SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 5 — 15 Questions

Question 1

A security analyst creates a dashboard with multiple timechart panels. To ensure the dashboard performs well with large datasets, which THREE practices should be followed? (Select three.)

Accepted Answer

Use the `fields` command to remove unnecessary fields early. The `fields` command removes unnecessary fields from events early in the search pipeline, reducing the amount of data that must be processed and stored in memory. This is especially important in dashboard timechart panels where large datasets can cause slow rendering and timeout issues.

Answer

Use `| eval` to create calculated fields after aggregation

Answer

Use `eventstats` instead of `stats` when possible

Question 2

A user wants to save a search as a report that can be used in a dashboard. Which TWO steps are required? (Select two.)

Accepted Answer

Run the search and click 'Save As' > 'Report'. The first required step to save a search as a report is to run the search and then select 'Save As' > 'Report' from the Splunk UI. This action opens the Save As Report dialog, which is the standard method for converting an ad-hoc search into a persistent report object that can be used in dashboards.

Answer

Schedule the report for email delivery

Answer

Set a time range in the search

Answer

Add the report to a dashboard panel

Question 3

Refer to the exhibit. The dashboard panel is not displaying data when the input changes. What is the most likely cause?

Accepted Answer

The token name in the search is "$token$" but the input token is "source".. The most likely cause is a token name mismatch. The search uses $token$ but the input defines the token as 'source'. For the dashboard to update when the input changes, the token names in the search and the input must match exactly. Therefore, option D is correct. Option A is incorrect because searchWhenChanged='true' enables automatic search on input change, not prevents loading. Option B is incorrect because timechart uses _time by default and does not require an explicit time field. Option C is incorrect because a chart type is not required; it defaults to a column chart.

Answer

The input uses `searchWhenChanged="true"` which prevents dashboard loading.

Answer

The search uses `timechart` which requires a time field.

Answer

The chart type is not specified.

Question 4

Refer to the exhibit. Which visualization would be most appropriate for this data?

Accepted Answer

Bar chart. A bar chart is the most appropriate visualization for this data because the exhibit shows categorical data (e.g., sourcetypes, hosts, or error codes) with a single numeric value (count or sum). Bar charts excel at comparing discrete categories, and Splunk's default behavior for a `stats count by field` command is to render a bar chart in the visualization tab, making it the natural choice for this structured output.

Answer

Line chart

Answer

Pie chart

Answer

Single value

Question 5

Refer to the exhibit. The user wants to display the count over time for each source. However, the chart shows only one line labeled 'MyCount'. What is the problem?

Accepted Answer

The `rename` command after `timechart` renames incorrectly; `timechart count by source` creates multiple fields, and `rename count as "MyCount"` does not rename them.. `timechart count by source` generates separate fields for each source value (e.g., `count: source1`, `count: source2`), not a single field named `count`. The subsequent `rename count as "MyCount"` fails to match any existing field, so the chart displays only one line labeled `MyCount` (which is actually a null or default aggregation). To rename all source-specific count fields, you must use a wildcard or rename each field individually.

Answer

The index name is misspelled.

Answer

The `timechart` command should not have `by source`.

Answer

The chart type is line chart by default.

Question 6

A security team wants to monitor the count of failed login attempts over the past week. They need a simple at-a-glance number. Which visualization type should they use?

Accepted Answer

Single Value. A Single Value visualization is the correct choice because it displays a single, aggregated number prominently, making it ideal for an at-a-glance metric like the count of failed login attempts over the past week. In Splunk, you can use a stats or timechart command to calculate the total count and then render it as a Single Value, which shows just the number without any trend or distribution detail.

Answer

Line chart

Answer

Bar chart

Answer

Pie chart

Question 7

An administrator needs to share a report with executives who prefer to see data in a tabular format with sorting capabilities. Which reporting method is best?

Accepted Answer

Table. A Table visualization in Splunk provides a tabular format with built-in sorting capabilities (clickable column headers), which directly meets the executives' requirement for viewing data in a structured, sortable table. Unlike other visualizations, the Table report type preserves raw event data in rows and columns, allowing users to reorder results by any field without additional configuration.

Answer

Dashboard panel

Answer

Gauges

Answer

Pie chart

Question 8

A user created a report that runs every hour. They notice the report's results include data from the previous hour only, but they want data from the last 24 hours. What should they change in the search?

Accepted Answer

Change the time range to Last 24 hours. The report's search is currently using a relative time range (e.g., Last hour) that limits results to the previous hour. Changing the time range to 'Last 24 hours' expands the search window to include all events from the past 24 hours, ensuring the report returns the desired data. The scheduling frequency controls when the search runs, not the span of data it retrieves.

Answer

Increase the report scheduling frequency

Answer

Add | timechart span=1h

Answer

Use | stats count by date_hour

Question 9

An analyst needs to see the top 5 error codes by count. Which visualization is most appropriate?

Accepted Answer

Bar chart. A bar chart is the most appropriate visualization for comparing the count of distinct error codes because it allows easy comparison of categorical data (error codes) against a numeric value (count). In Splunk, the `top` command or `stats count by error_code` produces results that are best visualized with a bar chart to show the relative frequency of each error code, and the chart can be limited to the top 5 by setting the limit in the search or chart properties.

Answer

Pie chart

Answer

Line chart

Answer

Single Value

Question 10

A dashboard includes a form input that allows users to select a user. After selecting a user, a panel should show that user's activity. Which dashboard feature is required?

Accepted Answer

Tokens. Tokens store the selected value and pass it to search queries, enabling dynamic panel updates.

Answer

Post-process searches

Answer

Drilldown

Answer

Link to report

Question 11

A report is scheduled to run every 5 minutes. After running, it sends an email if the count of errors exceeds 10. Which report action should be configured?

Accepted Answer

Scheduled report with email action and condition. The requirement is for a scheduled report that runs every 5 minutes and conditionally sends an email only when the count of errors exceeds 10. In Splunk, a scheduled report with an email action and a condition allows you to define a search that runs on a schedule, evaluate a numeric condition (e.g., count > 10), and trigger an email only when that condition is met. This is the exact mechanism for conditional email delivery based on report results.

Answer

Dashboard panel

Answer

Alert

Answer

Real-time search

Question 12

A dashboard has multiple panels that each use the same base search but apply different aggregate functions. To avoid running the base search multiple times, which technique should be used?

Accepted Answer

Use a base search with post-process panels. Splunk's post-process search feature allows a dashboard to define a single base search that runs once, and then multiple panels can apply different aggregate functions (e.g., stats, timechart) on the results without re-executing the base search. This is achieved by using the `base` and `postprocess` attributes in the dashboard XML or Simple XML, which significantly reduces search overhead and improves dashboard performance.

Answer

Use | savedsearch to reference the base search

Answer

Use | multisearch to combine all aggregations

Answer

Use | map to run the base search for each panel

Question 13

An organization has a large dataset and wants to create a daily report of top 10 error messages. The search takes a long time to run. Which optimization approach reduces run time while maintaining accuracy?

Accepted Answer

Use summary indexing to pre-aggregate. Summary indexing pre-aggregates data at search time and stores the results in a summary index. The daily report can then run against this pre-computed summary rather than scanning the entire raw dataset, drastically reducing run time while preserving accuracy because the aggregation is done once.

Answer

Use | rare instead of | top

Answer

Use | head 10 early in the search

Answer

Increase the time range

Question 14

In a dashboard, a user wants to click on a bar in a chart and navigate to another dashboard with relevant data for that bar. Which feature should they configure?

Accepted Answer

Drilldown. Drilldown is the correct feature because it allows a user to click on a data point (e.g., a bar in a chart) and navigate to another dashboard, passing the relevant field values as tokens to filter the target dashboard's data. This is a built-in capability in Splunk dashboards, configurable via the 'Drilldown' editor or XML attributes like `drilldown` on chart elements.

Answer

Link to search

Answer

Custom URL

Answer

Tokens

Question 15

Which two of the following are valid ways to create a report in Splunk? (Choose two.)

Accepted Answer

Save a search as a report. Splunk allows you to save any search as a report directly from the Search & Reporting app. When you run a search and click 'Save As' > 'Report', Splunk stores the search string, time range, and visualization settings as a reusable report object in the knowledge object store. This is a fundamental method for creating reports in Splunk.

Answer

Convert a dashboard panel to a report

Answer

Schedule an alert

Answer

Import an external CSV as a report