SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 3 — 15 Questions

Question 1

Which of the following are true about creating and managing dashboards in Splunk? (Choose all that apply. There are four correct answers.)

Accepted Answer

When editing a dashboard, you can set permissions to control which users can view or edit it.. The four correct statements are: (1) A dashboard can include panels based on reports, inline searches, or both; (2) A dashboard panel can display data using visualizations such as charts, tables, and maps; (3) A dashboard can be created from scratch using the Dashboard Editor without any existing search; (4) When editing a dashboard, you can set permissions to control which users can view or edit it. These are all documented features of Splunk dashboards. The two incorrect statements are false: dashboards do NOT require a saved report (they can use inline searches), and there is no fixed limit of five panels per dashboard.

Answer

Dashboards can only contain up to five panels per dashboard.

Answer

All dashboards must be based on a saved report before they can be created.

Question 2

Drag and drop the steps to configure a Splunk alert that sends an email when a specific condition is met into the correct order.

Accepted Answer

Run a search that returns the condition you want to alert on, then save the search as an alert, then define the trigger condition, then add the email action.. Alerts are created from a search, with conditions and actions defined in the alert configuration.

Answer

Save the search as an alert, then run the search, then add the email action, then define the trigger condition.

Answer

Define the trigger condition, then add the email action, then run the search, then save the search as an alert.

Answer

Run a search, then define the trigger condition, then add the email action, then save the search as an alert.

Question 3

Drag and drop the steps to troubleshoot a Splunk search that returns no results into the correct order.

Accepted Answer

Step 1: Check the time range; Step 2: Check the search syntax; Step 3: Verify that data is being indexed; Step 4: Check internal Splunk logs (e.g., _internal).. Troubleshooting no results involves checking time range, syntax, data existence, and logs.

Answer

Step 1: Check the search syntax; Step 2: Check the time range; Step 3: Verify that data is being indexed; Step 4: Check internal Splunk logs.

Answer

Step 1: Check internal Splunk logs; Step 2: Verify that data is being indexed; Step 3: Check the search syntax; Step 4: Check the time range.

Answer

Step 1: Verify that data is being indexed; Step 2: Check the time range; Step 3: Check the search syntax; Step 4: Check internal Splunk logs.

Question 4

Match each Splunk component to its purpose.

Accepted Answer

Indexer: Processes incoming data and creates indexes.. These are key components in a Splunk deployment. Matching them correctly is essential for understanding data flow and management.

Answer

Indexer: Provides the search interface and distributes queries.

Answer

Forwarder: Manages configuration updates for Splunk components.

Question 5

Match each lookup type to its definition.

Accepted Answer

CSV lookup: Looks up data from a static CSV file. CSV lookups use static CSV files, while KV Store lookups use key-value store collections. The other options misassign definitions from external or geospatial lookups.

Answer

External lookup: Looks up data from a static CSV file

Answer

CSV lookup: Looks up data from a KV Store collection

Answer

Geospatial lookup: Looks up data using an external script or command

Question 6

A security analyst wants to create a report that shows the count of failed login attempts per user over the last 24 hours, but only for users with more than 5 failures. Which Splunk command sequence should be used?

Accepted Answer

index=main action=failure | stats count by user | where count > 5. It first filters events to only failed login attempts using `index=main action=failure`, then uses `stats count by user` to count failures per user, and finally applies `where count > 5` to keep only users with more than 5 failures. This sequence ensures the count is calculated only on the relevant subset of events and the filter is applied after aggregation.

Answer

index=main action=failure | top limit=5 user

Answer

index=main | stats count by user | where count > 5

Answer

index=main action=failure | stats count by user | search count > 5

Question 7

A team wants to add an interactive time range picker to a dashboard. The dashboard uses a base search with a token for earliest and latest. Which configuration is required?

Accepted Answer

Add input type='time' token='time_tok' and use $time_tok$ in the search. The `input type='time'` element is the standard way to add an interactive time range picker in Splunk dashboards. By setting the `token` attribute to `time_tok` and referencing `$time_tok$` in the base search, the dashboard dynamically passes the selected time range to the search, overriding any static earliest/latest values.

Answer

Set the search's earliest and latest to -1h and now

Answer

Use the built-in time range picker by adding <option> elements

Answer

Add input type='dropdown' token='time' and use $time$ in the search

Question 8

A report is scheduled to run every hour but sometimes returns incomplete data because the search is too slow and times out. Which action should be taken to improve reliability without losing data?

Accepted Answer

Use a summary index to pre-aggregate data. A summary index pre-aggregates data at search time, storing the results in a separate index. When the report runs, it queries the summary index instead of the raw data, which is much faster and avoids timeouts. This ensures all data is captured because the summary is built incrementally from the full data set, not by sampling or truncating.

Answer

Add the 'lazy' command to defer computation

Answer

Reduce the time range to the last 30 minutes

Answer

Increase the search auto-finalization time

Question 9

A developer wants to display server CPU usage that updates every second on a dashboard. Which panel configuration is appropriate?

Accepted Answer

Add a chart panel with time range set to 'Real-time' and refresh set to 'Real-time'. A chart panel with time range set to 'Real-time' and refresh set to 'Real-time' provides a continuously updating line chart of CPU usage over time, updating every second. Option B (statistics table) is less visual for time-series data. Option C has a fixed time range of -1 minute, so it does not show real-time updates. Option D (single value panel) shows only a single number, not a time series.

Answer

Add a statistics table with real-time search

Answer

Add a chart panel with refresh set to 1 second and time range -1m

Answer

Add a single value panel with refresh set to 1s

Question 10

A user created a dashboard panel with a search that uses a token. The token is not being applied when the user modifies the dropdown. What is the most likely cause?

Accepted Answer

The token name in the search does not match the token in the input. For a token to dynamically filter search results in a Splunk dashboard, the token name referenced in the search string (e.g., `$token_name$`) must exactly match the token name defined in the input's `token` attribute. If these names differ, the search will not receive the selected value, and the token will appear unapplied.

Answer

The input has a default value that overrides user selections

Answer

The dashboard is set to 'disabled' mode

Answer

The panel is set to 'static'

Question 11

A compliance report must show the average latency per service for each hour over the past 30 days. The data set contains millions of events. To ensure the report finishes within a reasonable time, which approach is recommended?

Accepted Answer

Use the tstats command over a data model. The tstats command is optimized for use with data models and runs on indexed fields in the tsidx files, making it far faster than stats or timechart on raw events for large datasets. By pre-defining a data model with the latency field and using tstats, you avoid scanning millions of raw events and instead query pre-aggregated statistics, ensuring the report completes within a reasonable time.

Answer

Use timechart span=1h avg(latency) by service

Answer

Use stats avg(latency) by service, _time span=1h

Answer

Pre-process data using a summary index that runs hourly

Question 12

A user wants to add a drilldown to a dashboard panel so that clicking a value opens a related search in a new tab. Which Simple XML attribute is used?

Accepted Answer

drilldown. In Simple XML, the `drilldown` attribute is used to enable or disable click interactions on dashboard panels. When set to `drilldown`, clicking a value triggers a drilldown action, which by default opens a related search in the same tab. To open the search in a new tab, you must combine `drilldown` with the `target` attribute set to `_blank`. The `drilldown` attribute itself is the correct answer because it is the primary attribute that enables the drilldown behavior.

Answer

link

Answer

target

Answer

href

Question 13

A dashboard uses a base search and a post-process search that modifies the fields. When the base search returns no results, the panel shows an error. How can this be handled?

Accepted Answer

Use the depends attribute on the panel and set a token in the base search when results exist. The `depends` attribute on a panel allows you to conditionally show or hide the panel based on whether a token is set. By setting a token (e.g., `results_exist`) in the base search only when results are returned, the panel will be hidden when the base search returns no results, preventing the error. This is the standard Splunk approach to handle empty base search results in post-process searches.

Answer

Use the default attribute on the post-process search to provide fallback results

Answer

Reset the base search to return at least one result

Answer

Set the panel refresh to a higher interval

Question 14

A visualization is showing unexpected spikes in a timechart. The data is aggregated by hour, but the spikes align with time zone changes. What is the likely cause?

Accepted Answer

The data contains events with different time zones. The unexpected spikes in the timechart are caused by events being timestamped with different time zones. When Splunk aggregates data by hour using `_time`, it converts all timestamps to the search head's local time zone. Events originally logged in different time zones (e.g., UTC vs. EST) will be shifted into different hour buckets, creating artificial spikes at the boundaries of time zone changes (e.g., daylight saving time transitions). This is a classic time zone misalignment issue in time-series analysis.

Answer

The timechart uses a gap threshold

Answer

The search uses _time instead of _indextime

Answer

The bin span is too small

Question 15

Which TWO options are valid methods to add a visualization to a dashboard?

Accepted Answer

Save a search as a dashboard panel. Saving a search as a dashboard panel directly creates a visualization on a dashboard. When you run a search that produces a chart or table, the 'Save As' menu includes an option to save it as a dashboard panel, which automatically adds the visualization to an existing or new dashboard.

Answer

Drag a chart from the search page

Answer

Append the chart command to the search

Answer

Use the export to PDF feature