SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A user runs this search from a dashboard panel. The panel shows no results, but the lookup file exists and has data. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup table in Splunk. The search references a lookup file by name, but Splunk requires that lookup files be explicitly defined as lookup tables via Settings > Lookups > Lookup table definitions before they can be used in search commands like `lookup`, `inputlookup`, or `outputlookup`. Without this definition, Splunk cannot resolve the file name to a valid lookup table, causing the search to return no results even though the file exists on disk.

Answer

The time range is set to a period with no data

Answer

The sort command requires a field name

Answer

The where clause is incorrectly formatted

Question 2

A user creates a dashboard with multiple panels. Some panels share the same search. To improve performance, what should the user do?

Accepted Answer

Define a base search and use post-process for each panel. Defining a base search and using post-process searches allows the dashboard to run the common search once and then apply different post-processing transformations on the same result set. This reduces the overall search load on the indexers and search head, improving performance by avoiding redundant data retrieval and aggregation for each panel.

Answer

Use post-process searches without a base search

Answer

Create separate searches for each panel with same query

Answer

Increase the time range to include more data

Question 3

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Accepted Answer

Add the dashboard to a dashboard group with view permissions. Splunk allows you to add a dashboard to a dashboard group and set the group's permissions to 'read' (view) only. This grants users access to view the dashboard without the ability to edit it, as edit permissions are controlled separately via roles and object-level ACLs.

Answer

Embed the dashboard in an external website

Answer

Clone the dashboard and give the clone to users

Answer

Export the dashboard as a PDF and email it

Question 4

Which THREE are essential components of a Splunk dashboard?

Accepted Answer

Panels (e.g., charts, tables). Panels are the fundamental visual building blocks of a Splunk dashboard. Each panel displays data using a visualization type such as a chart, table, single value, or map, and is powered by either an inline search or a referenced saved search. Without panels, a dashboard would have no content to present to the user.

Answer

Reports (saved searches)

Answer

Alerts (scheduled actions)

Question 5

You are a Splunk administrator at a large e-commerce company. The operations team has created a real-time dashboard to monitor website performance. The dashboard includes multiple panels: a line chart showing page load times over the last 60 minutes, a single value showing the number of active users, and a table listing the top 10 slowest pages. The dashboard refreshes every 30 seconds. Recently, users have reported that the dashboard is very slow to load and sometimes times out. The underlying searches are not accelerated. The dashboard uses a shared time range picker set to 'Last 60 minutes'. The index for web logs receives about 2 GB of data per hour. The team wants to improve performance without losing real-time capability. Which approach best addresses the problem?

Accepted Answer

Reduce the time range to 'Last 15 minutes' and keep the 30-second refresh.. Reducing the time range to 'Last 15 minutes' significantly decreases the volume of data each search must scan, which directly reduces search execution time and dashboard load time. Since the dashboard refreshes every 30 seconds, a shorter time range still provides near-real-time visibility while preventing timeouts. The underlying searches are not accelerated, so limiting the data scanned is the most effective immediate performance improvement.

Answer

Increase the refresh interval to 5 minutes to reduce search frequency.

Answer

Implement summary indexing for the searches and run them every 5 minutes.

Answer

Remove the single value panel to reduce the number of searches.

Question 6

You are a Splunk analyst for a financial services firm. You need to create a weekly report for management showing the total transaction value and number of transactions per day, broken down by transaction type (credit, debit, transfer). The data is in index=transactions with fields: trans_date, trans_type, amount. The report should be sent via email every Monday morning at 8 AM. You have created a report with the search: `index=transactions | timechart sum(amount) by trans_type`. However, the timechart shows only one series because the trans_type field has multiple values. You need to fix the search so that it correctly separates by trans_type. Additionally, you need to schedule the report. What should you do?

Accepted Answer

Use `| eval trans_type=split(trans_type, ",") | mvexpand trans_type | timechart sum(amount) by trans_type`.. The trans_type field contains multiple values in a single field (e.g., 'credit,debit,transfer'), so you must first split the values using `split()` and then expand them with `mvexpand` before using `timechart` to correctly separate the series. This ensures each transaction type is treated as an individual event for the aggregation.

Answer

Add `| stats sum(amount) by _time, trans_type` before timechart.

Answer

Use `| chart sum(amount) by trans_type` instead of timechart.

Answer

Use `| makemv trans_type | timechart sum(amount) by trans_type`.

Question 7

A security analyst has created a report that shows the count of failed login attempts by user. The analyst now wants to display this data as a column chart on a dashboard. Which Splunk feature should be used to convert the report into a visualization?

Accepted Answer

Use the 'Save As Dashboard Panel' option on the report.. The 'Save As Dashboard Panel' option on a report directly converts the report's search and visualization settings into a dashboard panel, preserving the column chart configuration. This is the intended workflow in Splunk for turning a saved report into a reusable dashboard visualization without manual reconfiguration.

Answer

Schedule the report to run and then export the results as a PDF.

Answer

Convert the report to an alert and then add it to the dashboard.

Answer

Copy the report's search string and paste it into a new dashboard panel.

Question 8

An IT operations team has a dashboard with multiple panels showing server metrics. Each panel uses a separate search that runs every time the dashboard is loaded, causing slow performance. What is the best practice to improve dashboard load time?

Accepted Answer

Use a base search and post-process searches for dependent panels.. Using a base search with post-process searches allows multiple dashboard panels to share a single, initial data retrieval. Instead of each panel running its own independent search against the index, they all reference the results of the base search, which runs once. This drastically reduces the number of indexer queries and speeds up dashboard load time, especially when panels share a common data source or filtering criteria.

Answer

Reduce the time range picker to the last 24 hours.

Answer

Combine all searches into one large search and use eval to separate results.

Answer

Add more panels to distribute the data load.

Question 9

A user wants to create a pie chart showing the distribution of error types from web server logs. Which Splunk command should be used to group the errors before visualization?

Accepted Answer

stats count by error_type. The `stats count by error_type` command groups the raw events by the `error_type` field and computes the count for each group, producing the structured data needed for a pie chart. A pie chart requires aggregated numerical values per category, and `stats count by` is the standard Splunk approach to create this summary from log events.

Answer

table

Answer

eval

Answer

top

Question 10

A dashboard includes a time range picker. When a user selects 'Last 7 days', one panel does not update its data accordingly. What is the most likely cause?

Accepted Answer

The panel's search uses a hard-coded time range like earliest=-30d.. When a dashboard has a time range picker, each panel's search must reference the picker's time tokens (e.g., `$time$` or `$earliest$`/`$latest$`) to dynamically inherit the selected range. Option B is correct because a hard-coded time range like `earliest=-30d` overrides the picker, causing the panel to ignore the user's selection of 'Last 7 days' and always show data from the last 30 days.

Answer

The panel has insufficient permissions to access the data.

Answer

The dashboard time picker is set to 'All time'.

Answer

The panel is based on a scheduled report.

Question 11

Which TWO of the following are valid ways to add a visualization to a dashboard in Splunk?

Accepted Answer

Create a new panel in the dashboard editor and select a visualization type.. The dashboard editor in Splunk provides a dedicated workflow to add a new panel and then select a visualization type (e.g., chart, table, map) from the 'Visualization' tab. This is the standard method for building a panel from scratch within a dashboard, allowing you to define the search and choose the appropriate visualization for your data.

Answer

Use the 'Edit' button on an existing panel to change it to a new visualization.

Answer

Export a report as a PDF and upload it as an image panel.

Answer

Set up an alert and configure it to add a panel to the dashboard.

Question 12

Refer to the exhibit. The search is expected to produce a count of HTTP status codes grouped into categories. However, the results show a column 'status' instead of 'status_category'. What is the problem?

Accepted Answer

The first 'stats count by status' is unnecessary; the eval should be applied first, then stats.. The search pipeline first uses `stats count by status`, which consumes the raw `status` field and outputs only the `status` and `count` fields. The subsequent `eval` command then tries to create `status_category` from `status`, but `status` still exists after the first `stats` (it is the group-by field). The real issue is that the `eval` should be placed before the first `stats` so that the categorization happens on the raw `status` values, and then `stats count by status_category` can aggregate by the new field. The first `stats` is unnecessary and disrupts the intended flow.

Answer

The eval command references a field 'status' that does not exist after the first stats.

Answer

The second stats command should be 'stats count by status'.

Answer

The eval command should use 'if' instead of 'case'.

Question 13

Which TWO of the following are valid methods to convert a saved search into a report in Splunk?

Accepted Answer

Click 'Reports' in the app bar, then 'Create New Report', and select 'From an existing saved search'.. Splunk provides a dedicated workflow to create a report from an existing saved search via the 'Reports' page. By clicking 'Create New Report' and selecting 'From an existing saved search', you can directly convert the saved search's query and settings into a report object, preserving the search logic and scheduling. This method is explicitly supported in Splunk's UI for report creation.

Answer

On the search results page, click the 'Save As' button and select 'Report'.

Answer

Open the saved search, click 'Edit', then select 'Convert to Dashboard Panel'.

Answer

From the 'Job Manager', select the job and click 'Convert to Report'.

Question 14

You are a Splunk administrator for a large e-commerce company. The operations team uses a dashboard to monitor server health, which includes a single-value panel showing the current number of active users, a bar chart of error counts by service, and a table of recent critical log entries. Recently, users have reported that the dashboard loads very slowly, sometimes taking over 30 seconds to display all panels. The dashboard uses base search and post-process searches to reduce duplication. The base search retrieves all logs from the last 24 hours, and each panel runs a post-process search to filter and aggregate data. The dashboard is scheduled to refresh every 60 seconds. There are approximately 10 million events per day. After investigating, you notice that the base search returns a large amount of data, and each post-process search still processes a significant subset. Which approach would most effectively improve dashboard performance without significantly altering the dashboard's functionality?

Accepted Answer

Create a summary index that pre-aggregates logs by hour and service, then modify the base search to use the summary index and adjust post-process searches accordingly.. Creating a summary index that pre-aggregates logs by hour and service drastically reduces the volume of data the base search must process. Instead of scanning 10 million raw events per 60-second refresh, the base search queries pre-computed hourly summaries, and each post-process search operates on a much smaller, aggregated dataset. This approach preserves all dashboard panels and their functionality while addressing the root cause of slow performance: excessive data volume in the base search.

Answer

Remove the table of critical log entries to reduce the number of post-process searches.

Answer

Change the base search to a real-time search so that the data is streamed continuously.

Answer

Increase the dashboard refresh interval to 300 seconds to reduce the frequency of searches.

Question 15

Which three of the following are valid approaches for creating a dashboard in Splunk Web? (Choose three.)

Accepted Answer

Create a new dashboard using the Dashboard Studio editor.. These three options are correct because Splunk Web provides direct, supported methods for creating dashboards. Converting an existing report into a dashboard panel is a standard workflow from the report's 'Edit' menu. The Dashboard Studio editor is the modern, built-in interface for creating dashboards from scratch. Importing a dashboard definition from a saved XML file is supported via the 'Create New Dashboard' dialog, which allows you to upload a dashboard XML definition.

Answer

Use the REST API to create a dashboard from a CSV lookup file.

Answer

Generate a dashboard automatically from a search job's statistics tab.

Answer

Clone a dashboard from the Settings > Knowledge menu.