SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 7 — 15 Questions

Question 1

Which TWO actions are valid for modifying the appearance of a column chart in a dashboard panel? (Choose two.)

Accepted Answer

Specify a sort order for the x-axis categories.. In a column chart, you can specify a sort order for the x-axis categories using the 'Sorting' options in the formatting panel. This allows you to control the sequence of categories displayed, such as sorting by alphabetical order or by a numeric field value. Option E is correct because the 'Colors' section in the formatting options lets you change the color palette for the chart, modifying the appearance of the columns.

Answer

Set the chart to use a radial display to make it a pie chart.

Answer

Swap the chart type to a horizontal bar chart using the 'Chart' dropdown.

Answer

Adjust marker size to make bars thicker.

Question 2

Which THREE of the following are valid considerations when scheduling a report for PDF delivery via email? (Choose three.)

Accepted Answer

The report can be sent as a PDF attachment or as a link to the report in Splunk.. When scheduling a report for PDF delivery via email, Splunk allows you to choose between sending the report as a PDF attachment or as a link to the report within Splunk. This is a configurable option in the schedule's email settings, providing flexibility for recipients who may prefer direct access to the live report in Splunk versus a static PDF file.

Answer

The report can include HTML-embedded CSV data directly in the email body.

Answer

The email server must be configured to allow inbound SMTP from Splunk.

Question 3

Which TWO options are valid when adding a panel to a dashboard from an existing report? (Choose two.)

Accepted Answer

The panel can be added as a table, chart, or single value based on the report's results.. When you add a panel from an existing report to a dashboard, Splunk allows you to choose the visualization type (table, chart, or single value) based on the report's results. This flexibility lets you reuse the report's data while customizing how it is displayed on the dashboard.

Answer

The panel can only be added to the same app where the report was created.

Answer

The report is added as a link to the dashboard.

Answer

The report's scheduled run time is inherited by the dashboard.

Question 4

A security analyst creates a dashboard to monitor failed login attempts over the past 24 hours. Which visualization type is most appropriate for showing the trend of failed logins over time?

Accepted Answer

Line chart. A line chart is the most appropriate visualization for showing the trend of failed login attempts over time because it plots continuous data points along a time axis, allowing the analyst to easily identify patterns, spikes, or declines in the event count. In Splunk, a timechart command (e.g., `timechart count by action`) generates data that is best rendered as a line chart to display the temporal progression of failed logins over the past 24 hours.

Answer

Single value

Answer

Pie chart

Answer

Scatter plot

Question 5

A user wants to create a dashboard panel that shows the top 5 most visited web pages. Which report type should be used as the underlying search?

Accepted Answer

top 5 page. The 'top' command in Splunk automatically returns the most common values of a field, and the syntax 'top 5 page' directly limits the result to the top 5 pages by count. This is the most straightforward and efficient way to generate a dashboard panel showing the top 5 most visited web pages, as it combines counting and sorting into a single command.

Answer

stats count by page

Answer

rare 5 page

Answer

chart count by page

Question 6

An IT administrator has a dashboard with multiple panels that all use the same base search but with different post-processing filters. The dashboard is slow to load. Which optimization technique is most effective?

Accepted Answer

Implement a base search and use post-process searches. Using a base search with post-processing filters allows the dashboard to run the expensive base search once and then apply lightweight filter transformations on each panel. This avoids redundant data retrieval and processing, significantly reducing load time compared to running separate searches per panel.

Answer

Remove data model acceleration from the underlying data

Answer

Enable report acceleration on each panel

Answer

Duplicate the base search in each panel

Question 7

A dashboard panel using a bar chart shows a large number of values on the x-axis, making the chart unreadable. Which dashboard option should be used to limit the number of bars shown?

Accepted Answer

Limit in the chart options. The 'Limit' option in the chart configuration allows you to specify the maximum number of data points (bars) displayed on the x-axis. By setting a limit, you reduce the number of bars shown, preventing overcrowding and making the chart readable. This is a direct control over the cardinality of the x-axis values in Splunk's visualization settings.

Answer

Overlay in the chart options

Answer

Color by field in the chart options

Answer

Stack mode in the chart options

Question 8

A dashboard designer adds a radio button input to filter by department. When a user selects a department, the panel does not update. What is the most likely cause?

Accepted Answer

The search string does not include a token referencing the input. A radio button input in Splunk dashboards generates a token when selected, but the search string must explicitly reference that token using the $token_name$ syntax. Without this token reference in the search, the panel will not re-run with the selected department value, so the dashboard appears unresponsive.

Answer

The radio button input is not configured with a default value

Answer

The token name in the search does not match the input's token name

Answer

The input's label field is empty

Question 9

A SOC manager creates a dashboard with multiple time-range pickers (one global, one per panel). The global picker is set to 'Last 7 days' but one panel uses its own picker set to 'Last 24 hours'. When the dashboard loads, which time range will the panel use?

Accepted Answer

The panel's own picker setting of 'Last 24 hours'. In Splunk dashboards, when a panel has its own time-range picker configured, it overrides the global time-range picker for that specific panel. The panel will use its own picker setting of 'Last 24 hours' regardless of the global setting of 'Last 7 days'. This behavior ensures that individual panels can display data for different time ranges as needed.

Answer

The dashboard default of 'Last 24 hours'

Answer

A combination of both: the last 7 days but limited to 24 hours

Answer

The global picker setting of 'Last 7 days'

Question 10

A dashboard uses a drilldown on a table to navigate to another dashboard. After migration to a different Splunk instance, the drilldown links are broken. What is the best practice to avoid this issue?

Accepted Answer

Use relative paths like /app/search/dashboard_name. Using relative paths (e.g., `/app/search/dashboard_name`) ensures that the drilldown link remains valid after migration to a different Splunk instance. Absolute URLs with the full server name (Option C) break when the hostname or port changes, while token variables like `$host$` (Option A) are not resolved in drilldown links. URL-encoding the dashboard name (Option B) is unnecessary because Splunk dashboard names are already URL-safe and encoding does not address the root cause of broken links.

Answer

Use token variables like $host$ in the link

Answer

URL-encode the dashboard name

Answer

Use absolute URLs with the full server name

Question 11

A power user creates a dashboard with a panel that uses a search returning 10,000 events. The dashboard should display a single value representing the count of unique users. Which search approach is most efficient?

Accepted Answer

Search index=main | stats dc(user) as unique_users. The most efficient because it uses the `stats dc(user)` command directly, which calculates the distinct count of the `user` field in a single pass over the data. This avoids unnecessary data movement or intermediate processing, making it optimal for a dashboard panel that needs to display a single value from 10,000 events.

Answer

Search index=main | eval user=lower(user) | stats dc(user)

Answer

Search index=main | fields user | dedup user | stats count

Answer

Search index=main | table user | stats dc(user)

Question 12

A user creates a report that summarizes error codes by frequency. They want to share it with the team so others can view but not edit. Which permission should the user set on the report?

Accepted Answer

The 'read' permission for the team. The 'read' permission (Option D) is correct because it grants view-only access to the report, allowing team members to see the summarized error codes without the ability to modify or delete the report. In Splunk, permissions are managed via roles and object-level access control, where 'read' enables viewing but not editing, which aligns with the user's requirement to share the report for viewing only.

Answer

The 'edit' permission for the team

Answer

The 'share' permission for the team

Answer

The 'write' permission for the team

Question 13

Which TWO options are valid ways to add a visualization to a dashboard using Splunk Web? (Choose two.)

Accepted Answer

Clone an existing panel and modify its search. Cloning an existing panel in Splunk Web allows you to duplicate a panel along with its search, then modify the search to create a new visualization without starting from scratch. This is a standard workflow for reusing dashboard configurations efficiently.

Answer

Upload a CSV file directly as a new panel

Answer

Paste a URL of an external chart

Answer

Drag a visualization from the search results page onto the dashboard

Question 14

Which THREE elements are required to create a dashboard in Splunk Web? (Choose three.)

Accepted Answer

At least one panel. A dashboard in Splunk Web must contain at least one panel to display data. Panels are the fundamental building blocks of a dashboard; without them, there is no content to visualize. A dashboard with zero panels is invalid and cannot be saved or rendered.

Answer

A time range picker

Answer

A scheduled report in at least one panel

Question 15

A dashboard panel uses a search that returns time-series data. Which TWO chart options are available in the 'Format' tab of the chart editor to modify the appearance of a line chart? (Choose two.)

Accepted Answer

Connect missing data. The 'Connect missing data' setting in the Format tab of the chart editor allows you to bridge gaps in time-series data by drawing a line across null or missing values. This is useful when your search returns sparse data points and you want a continuous visual line, rather than breaks in the chart.

Answer

Pie area

Answer

Stack mode

Answer

Gauge style