the report's search and visualization settings into a dashboard panel, preserving the column chart configuration. This is the intended workflow in Splunk for turning a saved report into a reusable dashboard visualization without manual reconfiguration.

Answer

Schedule the report to run and then export the results as a PDF.

Answer

Convert the report to an alert and then add it to the dashboard.

Answer

Copy the report's search string and paste it into a new dashboard panel.