SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 3 — 15 Questions

Question 1

A Splunk admin notices that a dashboard panel using `timechart` is showing gaps (null values) for some time periods where no events exist. The admin wants to display a zero instead of null to make the chart continuous. Which command should be added before `timechart`?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

`fillnull`. `fillnull`, is correct because it explicitly replaces null values with a specified value (default 0) in the results of a transforming command. In Splunk, `fillnull` is used after commands like `timechart` to fill gaps where no events exist. The question asks which command should be added "before `timechart`", but in practice, `fillnull` is placed after `timechart`. However, among the given choices, only `fillnull` can achieve the desired outcome. Option A (`timechart useother=t`) is unrelated to null filling. Option B (`eventstats`) does not replace nulls. Option C (`makecontinuous`) creates time buckets for missing periods but does not fill the null values; it leaves them as null or adds null events. Therefore, `fillnull` is the correct command to use in conjunction with `timechart` to display zeros instead of nulls.

Answer

`timechart useother=t`

Answer

`eventstats`

Answer

`makecontinuous`

Question 2

A user wants to create a bar chart showing the count of events by host for the last hour. Which command should be used?

Accepted Answer

`index=* | stats count by host`. `stats count by host` produces a table of hosts and their event counts, which can be directly visualized as a bar chart. The user wants a count of events by host for the last hour, and `stats` with a `by` clause is the appropriate transforming command to aggregate counts per host without time-series splitting.

Answer

`index=* | timechart count by host`

Answer

`index=* | top host`

Answer

`index=* | chart count by host`

Question 3

A dashboard includes a pie chart showing the distribution of error types. The data comes from a search that uses `top` command. The pie chart is showing a slice labeled 'Other' that is very large. What is the most likely cause?

Accepted Answer

The `top` command default limit is 10, grouping remaining into 'Other'.. The `top` command in Splunk by default returns the top 10 most common values and groups all remaining values into an 'Other' category. If the pie chart shows a very large 'Other' slice, it indicates that the default limit of 10 is too low for the dataset, causing many distinct error types to be lumped together. Option D correctly identifies this default behavior as the most likely cause.

Answer

The `top` command is using `limit=0` which shows all values.

Answer

The search uses `rare` instead of `top`.

Answer

The pie chart has a maximum number of slices set to 5.

Question 4

A dashboard designer wants to create a drilldown from one chart to another dashboard. Which TWO actions must be configured? (Select two.)

Accepted Answer

Set the target dashboard's token to accept the drilldown value. Option E is correct because in Splunk dashboards, a drilldown from one chart to another dashboard is configured by setting the source chart's drilldown action to 'link to dashboard', which specifies the target dashboard to open. Option D is correct because the target dashboard must have a token defined (typically a text token) to receive the value passed from the source chart's drilldown, allowing the target dashboard to filter or display data based on that value. Option A is incorrect because adding a search command to the chart is not a required configuration step for drilldown; the chart already has a search, and drilldown configuration is separate. Option B is incorrect because 'link to search' would open a search results page, not another dashboard, so it does not satisfy the requirement. Option C is incorrect because enabling dashboard permissions is unrelated to configuring drilldown behavior; permissions control access, not drilldown actions.

Answer

Add a search command to the chart

Answer

Set the source chart's drilldown to 'link to search'

Answer

Enable dashboard permissions

Question 5

A security analyst creates a dashboard with multiple timechart panels. To ensure the dashboard performs well with large datasets, which THREE practices should be followed? (Select three.)

Accepted Answer

Use the `fields` command to remove unnecessary fields early. Option C is correct because using the `fields` command early in the search pipeline removes unnecessary fields before subsequent processing, reducing the amount of data carried through the pipeline and improving dashboard performance. Option D is correct because limiting the time range to only the necessary periods reduces the volume of events scanned, which directly lowers search cost and speeds up timechart panels on large datasets. Option E is correct because report acceleration on the base search precomputes and stores results, so repeated dashboard panels can reuse accelerated data instead of re-running the full search each time. Option A is not appropriate because creating calculated fields with `| eval` after aggregation still requires processing the aggregated results and does not reduce the underlying data volume the way early field pruning or time-range limiting does. Option B is not appropriate because `eventstats` computes statistics across events and adds them back to each event, which is generally more resource-intensive than `stats`, so replacing `stats` with `eventstats` would not improve performance.

Answer

Use `| eval` to create calculated fields after aggregation

Answer

Use `eventstats` instead of `stats` when possible

Question 6

Refer to the exhibit. Which visualization would be most appropriate for this data?

Accepted Answer

Bar chart. A bar chart is the most appropriate visualization for this data because the exhibit shows categorical data (e.g., sourcetypes, hosts, or error codes) with a single numeric value (count or sum). Bar charts excel at comparing discrete categories, and Splunk's default behavior for a `stats count by field` command is to render a bar chart in the visualization tab, making it the natural choice for this structured output.

Answer

Line chart

Answer

Pie chart

Answer

Single value

Question 7

Refer to the exhibit. The user wants to display the count over time for each source. However, the chart shows only one line labeled 'MyCount'. What is the problem?

Accepted Answer

The `rename` command after `timechart` renames incorrectly; `timechart count by source` creates multiple fields, and `rename count as "MyCount"` does not rename them.. `timechart count by source` generates separate fields for each source value (e.g., `count: source1`, `count: source2`), not a single field named `count`. The subsequent `rename count as "MyCount"` fails to match any existing field, so the chart displays only one line labeled `MyCount` (which is actually a null or default aggregation). To rename all source-specific count fields, you must use a wildcard or rename each field individually.

Answer

The index name is misspelled.

Answer

The `timechart` command should not have `by source`.

Answer

The chart type is line chart by default.

Question 8

A report is scheduled to run every 5 minutes. After running, it sends an email if the count of errors exceeds 10. Which report action should be configured?

Accepted Answer

Scheduled report with email action and condition. The requirement is for a scheduled report that runs every 5 minutes and conditionally sends an email only when the count of errors exceeds 10. In Splunk, a scheduled report with an email action and a condition allows you to define a search that runs on a schedule, evaluate a numeric condition (e.g., count > 10), and trigger an email only when that condition is met. This is the exact mechanism for conditional email delivery based on report results.

Answer

Dashboard panel

Answer

Alert

Answer

Real-time search

Question 9

Which two of the following are valid ways to create a report in Splunk? (Choose two.)

Accepted Answer

Save a search as a report. Option C is correct because in Splunk Web you can run a search in the Search & Reporting app and then use Save As > Report to persist that search as a report, which can later be scheduled, shared, and added to dashboards. Option E is correct because the Report Builder (accessible via Settings > Searches, reports, and alerts or through the Pivot/visualization workflow) provides a guided interface for defining a report's search, time range, and visualization without hand-writing SPL. Option A is not a valid creation method: a dashboard panel is a visualization within a dashboard, and while you can save a panel's search as a report, you cannot directly 'convert' the panel itself into a report object. Option B is incorrect because scheduling an alert creates an alert, not a report, even though alerts and reports share the saved-search infrastructure. Option D is incorrect because importing an external CSV creates a lookup or indexed data, not a report; reports are built from searches over indexed data.

Answer

Convert a dashboard panel to a report

Answer

Schedule an alert

Answer

Import an external CSV as a report

Question 10

Which two of the following are actions that can be performed on a report after it is created? (Choose two.)

Accepted Answer

Embed it in a dashboard. Option C is correct because a saved report can be added as a panel to a dashboard, allowing its visualization to be displayed alongside other panels for monitoring. Option E is correct because reports can be scheduled to run automatically at defined intervals (for example, via a cron-style schedule) and deliver results by email or other output. The remaining options do not belong: a report's underlying search query is fixed at creation time and cannot be modified afterward (A), reports are saved objects rather than index data, so they cannot be deleted from the index (B), and converting a report into an alert is not a supported post-creation action (D).

Answer

Modify its search query

Answer

Delete it from the index

Answer

Convert it to an alert

Question 11

Refer to the exhibit. Which visualization is most appropriate for this data?

Accepted Answer

Pie chart. A pie chart is the most appropriate visualization for this data because it shows a breakdown of a whole into its constituent parts, specifically the percentage of total events by source type. Pie charts are ideal for displaying proportional or categorical data where the sum of all slices equals 100%, making it easy to compare the relative size of each category at a glance.

Answer

Single value

Answer

Scatter chart

Answer

Line chart

Question 12

Refer to the exhibit. The chart shows five series. What is the effect of the useother=f argument?

Accepted Answer

It limits the chart to exactly 5 series without an 'Other' category. The `useother=f` argument in a timechart command explicitly disables the automatic grouping of the least significant series into an 'Other' category. By default, timechart limits the number of distinct series displayed (often to 10) and aggregates the rest as 'Other'; setting `useother=f` forces the chart to show exactly the top 5 series as separate lines, with no aggregation. This matches option D, which states the chart is limited to exactly 5 series without an 'Other' category.

Answer

It groups status codes beyond the top 5 into 'Other'

Answer

It includes all status codes as separate series

Answer

It sets the timechart to use default colors

Question 13

Refer to the exhibit. The dashboard panel shows a column chart of bytes by protocol for the last 24 hours. However, the chart shows only one column. What is the most likely cause?

Accepted Answer

The search returns only one result row. A column chart in Splunk displays one column per distinct value of the x-axis field. If the search returns only one result row (e.g., a single protocol value such as 'HTTP' with a total byte count), the chart will render a single column. This typically occurs when the search uses a stats or timechart command that groups by a field with only one unique value, or when a filter like `protocol=*` inadvertently matches only one protocol.

Answer

The chart type cannot display multiple columns

Answer

The protocol field is not extracted

Answer

The time range is not wide enough

Question 14

When creating a dashboard panel that displays a line chart of CPU usage over time, which visualization option should be used to show multiple series (each CPU core) with different colors?

Accepted Answer

Overlay. The 'Overlay' visualization option in Splunk allows you to display multiple data series (e.g., each CPU core) as separate lines on the same chart, each with a distinct color. This is essential for comparing CPU usage across cores over time without merging or stacking the values, which would obscure individual core behavior.

Answer

Line mode

Answer

Stacking

Answer

Markers

Question 15

A dashboard includes a table panel that shows recent errors. The analyst wants users to click on an error message and be taken to a search showing all events containing that error message within the same time range. Which configuration should be applied to the table panel?

Accepted Answer

Set 'Drilldown' to 'Link to search' and configure the target search with a token for the error message.. Setting 'Drilldown' to 'Link to search' allows you to configure a target search URL that includes a token for the clicked error message. When a user clicks a cell in the table, the token (e.g., `$click.value$`) is replaced with the actual value from that cell, and Splunk opens a new search using the same time range as the original dashboard, fulfilling the requirement exactly.

Answer

Add a token on the table panel and set the drilldown to 'Token' with value '$row.error_message$'.

Answer

Set 'Drilldown' to 'Custom' and use JavaScript to open a new window.

Answer

Set 'Drilldown' to 'Search', and in the search string include 'error_message="$click.value$"'