SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. The pie chart shows only 10 slices, but the base search stats returns all destinations. What is the reason?

Accepted Answer

The post-process search includes | top limit=10 dest. The base search returns all destinations, but the pie chart shows only 10 slices because the post-process search uses the `| top limit=10 dest` command. The `top` command limits the results to the top 10 values of the `dest` field by count, and this post-process search is applied after the base search, so only those 10 slices are displayed in the pie chart.

Answer

The eval command changes the dest field

Answer

The base search time range is too small

Answer

The charting option 'chart' is set to 'pie'

Question 2

A security analyst creates a report that shows the count of failed login attempts by user over the last 7 days. The report uses the `top` command. However, the report only shows the top 10 users, but the analyst wants to see all users. What should the analyst do?

Accepted Answer

Add the `limit=0` argument to the `top` command.. The `top` command in Splunk defaults to showing the top 10 results. Adding `limit=0` removes this limit, displaying all users with failed login attempts. This is the correct approach because `top` already counts occurrences and sorts them, so the analyst only needs to override the default limit.

Answer

Use the `rare` command instead.

Answer

Change the time range to include more data.

Answer

Use the `stats count by user` command and sort descending.

Question 3

A user wants to create a dashboard panel that shows a single number representing the total number of errors in the last 24 hours. Which visualization type should be used?

Accepted Answer

Single value. A Single Value visualization is designed to display a single numeric metric prominently, making it the ideal choice for showing the total number of errors in the last 24 hours. It directly answers the user's requirement for a single number without any additional chart elements or time-series context.

Answer

Pie chart

Answer

Bar chart

Answer

Line chart

Question 4

A dashboard has a radio button input that selects a sourcetype. The panel uses `index=web sourcetype=$source$`. However, when the user selects a sourcetype, the panel doesn't update. What is the most likely cause?

Accepted Answer

The token name in the search is `$source$` but the input token is named `sourcetype`.. The dashboard panel does not update because the token referenced in the search string (`$source$`) does not match the name of the radio button input. In Splunk, a dashboard input creates a token with the name specified in its `token` attribute. If the input's token is named `sourcetype`, the search must use `$sourcetype$` to reference its value. Using `$source$` means the search looks for a token that does not exist, so no substitution occurs and the panel remains static.

Answer

The search includes a `stats` command that ignores the token.

Answer

The panel is a single value panel that does not update dynamically.

Answer

The time range is too short and returns no events.

Question 5

A report uses `| timechart count by action`. The user wants to show only the top 3 actions and combine all others into a single 'Other' column. Which argument should be added?

Accepted Answer

`limit=3 useother=t`. The `timechart` command in Splunk uses the `limit` argument to control the number of distinct series (columns) displayed. Adding `limit=3` restricts the output to the top 3 values by count, and `useother=t` automatically groups all remaining values into a single 'Other' column. Without `useother=t`, the extra values are simply dropped, not aggregated.

Answer

`limit=3`

Answer

`useother=t`

Answer

`other=t`

Question 6

A user wants to add a trend indicator to a single value visualization showing whether the count increased or decreased compared to the previous period. Which feature should be used?

Accepted Answer

Comparison. The Comparison feature in a single value visualization allows you to show a trend indicator (e.g., an up or down arrow) that compares the current value to a previous time period, such as the previous week or month. This directly answers the user's need to see whether the count increased or decreased compared to the previous period. It is configured in the 'Single Value' visualization options under 'Comparison' settings.

Answer

Trendline

Answer

Color coding

Answer

Sparkline

Question 7

A dashboard has multiple panels that use the same base search. The admin wants to avoid running the same search multiple times. Which feature should be used?

Accepted Answer

Post-process search. Post-process searches allow a dashboard panel to run a secondary search against the results of a base search, rather than re-running the original search against the index. This avoids redundant data retrieval and processing, as the base search runs once and its results are stored in a results server, which subsequent post-process searches query using the `| search` command or similar filtering.

Answer

Report acceleration

Answer

Data model

Answer

Summary indexing

Question 8

A user wants to save a search as a report that can be used in a dashboard. Which TWO steps are required? (Select two.)

Accepted Answer

Run the search and click 'Save As' > 'Report'. Option B is correct because in Splunk you must first run the search and then use 'Save As' > 'Report' to convert the ad-hoc search into a saved report, which is the prerequisite for dashboard use. Option D is correct because during that save workflow you must provide a report name and configure permissions (owner/app/sharing) so the report is persisted and accessible to the dashboard. Option A is incorrect because scheduling email delivery is an optional alert/report action, not a required step to save a report. Option C is incorrect because a time range can be inherent in the search or set later; it is not a mandatory save step. Option E is incorrect because adding the report to a dashboard panel happens after the report exists and is not part of saving it.

Answer

Schedule the report for email delivery

Answer

Set a time range in the search

Answer

Add the report to a dashboard panel

Question 9

Refer to the exhibit. The dashboard panel is not displaying data when the input changes. What is the most likely cause?

Accepted Answer

The token name in the search is "$token$" but the input token is "source".. The most likely cause is a token name mismatch. The search uses $token$ but the input defines the token as 'source'. For the dashboard to update when the input changes, the token names in the search and the input must match exactly. Therefore, option D is correct. Option A is incorrect because searchWhenChanged='true' enables automatic search on input change, not prevents loading. Option B is incorrect because timechart uses _time by default and does not require an explicit time field. Option C is incorrect because a chart type is not required; it defaults to a column chart.

Answer

The input uses `searchWhenChanged="true"` which prevents dashboard loading.

Answer

The search uses `timechart` which requires a time field.

Answer

The chart type is not specified.

Question 10

A security team wants to monitor the count of failed login attempts over the past week. They need a simple at-a-glance number. Which visualization type should they use?

Accepted Answer

Single Value. A Single Value visualization is the correct choice because it displays a single, aggregated number prominently, making it ideal for an at-a-glance metric like the count of failed login attempts over the past week. In Splunk, you can use a stats or timechart command to calculate the total count and then render it as a Single Value, which shows just the number without any trend or distribution detail.

Answer

Line chart

Answer

Bar chart

Answer

Pie chart

Question 11

An administrator needs to share a report with executives who prefer to see data in a tabular format with sorting capabilities. Which reporting method is best?

Accepted Answer

Table. A Table visualization in Splunk provides a tabular format with built-in sorting capabilities (clickable column headers), which directly meets the executives' requirement for viewing data in a structured, sortable table. Unlike other visualizations, the Table report type preserves raw event data in rows and columns, allowing users to reorder results by any field without additional configuration.

Answer

Dashboard panel

Answer

Gauges

Answer

Pie chart

Question 12

A user created a report that runs every hour. They notice the report's results include data from the previous hour only, but they want data from the last 24 hours. What should they change in the search?

Accepted Answer

Change the time range to Last 24 hours. The report's search is currently using a relative time range (e.g., Last hour) that limits results to the previous hour. Changing the time range to 'Last 24 hours' expands the search window to include all events from the past 24 hours, ensuring the report returns the desired data. The scheduling frequency controls when the search runs, not the span of data it retrieves.

Answer

Increase the report scheduling frequency

Answer

Add | timechart span=1h

Answer

Use | stats count by date_hour

Question 13

An analyst needs to see the top 5 error codes by count. Which visualization is most appropriate?

Accepted Answer

Bar chart. A bar chart is the most appropriate visualization for comparing the count of distinct error codes because it allows easy comparison of categorical data (error codes) against a numeric value (count). In Splunk, the `top` command or `stats count by error_code` produces results that are best visualized with a bar chart to show the relative frequency of each error code, and the chart can be limited to the top 5 by setting the limit in the search or chart properties.

Answer

Pie chart

Answer

Line chart

Answer

Single Value

Question 14

A dashboard includes a form input that allows users to select a user. After selecting a user, a panel should show that user's activity. Which dashboard feature is required?

Accepted Answer

Tokens. Tokens are the mechanism in Splunk dashboards that allow form inputs to pass selected values to panels. When a user selects a user from a dropdown, a token is set with that value, and the panel's search uses the token (e.g., $user$) to filter results dynamically. This is the core feature enabling interactive dashboards.

Answer

Post-process searches

Answer

Drilldown

Answer

Link to report

Question 15

A dashboard has multiple panels that each use the same base search but apply different aggregate functions. To avoid running the base search multiple times, which technique should be used?

Accepted Answer

Use a base search with post-process panels. Splunk's post-process search feature allows a dashboard to define a single base search that runs once, and then multiple panels can apply different aggregate functions (e.g., stats, timechart) on the results without re-executing the base search. This is achieved by using the `base` and `postprocess` attributes in the dashboard XML or Simple XML, which significantly reduces search overhead and improves dashboard performance.

Answer

Use | savedsearch to reference the base search

Answer

Use | multisearch to combine all aggregations

Answer

Use | map to run the base search for each panel