SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. What is the purpose of the where clause in this search?

Accepted Answer

To show only rows for EventCode 4624 in the table. The `where` clause in SPL (Search Processing Language) filters results after the `chart` command has already aggregated and transformed the data into a table. In this search, the `where` clause is applied after `chart count by Action` to display only rows where `EventCode` equals 4624, effectively showing only those specific rows in the final table output.

Answer

To filter events before the chart command

Answer

To count only events with EventCode 4624

Answer

To remove rows where Action is not specified

Question 2

Refer to the exhibit. What will be the output of this search?

Accepted Answer

The five most frequent error codes. The search uses the `top` command, which by default returns the most frequent values of the specified field (`error_code`) in descending order of count, limited to the top 10 results. Since the search explicitly limits the output to 5 with `limit=5`, the result is the five most frequent error codes. This is the standard behavior of the `top` command in Splunk's SPL.

Answer

The five least frequent error codes

Answer

Only error codes that appear more than five times

Answer

All error codes sorted alphabetically

Question 3

A Splunk user creates a dashboard with a single-value panel that shows the total number of errors in the last 24 hours. The user wants the panel to change color to red when the count exceeds 100 and green otherwise. What should the user configure?

Accepted Answer

Edit the panel's visualization format and set the 'Color' to 'Dynamic' with a threshold at 100.. Single-value panels support dynamic coloring through the visualization format menu. By setting the color mode to 'Dynamic' and defining thresholds, the panel automatically changes color based on the value. This is a built-in feature that requires no custom code.

Answer

Set the panel's 'Color' property in the dashboard editor to 'Dynamic' and define a range for the threshold.

Answer

Modify the search to use the eval command to set a color field, then use the table command to display it.

Answer

Add a CSS style sheet to the dashboard that targets the panel and uses JavaScript to update the color.

Question 4

A Splunk user has a dashboard with a table panel that shows the top 10 source IP addresses by event count. The user wants to be able to click on an IP address in the table and open a new search in a new browser tab that shows all events from that IP. What should the user configure?

Accepted Answer

Enable row drilldown on the table panel and set the drilldown action to 'Search in new window' with the token $row.SourceIP$.. Table panels have built-in drilldown capabilities. Enabling row drilldown and configuring it to open a search in a new window with the token $row.SourceIP$ allows users to click an IP and see all related events in a new tab. This uses standard dashboard features without custom code.

Answer

Set the panel's 'Drilldown' to 'None' and instead use a single value panel with a link to a search.

Answer

Add a element to the dashboard XML with a to a search URL that includes the token $click.value$.

Answer

Use the 'Format' menu on the table panel to add a clickable link to each IP address using the eval and link commands.

Question 5

A SOC manager wants a dashboard panel that lists the top 10 source IPs by event count, but the panel must refresh automatically every 5 minutes without user interaction. The underlying search is already saved as a report named "Top Source IPs." Which approach should be used to meet these requirements in Splunk Web?

Accepted Answer

Add the saved report to the dashboard and set the panel's refresh interval to 5 minutes.. The requirement is an auto-refreshing dashboard panel that re-runs a saved search every 5 minutes. Adding the saved report as a panel and setting a refresh interval achieves this directly in Splunk Web without manual XML editing or email delivery. The other options either change the search type, deliver results outside the dashboard, or unnecessarily duplicate the search logic.

Answer

Edit the dashboard XML to include a <refresh> tag with a 5-minute interval and embed the search inline.

Answer

Create a real-time search panel and set the time range to "All time."

Answer

Schedule the report to run every 5 minutes and email the results to the SOC manager.

Question 6

A NOC analyst maintains a classic Splunk dashboard whose panels read from saved searches. The analyst wants the panels to begin refreshing automatically every five minutes without any user interaction, while keeping the existing search definitions unchanged. Where should this be configured?

Accepted Answer

In the saved search definition, by enabling a schedule and setting the cron interval to every five minutes. Panels built on saved searches refresh according to that saved search's schedule. Configuring the saved search to run every five minutes produces fresh cached results that the panels display, meeting the unattended refresh requirement without editing the search logic itself. Visualization formatting and server-level retention settings do not trigger re-execution of the search, so they cannot deliver recurring automatic updates.

Answer

In Settings > Server settings, by lowering the search job retention period to five minutes

Answer

In each panel's visualization Format menu, by enabling the Streaming option

Answer

In the dashboard's Edit > Refresh interval setting, applied as an auto-refresh to the dashboard

Question 7

A Splunk administrator is building a dashboard that must allow users to filter results by selecting a specific index and a specific sourcetype before the panels run. The dashboard should use tokens to pass these selections to the panel searches. Which two form inputs should be used to meet this requirement? (Choose two.)

Accepted Answer

Checkbox. Dropdowns and checkboxes are both form inputs that can be populated dynamically with search results and can assign selected values to tokens. These tokens can then be used in panel searches to filter by index and sourcetype. Checkboxes can be configured for single selection, making them suitable for this use case. Text boxes, radio buttons, and time range pickers do not provide the same combination of dynamic population and single-select filtering for index and sourcetype.

Answer

Time range picker

Answer

Radio button

Answer

Text box

Question 8

A Splunk administrator is building a classic dashboard and wants to add a new panel based on an existing saved search without retyping the search string. Which two methods allow the administrator to add that saved search as a dashboard panel? (Choose two.)

Accepted Answer

Run the saved search in Search & Reporting, then select Save As > New Dashboard and add it as a panel.. Splunk Web provides two native paths to place a saved search on a dashboard: the Add Panel workflow during dashboard editing, which lists existing reports, and the Save As > New Dashboard option after running the search. Both reference the saved search rather than duplicating its SPL, keeping the panel maintainable.

Answer

Edit the dashboard XML and paste the saved search's SPL directly into the panel's <query> element.

Answer

Use the Settings > Searches, reports, and alerts page and click Move to Dashboard on the saved search.

Answer

Install the Saved Search Dashboard app from Splunkbase and enable its automatic panel sync feature.

Question 9

An analyst creates a dashboard with a single value panel that shows the total count of errors in the last 24 hours. The panel uses a search that returns a single number. The analyst wants the panel to display a green checkmark if the count is below 100, a yellow warning if between 100 and 500, and a red critical if above 500. Which configuration should be applied to achieve this?

Accepted Answer

Set the panel's color palette to "Traffic Light" and define thresholds in the visualization settings.. The single value visualization in Splunk includes built-in threshold settings that allow you to define color ranges and icons. By configuring thresholds, the panel can display a green checkmark below 100, a yellow warning between 100 and 500, and a red critical above 500. This is the standard way to achieve conditional formatting for a single metric. Other visualization types or multiple panels do not provide the same integrated threshold icon behavior.

Answer

Add a conditional expression to the search that returns different values based on the count, and use a table to display icons.

Answer

Use a gauge visualization and set the ranges manually in the gauge's axis settings.

Answer

Create three separate panels, each with a different search for each threshold range, and arrange them side by side.

Question 10

An analyst builds a dashboard with a table panel listing suspicious process names and a separate panel showing related network events. The analyst wants clicking a process name in the table to pass that value into the network panel's search and re-run it. Which feature accomplishes this?

Accepted Answer

Drilldown on the table panel using a token that the network panel's search references, with the receiving panel set to re-run when the token changes. Interactive cross-panel filtering requires drilldown to capture the clicked field into a token, the target panel's search to consume that token, and the target panel to re-run on token change. That combination passes the process name into the network events search and refreshes its results. Merely setting a token, scheduling an email, or overlaying charts does not create the linked, dynamic behavior described.

Answer

A scheduled saved search that emails the process names to the analyst for manual cross-referencing

Answer

Token-based drilldown configured on the table panel with a set token action that references the clicked field

Answer

Chart overlay settings on the table panel that merge the network events into the same visualization

Question 11

An analyst wants to share a dashboard with a colleague who does not have a Splunk account. The dashboard contains sensitive data and should not be publicly accessible. Which method should the analyst use to share the dashboard?

Accepted Answer

Export the dashboard as a PDF and email it to the colleague.. Exporting the dashboard as a PDF allows the analyst to share a static version with a colleague who lacks a Splunk account, without exposing the live dashboard or requiring authentication. This method keeps the sensitive data contained in a file that can be shared securely. Other methods either require a Splunk account, risk public exposure, or involve scheduled emails that may not be suitable for a one-time share.

Answer

Send the dashboard's URL to the colleague and ask them to request access.

Answer

Publish the dashboard to a public URL and provide the link.

Answer

Schedule the dashboard to be emailed to the colleague every day.

Question 12

A security team needs to create a report that shows the number of distinct users who triggered a firewall block each day for the past 30 days. Which search and visualization combination should be used?

Accepted Answer

Use `dc(user)` with `timechart` and a column chart. `dc(user)` calculates the distinct count of users, and `timechart` automatically groups results by time (e.g., per day) over the specified 30-day range. A column chart is the appropriate visualization for displaying discrete daily counts, as it clearly shows trends over time.

Answer

Use `dc(user)` with `chart` and a column chart

Answer

Use `top user` with `timechart` and a pie chart

Answer

Use `count` with `chart` and a bar chart

Question 13

A user wants to create a dashboard panel that refreshes automatically every 60 seconds. Which setting must be configured in the panel's edit mode?

Accepted Answer

Set the Refresh Interval to 60 seconds. The dashboard panel's edit mode includes a 'Refresh Interval' setting that allows you to specify an automatic refresh period in seconds. Setting this to 60 causes the panel to re-run its underlying search and update the visualization every 60 seconds without manual intervention.

Answer

Add | delay 60 to the search

Answer

Schedule the search to run every 60 seconds

Answer

Set the Time Range to Last 60 seconds

Question 14

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 15

Which TWO statements are true about saved reports in Splunk?

Accepted Answer

Saved reports can be used as data sources for dashboard panels.. Option C is correct because a saved report in Splunk is essentially a saved search that can be referenced and added as a panel to a dashboard, allowing the report's results to populate that panel. Option D is correct because saved reports can be scheduled with a cron-style schedule (for example, via Settings > Searches, reports, and alerts or the SPL 'schedule' setting), so the search runs automatically at specified times. Option A is wrong because saving a report does not automatically create an email alert; alerting requires configuring an alert action such as Send email, and scheduling alone does not imply notification. Option B is wrong because saved reports can be created directly from the Search & Reporting app by saving a search, not exclusively from dashboard panels. Option E is wrong because saved reports remain editable after creation, including changes to the search, time range, schedule, and permissions.

Answer

All saved reports automatically send email alerts.

Answer

Saved reports are created exclusively from dashboard panels.

Answer

Saved reports cannot be edited after creation.