SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 8 — 15 Questions

Question 1

A junior analyst creates a dashboard to monitor server CPU usage. The dashboard contains a single panel with a line chart showing CPU percentage over the last 24 hours. The analyst then adds a second panel that displays the same data but as a single value showing the average CPU. Both panels use the exact same search string. The dashboard loads slowly, and users complain of wait times. The analyst wants to improve performance without changing the displayed data. Which course of action is best?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the dashboard to use a base search and post-process the panels. Using a base search with post-process searches allows both panels to share a single dataset, reducing redundant search execution. Instead of running the same heavy search twice, the base search runs once, and each panel applies lightweight post-processing (e.g., timechart vs. stats) on the cached results. This directly addresses the slow load time without altering the displayed data.

Answer

Keep both panels but add more resources to the Splunk server

Answer

Remove the single value panel and embed its value in the line chart title

Answer

Enable report acceleration on one of the panels

Question 2

A financial analyst creates a dashboard in Splunk Web to track daily transaction volumes. The dashboard has three panels: a table of top 10 merchants by transaction count, a bar chart of transactions by hour, and a single value showing total transaction amount. All panels use the same base search from the 'transactions' index. The analyst is in the 'finance' role. The dashboard runs fine in the analyst's session, but when the analyst shares the dashboard with the 'auditor' role, the auditor sees no data in any panel. The auditor role has read access to the dashboard and the 'transactions' index. What is the most likely cause?

Accepted Answer

The base search used in the dashboard's panels is a saved search owned by the analyst, and the 'auditor' role does not have permissions to that saved search. The base search is a saved search owned by the analyst. When a dashboard uses a saved search as its base search, Splunk enforces permissions on that saved search object. Even though the auditor role has read access to the 'transactions' index, if the saved search itself is not shared with the auditor role (e.g., it remains private to the analyst), the dashboard panels will fail to retrieve data for the auditor. This is a common permission scoping issue in Splunk where data access is gated by the saved search object, not just the index.

Answer

The 'auditor' role does not have read access to the 'transactions' index

Answer

The dashboard's permission is set to 'private' and only the analyst can view it

Answer

The dashboard is set to run as the 'finance' role, and the 'auditor' role lacks the 'rbac_perm' privilege

Question 3

A large enterprise Splunk environment has a heavy forwarder sending 2 TB of log data per day. An operator builds a dashboard that displays a real-time chart of events per second across all data sources, using the search 'index=* | stats count by sourcetype' with a real-time window of last 10 minutes. The dashboard is extremely slow, often timing out. The operator suspects the search is too broad. Which optimization strategy should be implemented first?

Accepted Answer

Implement a summary index that aggregates events per second by sourcetype every minute, and have the dashboard search the summary index. A summary index pre-aggregates the events-per-second data by sourcetype at a regular interval (e.g., every minute), drastically reducing the data volume the dashboard must scan. Instead of processing 2 TB of raw logs in real time, the dashboard queries a small, precomputed table, eliminating the performance bottleneck caused by the heavy forwarder's high ingestion rate.

Answer

Replace the real-time search with a base search that runs every 10 minutes

Answer

Change the real-time window to a 10-minute historical search and enable report acceleration

Answer

Create a data model for all sourcetypes and use acceleration on the data model

Question 4

A security analyst wants to create a report showing the number of failed login attempts by user over the past 24 hours, updated automatically every hour. Which approach is most efficient?

Accepted Answer

Create a report with a scheduled search that runs every hour and saves to a CSV file. Scheduled reports with a time range run periodically and save results, reducing resource usage. Option A is wrong because real-time searches are continuous and resource-intensive, not suitable for periodic updates. Option C is wrong because dashboard panels run every time the dashboard loads, not on a fixed schedule, and without saving results. Option D is wrong because tstats is used for accelerated data models, not for ad-hoc reporting.

Answer

Create a real-time search in a dashboard

Answer

Create a dashboard panel with a fast search

Answer

Use the tstats command in a dashboard

Question 5

Which TWO actions increase the performance of a dashboard in Splunk? (Choose two.)

Accepted Answer

Use scheduled reports as base searches. Scheduled reports as base searches pre-compute and cache results, reducing the real-time query load on the indexers when the dashboard loads. This shifts expensive computation to off-peak times, improving dashboard rendering speed.

Answer

Add a large number of drilldowns

Answer

Use real-time searches

Answer

Add multiple time range pickers to the dashboard

Question 6

A small business uses Splunk to monitor their web server. They have a dashboard that shows daily page views. After a system update, the dashboard loads very slowly, often timing out. The dashboard uses a search that takes only 2 seconds when run manually. The dashboard has a time range picker set to 'Today'. The update changed some default settings. What is the most likely cause?

Accepted Answer

The time range picker default was reset to 'All Time'. The dashboard was configured with a time range picker set to 'Today', but the system update reset the default to 'All Time'. This causes the search to scan all indexed data, dramatically increasing the data volume and search time, leading to timeouts. A manual search taking 2 seconds on a small time range becomes extremely slow when applied to the entire dataset, which is why the dashboard fails while the manual search still works.

Answer

The index was renamed

Answer

The dashboard now uses real-time search

Answer

The search command changed to 'timechart'

Question 7

A large organization's security team has a dashboard that displays the top 10 source IPs by number of failed login attempts. The dashboard uses a search: index=security sourcetype=login action=failure | top limit=10 src_ip. Lately, the dashboard shows incorrect data (e.g., IPs that are not actually top). However, when the same search is run in the Search app, it shows correct results. The dashboard is scheduled to refresh every 10 minutes. What is the most likely cause?

Accepted Answer

The dashboard uses a summary index with stale data. The dashboard is likely configured to use a summary index that is populated by a scheduled search. If the summary index is not updated frequently enough or contains stale data, the dashboard will display incorrect results even though the live search in the Search app returns accurate data. The 10-minute refresh interval does not repopulate the summary index; it only re-queries the already stale summary data.

Answer

The dashboard's time range is different from the manual search

Answer

The dashboard is using a real-time search that causes data inconsistency

Answer

The user has incorrect field permissions

Question 8

A company has a dashboard that uses a base search and four post-process searches to display metrics. The dashboard loads slowly. The base search returns 10,000 results and each post-process search further filters. The infrastructure team suggests using tstats to improve performance. Which approach is best?

Accepted Answer

Accelerate the data model used by the base search and use tstats in the post-process searches. Tstats is optimized to run against accelerated data models, which pre-aggregate statistics and dramatically reduce the time needed to compute metrics. By accelerating the data model used by the base search, the base search itself becomes faster, and using tstats in the post-process searches leverages that acceleration to filter and aggregate results without scanning raw events. This combination addresses the root cause of slow performance—scanning 10,000 raw results in post-process searches—by moving computation to the indexed, pre-summarized data.

Answer

Use the tstats command in each post-process search without changing the base search

Answer

Replace all searches with a single tstats search and use eval in the dashboard

Answer

Use tstats only in the base search and keep the post-process searches as they are

Question 9

A user creates a dashboard with a line chart showing server response times. The chart looks correct in the dashboard editor but when saved and viewed by other users, the chart shows no data. The other users have the same role as the creator. What is the most likely cause?

Accepted Answer

The time range is set to 'Real-time' while the other users access at a different time. When a dashboard chart uses a 'Real-time' time range, it continuously updates to show data from the current moment. If the creator views the dashboard at one time, the chart displays data, but when other users access it later, the real-time window has shifted, and if no data exists for that new window, the chart appears empty. This is a common issue with real-time searches in Splunk dashboards, as they do not retain historical data.

Answer

The other users do not have permission to the index

Answer

The search includes a field that is only visible to the creator

Answer

The dashboard is set to private

Question 10

A Splunk administrator needs to create a dashboard that displays a summary of sales data from multiple regions. Each region's data is in a separate index. The dashboard should allow users to select a region from a dropdown and see the sales data for that region. Which type of dashboard input should be used?

Accepted Answer

A dropdown input that populates from a search returning the list of regions. A dropdown input that populates from a search dynamically retrieves the list of region names from the data, ensuring the dashboard always reflects the actual indices available. This approach is scalable and reduces manual maintenance, as the dropdown options are generated by a Splunk search (e.g., `| eventcount summarize=false index=* | dedup index | table index`), making it ideal for a multi-index scenario where regions may change over time.

Answer

A text input field where users type the region name

Answer

A radio button group with predefined regions

Answer

A checkbox list with multiple regions

Question 11

A user wants to add a panel to an existing dashboard in Splunk. Which TWO of the following methods can be used to achieve this?

Accepted Answer

From a search results page, click 'Save As' and select 'Dashboard Panel'.. After running a search in the Search & Reporting app, you can click 'Save As' and select 'Dashboard Panel' to add the search results as a new panel to an existing dashboard. Option E is correct because when editing a dashboard, the 'Add Panel' button allows you to create a new panel directly within the dashboard editor, choosing from saved searches or creating a new one.

Answer

From the dashboard, click 'Clone Panel' on an existing panel.

Answer

From the dashboard listing, click 'Edit' and then 'Import Panel'.

Answer

From the search app, click 'Add to Dashboard' after running a search.

Question 12

Refer to the exhibit. A user scheduled a report but it never runs. Which of the following is the most likely reason?

Accepted Answer

The cron schedule is invalid because it lacks the weekday field.. The cron schedule in Splunk must include a weekday field (e.g., `?`, `*`, or specific days like `1-5`). If the cron expression omits this field, Splunk treats it as invalid and the scheduled report never runs. Option D correctly identifies this missing weekday field as the root cause.

Answer

The report needs to be shared with the scheduler role.

Answer

The stats command requires a by clause with a time field.

Answer

The search string is missing the 'timechart' command.

Question 13

A large e-commerce company uses Splunk Enterprise to analyze sales data. The marketing team requests a real-time dashboard showing total revenue per product category, updated every 5 seconds. A new Splunk user creates a dashboard panel with the search `index=sales | stats sum(price) by category | sort - sum(price)`. The dashboard works initially, but after 30 minutes, it stops updating and displays the error 'Search failed: too many results'. The user is concerned about the impact on system performance. The data volume is approximately 1 TB per day. Which of the following should the user do to create a reliable dashboard that updates frequently without causing performance issues?

Accepted Answer

Create a scheduled summary search that aggregates sales data by category every 5 minutes, and use the 'loadjob' command in the dashboard to load the summary results.. Creating a scheduled summary search that pre-aggregates sales data by category every 5 minutes, and then using 'loadjob' in the dashboard to load those pre-computed results, is the most efficient approach. This drastically reduces the load on indexers because the heavy aggregation runs only every 5 minutes, while the dashboard refreshes every 5 seconds by loading the small pre-summarized results. Option A is correct. Option B ('streamstats' with last 5 minutes) still scans the full raw data on every refresh and does not reduce the result set size sufficiently, as 'streamstats' accumulates all events. Option C reduces display but still performs the full aggregation on every 5-second refresh, causing performance issues. Option D uses 'timechart' with span=5s in real-time mode, which is extremely resource-intensive and will likely lead to similar 'too many results' errors.

Answer

Use the 'streamstats' command to incrementally calculate revenue and limit the time range to the last 5 minutes to reduce the result set.

Answer

Reduce the search to only show the top 5 categories by using 'head 5' and set a 5-second auto-refresh on the dashboard.

Answer

Change the search to use the 'timechart' command with 'span=5s' and set the search to real-time mode.

Question 14

Refer to the exhibit. A user runs this search in Splunk to create a timechart of web server status codes. The resulting chart shows no data for the "error" status. What is the most likely cause?

Accepted Answer

The eval command after timechart does not affect the timechart series; the timechart already split by original status values.. The search redefines the 'status' field after the timechart command, but timechart already uses the original status values to create separate series. The eval command overwrites the field, but the timechart series are already fixed. To fix, the eval should be placed before timechart.

Answer

The 'status' field is not extracted from the sourcetype.

Answer

The stats command after eval removes the status field.

Answer

The web server is not generating any errors.

Question 15

Refer to the exhibit. A Splunk user runs this search against a lookup file containing application error data. The search returns fewer than 10 results. Which is the most likely reason?

Accepted Answer

The search filter 'severity="high"' is too restrictive, resulting in fewer than 10 matching rows.. The search filters for severity='high', which may be a small subset. The head command limits to 10, but if fewer than 10 match, that's all that's returned.

Answer

The inputlookup command only returns the first 10 rows by default.

Answer

The lookup file contains more than 10 rows.

Answer

The table command limits the number of results.