SPLK-1001 Creating Reports, Dashboards and Visualizations — 40 Questions

Question 1

You are a Splunk administrator for a large e-commerce company. The marketing team has a dashboard that displays daily sales metrics, including revenue, number of transactions, and average order value. The dashboard is built using a single search that runs a 'timechart' command across all events. Recently, the dashboard has been timing out and failing to load during peak hours (10 AM - 2 PM) when traffic is highest. The team needs the dashboard to be available with minimal latency. You have the following options:

A. Reduce the time range on the dashboard to the last hour instead of the default last 24 hours.
B. Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.
C. Increase the search time limit in the Splunk settings to allow the search to run longer.
D. Split the single search into multiple smaller searches, each for a different metric, and run them concurrently on separate panels.

Which option best addresses the performance issue while maintaining data accuracy?

Accepted Answer

Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.. Creating a summary index that pre-aggregates sales metrics every hour offloads heavy computation from real-time searches. The dashboard then queries this smaller, pre-computed dataset, drastically reducing search time and avoiding timeouts during peak hours, while maintaining data accuracy since the aggregation is done on the raw data. Other options are less effective: reducing time range (Option B) loses historical data; splitting into multiple searches (Option A) may increase I/O and CPU contention; increasing time limit (Option D) does not address the root cause of scanning large volumes of raw data.

Answer

Split the single search into multiple smaller searches.

Answer

Reduce the time range on the dashboard to the last hour.

Answer

Increase the search time limit in Splunk settings.

Question 2

Which three options correctly describe characteristics or behaviors of Splunk reports and visualizations? (Choose three.)

Accepted Answer

A report can be scheduled to run at a specific time and send results via email.. Options A, B, C, and D are all correct. Option A is correct because Splunk reports can be scheduled to run at specific times and send results via email. Option B is correct because the trellis layout splits a chart into multiple smaller charts based on a field. Option C is correct because a single report can be reused as a data source for multiple dashboard panels via its SID. Option D is correct because the Single Value visualization can display trend indicators and sparklines. Options E and F are incorrect: radial gauges are not the default visualization; time series charts do support the 'stacked' mode.

Answer

Time series charts cannot be used with the 'stacked' mode option.

Answer

Radial gauges are the default visualization type for all statistical reports.

Answer

The Single Value visualization can display trend indicators and sparklines.

Question 3

A security team needs to create a report that shows the number of distinct users who triggered a firewall block each day for the past 30 days. Which search and visualization combination should be used?

Accepted Answer

Use `dc(user)` with `timechart` and a column chart. `dc(user)` calculates the distinct count of users, and `timechart` automatically groups results by time (e.g., per day) over the specified 30-day range. A column chart is the appropriate visualization for displaying discrete daily counts, as it clearly shows trends over time.

Answer

Use `dc(user)` with `chart` and a column chart

Answer

Use `top user` with `timechart` and a pie chart

Answer

Use `count` with `chart` and a bar chart

Question 4

A user wants to create a dashboard panel that refreshes automatically every 60 seconds. Which setting must be configured in the panel's edit mode?

Accepted Answer

Set the Refresh Interval to 60 seconds. The dashboard panel's edit mode includes a 'Refresh Interval' setting that allows you to specify an automatic refresh period in seconds. Setting this to 60 causes the panel to re-run its underlying search and update the visualization every 60 seconds without manual intervention.

Answer

Add | delay 60 to the search

Answer

Schedule the search to run every 60 seconds

Answer

Set the Time Range to Last 60 seconds

Question 5

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 6

Which TWO statements are true about saved reports in Splunk?

Accepted Answer

Saved reports can be used as data sources for dashboard panels.. Saved reports in Splunk can be used as data sources for dashboard panels. When you create a dashboard panel, you can select a saved report as its data source, which allows the panel to display the report's results. This enables reuse of report logic across multiple dashboards without rewriting the search.

Answer

All saved reports automatically send email alerts.

Answer

Saved reports are created exclusively from dashboard panels.

Answer

Saved reports cannot be edited after creation.

Question 7

Which THREE of the following are valid ways to add a visualization to a dashboard?

Accepted Answer

Paste a search query in the dashboard editor.. Pasting a search query directly into the dashboard editor is a standard method for creating a new panel. When you paste a search in the editor, Splunk automatically generates a visualization based on the search results, allowing you to configure the chart type and formatting within the dashboard context.

Answer

Create a report and then drag it onto the dashboard.

Answer

Upload a CSV file and select visualization type.

Question 8

Which TWO chart types are best suited for showing the distribution of categorical data?

Accepted Answer

Pie chart. Pie charts and column charts are both effective for displaying the distribution of categorical data because they visually compare parts of a whole or the frequency of distinct categories. In Splunk, the `pie` and `column` chart types are commonly used with the `chart` or `timechart` commands to aggregate event counts or statistical values by a categorical field, making it easy to see relative proportions or rankings.

Answer

Scatter chart

Answer

Line chart

Answer

Area chart

Question 9

Which THREE actions are possible when editing a dashboard in Studio?

Accepted Answer

Set a custom time range for the dashboard.. In Splunk Dashboard Studio, you can set a custom time range for the entire dashboard via the 'Time Range' picker in the editor. This overrides the default time range and applies to all panels that do not have their own explicit time range set, allowing consistent temporal scoping across the dashboard.

Answer

Edit the underlying search of a report used in a panel.

Answer

Export the dashboard as a PDF from the editor.

Question 10

A user wants to create a report that shows the top 5 most frequent error messages from the last 7 days. The search results should be sorted by count. Which search is correct?

Accepted Answer

error | top limit=5 message. The `top` command automatically counts the occurrences of each distinct value of the `message` field, sorts the results in descending order by count, and limits the output to the top 5 results. This directly fulfills the requirement of showing the top 5 most frequent error messages from the last 7 days, sorted by count.

Answer

error | top 5 message

Answer

error | rare message | head 5

Answer

error | stats count by message | sort -count

Question 11

Refer to the exhibit. A user runs this search and the resulting timechart shows multiple lines, one for each host. The user wants to show only the top 3 hosts by total count. Which modification achieves this?

Accepted Answer

Add | top 3 host before timechart. The `top 3 host` command, when placed before `timechart`, calculates the top 3 hosts by total count across the entire search timeframe, then passes only those three hosts to the `timechart` command. This ensures the timechart displays exactly three lines, one for each of the top hosts, based on their overall event count.

Answer

Add | top 3 host after timechart

Answer

Add | where host in (select top 3) after timechart

Answer

Add | head 3 after timechart

Question 12

A dashboard includes a single value visualization showing the total number of login failures. The number seems too high. Which common mistake could cause inflated counts?

Accepted Answer

Using `count` instead of `sum` when each event holds multiple failures. When a single event contains multiple login failures (e.g., a log line like 'Failed logins: 5'), using `count` merely counts the number of events, not the total failures. The `sum` command is required to aggregate the numeric field representing failures across events, giving the true total. This is a classic pitfall in Splunk where `count` (event count) is confused with `sum` (field value summation).

Answer

Using `dedup` before counting

Answer

Splitting by user without combining

Answer

Setting a too narrow time range

Question 13

A team creates a dashboard that uses a drop-down input to select a server. The dashboard slows down significantly when the input changes. What is the most likely cause?

Accepted Answer

The input's search is not using a summary index or accelerated data. A drop-down input that triggers a search each time the user selects a new value can cause significant performance degradation if the underlying search is not optimized. Using a summary index or accelerated data allows the dashboard to retrieve pre-computed results instead of running a full raw data search on every selection, reducing load on the search head and indexers.

Answer

The input is based on a report that runs every hour

Answer

The token name is too long

Answer

The input's results are cached too aggressively

Question 14

A user wants to create a report that shows the average response time for each web endpoint over the past week. The data has fields: endpoint, response_time. Which search correctly calculates the average?

Accepted Answer

... | stats avg(response_time) by endpoint. The `stats avg(response_time) by endpoint` command calculates the average (mean) of the response_time field for each unique endpoint value. This directly meets the requirement of showing average response time per web endpoint over the past week, assuming the time range is set in the search bar or via an earliest/latest constraint.

Answer

... | stats mean(response_time) by endpoint

Answer

... | stats avg(response_time) by _time

Answer

... | eval avg=sum(response_time)/count | stats values(avg) by endpoint

Question 15

Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?

Accepted Answer

Stacked column chart. A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.

Answer

Line chart

Answer

Pie chart

Answer

Scatter chart

Question 16

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup table in Splunk. The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Answer

The time range is set to a period with no data

Answer

The sort command requires a field name

Answer

The where clause is incorrectly formatted

Question 17

A user creates a dashboard with multiple panels. Some panels share the same search. To improve performance, what should the user do?

Accepted Answer

Define a base search and use post-process for each panel. Defining a base search and using post-process searches allows the dashboard to run the common search once and then apply different post-processing transformations on the same result set. This reduces the overall search load on the indexers and search head, improving performance by avoiding redundant data retrieval and aggregation for each panel.

Answer

Use post-process searches without a base search

Answer

Create separate searches for each panel with same query

Answer

Increase the time range to include more data

Question 18

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Accepted Answer

Add the dashboard to a dashboard group with view permissions. Splunk allows you to add a dashboard to a dashboard group and set the group's permissions to 'read' (view) only. This grants users access to view the dashboard without the ability to edit it, as edit permissions are controlled separately via roles and object-level ACLs.

Answer

Embed the dashboard in an external website

Answer

Clone the dashboard and give the clone to users

Answer

Export the dashboard as a PDF and email it

Question 19

Which THREE are essential components of a Splunk dashboard?

Accepted Answer

Panels (e.g., charts, tables). Panels are the fundamental visual building blocks of a Splunk dashboard. Each panel displays data using a visualization type such as a chart, table, single value, or map, and is powered by either an inline search or a referenced saved search. Without panels, a dashboard would have no content to present to the user.

Answer

Reports (saved searches)

Answer

Alerts (scheduled actions)

Question 20

You are a Splunk administrator at a large e-commerce company. The operations team has created a real-time dashboard to monitor website performance. The dashboard includes multiple panels: a line chart showing page load times over the last 60 minutes, a single value showing the number of active users, and a table listing the top 10 slowest pages. The dashboard refreshes every 30 seconds. Recently, users have reported that the dashboard is very slow to load and sometimes times out. The underlying searches are not accelerated. The dashboard uses a shared time range picker set to 'Last 60 minutes'. The index for web logs receives about 2 GB of data per hour. The team wants to improve performance without losing real-time capability. Which approach best addresses the problem?

Accepted Answer

Reduce the time range to 'Last 15 minutes' and keep the 30-second refresh.. Reducing the time range to 'Last 15 minutes' significantly decreases the volume of data each search must scan, which directly reduces search execution time and dashboard load time. Since the dashboard refreshes every 30 seconds, a shorter time range still provides near-real-time visibility while preventing timeouts. The underlying searches are not accelerated, so limiting the data scanned is the most effective immediate performance improvement.

Answer

Increase the refresh interval to 5 minutes to reduce search frequency.

Answer

Implement summary indexing for the searches and run them every 5 minutes.

Answer

Remove the single value panel to reduce the number of searches.