SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 5 — 15 Questions

Question 1

A large organization's security team has a dashboard that displays the top 10 source IPs by number of failed login attempts. The dashboard uses a search: index=security sourcetype=login action=failure | top limit=10 src_ip. Lately, the dashboard shows incorrect data (e.g., IPs that are not actually top). However, when the same search is run in the Search app, it shows correct results. The dashboard is scheduled to refresh every 10 minutes. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The dashboard uses a summary index with stale data. The dashboard is likely configured to use a summary index that is populated by a scheduled search. If the summary index is not updated frequently enough or contains stale data, the dashboard will display incorrect results even though the live search in the Search app returns accurate data. The 10-minute refresh interval does not repopulate the summary index; it only re-queries the already stale summary data.

Answer

The dashboard's time range is different from the manual search

Answer

The dashboard is using a real-time search that causes data inconsistency

Answer

The user has incorrect field permissions

Question 2

A company has a dashboard that uses a base search and four post-process searches to display metrics. The dashboard loads slowly. The base search returns 10,000 results and each post-process search further filters. The infrastructure team suggests using tstats to improve performance. Which approach is best?

Accepted Answer

Accelerate the data model used by the base search and use tstats in the post-process searches. Tstats is optimized to run against accelerated data models, which pre-aggregate statistics and dramatically reduce the time needed to compute metrics. By accelerating the data model used by the base search, the base search itself becomes faster, and using tstats in the post-process searches leverages that acceleration to filter and aggregate results without scanning raw events. This combination addresses the root cause of slow performance—scanning 10,000 raw results in post-process searches—by moving computation to the indexed, pre-summarized data.

Answer

Use the tstats command in each post-process search without changing the base search

Answer

Replace all searches with a single tstats search and use eval in the dashboard

Answer

Use tstats only in the base search and keep the post-process searches as they are

Question 3

A user creates a dashboard with a line chart showing server response times. The chart looks correct in the dashboard editor but when saved and viewed by other users, the chart shows no data. The other users have the same role as the creator. What is the most likely cause?

Accepted Answer

The time range is set to 'Real-time' while the other users access at a different time. When a dashboard chart uses a 'Real-time' time range, it continuously updates to show data from the current moment. If the creator views the dashboard at one time, the chart displays data, but when other users access it later, the real-time window has shifted, and if no data exists for that new window, the chart appears empty. This is a common issue with real-time searches in Splunk dashboards, as they do not retain historical data.

Answer

The other users do not have permission to the index

Answer

The search includes a field that is only visible to the creator

Answer

The dashboard is set to private

Question 4

A Splunk administrator needs to create a dashboard that displays a summary of sales data from multiple regions. Each region's data is in a separate index. The dashboard should allow users to select a region from a dropdown and see the sales data for that region. Which type of dashboard input should be used?

Accepted Answer

A dropdown input that populates from a search returning the list of regions. A dropdown input that populates from a search dynamically retrieves the list of region names from the data, ensuring the dashboard always reflects the actual indices available. This approach is scalable and reduces manual maintenance, as the dropdown options are generated by a Splunk search (e.g., `| eventcount summarize=false index=* | dedup index | table index`), making it ideal for a multi-index scenario where regions may change over time.

Answer

A text input field where users type the region name

Answer

A radio button group with predefined regions

Answer

A checkbox list with multiple regions

Question 5

A user wants to add a panel to an existing dashboard in Splunk. Which TWO of the following methods can be used to achieve this?

Accepted Answer

From a search results page, click 'Save As' and select 'Dashboard Panel'.. After running a search in the Search & Reporting app, you can click 'Save As' and select 'Dashboard Panel' to add the search results as a new panel to an existing dashboard. Option E is correct because when editing a dashboard, the 'Add Panel' button allows you to create a new panel directly within the dashboard editor, choosing from saved searches or creating a new one.

Answer

From the dashboard, click 'Clone Panel' on an existing panel.

Answer

From the dashboard listing, click 'Edit' and then 'Import Panel'.

Answer

From the search app, click 'Add to Dashboard' after running a search.

Question 6

Refer to the exhibit. A user scheduled a report but it never runs. Which of the following is the most likely reason?

Accepted Answer

The cron schedule is invalid because it lacks the weekday field.. The cron schedule in Splunk must include a weekday field (e.g., `?`, `*`, or specific days like `1-5`). If the cron expression omits this field, Splunk treats it as invalid and the scheduled report never runs. Option D correctly identifies this missing weekday field as the root cause.

Answer

The report needs to be shared with the scheduler role.

Answer

The stats command requires a by clause with a time field.

Answer

The search string is missing the 'timechart' command.

Question 7

A large e-commerce company uses Splunk Enterprise to analyze sales data. The marketing team requests a real-time dashboard showing total revenue per product category, updated every 5 seconds. A new Splunk user creates a dashboard panel with the search `index=sales | stats sum(price) by category | sort - sum(price)`. The dashboard works initially, but after 30 minutes, it stops updating and displays the error 'Search failed: too many results'. The user is concerned about the impact on system performance. The data volume is approximately 1 TB per day. Which of the following should the user do to create a reliable dashboard that updates frequently without causing performance issues?

Accepted Answer

Create a scheduled summary search that aggregates sales data by category every 5 minutes, and use the 'loadjob' command in the dashboard to load the summary results.. A scheduled summary search that pre-aggregates sales data by category every 5 minutes and is loaded via the 'loadjob' command is the correct approach because it decouples the expensive aggregation from the dashboard refresh cycle. The dashboard then reads pre-computed results from the summary index, eliminating the repeated full-dataset scans that caused the 'too many results' error. This is the standard Splunk pattern for high-frequency dashboards over large datasets.

Answer

Use the 'streamstats' command to incrementally calculate revenue and limit the time range to the last 5 minutes to reduce the result set.

Answer

Reduce the search to only show the top 5 categories by using 'head 5' and set a 5-second auto-refresh on the dashboard.

Answer

Change the search to use the 'timechart' command with 'span=5s' and set the search to real-time mode.

Question 8

Refer to the exhibit. A user runs this search in Splunk to create a timechart of web server status codes. The resulting chart shows no data for the "error" status. What is the most likely cause?

Accepted Answer

The eval command after timechart does not affect the timechart series; the timechart already split by original status values.. The search redefines the 'status' field after the timechart command, but timechart already uses the original status values to create separate series. The eval command overwrites the field, but the timechart series are already fixed. To fix, the eval should be placed before timechart.

Answer

The 'status' field is not extracted from the sourcetype.

Answer

The stats command after eval removes the status field.

Answer

The web server is not generating any errors.

Question 9

Refer to the exhibit. A Splunk user runs this search against a lookup file containing application error data. The search returns fewer than 10 results. Which is the most likely reason?

Accepted Answer

The search filter 'severity="high"' is too restrictive, resulting in fewer than 10 matching rows.. The search filters for severity='high', which may be a small subset. The head command limits to 10, but if fewer than 10 match, that's all that's returned.

Answer

The inputlookup command only returns the first 10 rows by default.

Answer

The lookup file contains more than 10 rows.

Answer

The table command limits the number of results.

Question 10

Refer to the exhibit. A Splunk admin created this dashboard XML. When viewing the dashboard, the "Response Time" panel shows no data. What is the most likely cause?

Accepted Answer

The 'response_time' field does not exist in the access_combined sourcetype.. The dashboard XML references a field called 'response_time' in the search, but the access_combined sourcetype (commonly used by Splunk for web access logs) does not contain a field named 'response_time'. The access_combined sourcetype typically includes fields like status, bytes, referrer, useragent, etc., but not a dedicated response_time field. Without this field existing in the data, the stats command will return no results, causing the panel to show no data.

Answer

The index 'web' does not contain any events.

Answer

The bar chart cannot display the results.

Answer

The stats command requires a by clause and host is not a valid field.

Question 11

Refer to the exhibit. A user runs this search to get details about a saved search. The results show empty values for the actions types. What is the most likely reason?

Accepted Answer

The spath command cannot parse the multivalue actions field correctly without mvexpand.. The spath command is used incorrectly. The actions field is a multivalue field containing action objects. The spath command expects a single JSON object per event, but actions is a list. To extract action types, you might need to mvexpand first.

Answer

The rest endpoint does not return actions data.

Answer

The search title filter is too restrictive.

Answer

The saved search has no actions configured.

Question 12

Refer to the exhibit. A security analyst runs this search to find top failed actions for admin accounts. The search returns no results, but there are failed actions for admin accounts in the data. What is the most likely cause?

Accepted Answer

The eval command uses match which is case-sensitive; the admin usernames may start with lowercase 'admin'.. The eval command's match() function uses regular expressions that are case-sensitive by default, so a pattern like match(user,"admin.*") will not match usernames such as 'Admin' or 'ADMIN'. If the environment stores admin accounts with a capitalized or lowercase variant, the filter silently drops all events, producing zero results even though failed actions exist. The fix is to use a case-insensitive regex (e.g., (?i)admin) or normalize the field with lower() before matching.

Answer

The windows_security sourcetype does not contain a 'user' field.

Answer

The where clause should use 'search' instead.

Answer

The stats command should be before eval.

Question 13

Refer to the exhibit. A user runs this search in Splunk. What will the resulting table include?

Accepted Answer

A row for each hour and a column for each status code, plus a Total column and a Total row. The search uses the `timechart` command with `count by status`. The `timechart` command produces a table with a row for each time bucket (hour) and a column for each distinct value of the `status` field. However, `timechart` does not automatically add a Total column or Total row. In this search, the `addtotals` command is also applied, which adds the Total column (sum across all statuses per row) and the Total row (sum across all time buckets per column). Therefore, the resulting table includes rows per hour, columns per status code, plus a Total column and a Total row.

Answer

A row for each status code and a column for each hour

Answer

A row for each hour and a column for each status code, with no totals

Answer

Only the sum of all events per hour

Question 14

Refer to the exhibit. Which severity values will appear in the results?

Accepted Answer

Error, Warning, and Info. The eval command assigns severity based on the case function. If error=1, severity='Error'; if warn=1, severity='Warning'; otherwise, severity='Info'. So all three values are possible.

Answer

Only Error and Warning

Answer

Only Info

Answer

Only Error

Question 15

Refer to the exhibit. What does this search accomplish?

Accepted Answer

Finds source IPs that generate more than 5% of total events in each hour. The search uses `timechart` with a `per_hour` span and `count by src_ip` to count events per source IP per hour, then applies `eval` to compute each IP's percentage of total events per hour. The `where` clause filters for percentages greater than 5, so the result shows only source IPs that exceed 5% of total events in any given hour.

Answer

Finds source IPs that generate more than 5% of events across all hours

Answer

Finds hours where a single source IP generates more than 5% of events

Answer

Finds source IPs that generate less than 5% of total events per hour