SPLK-1001 Creating Reports, Dashboards and Visualizations Practice Test 9 — 15 Questions

Question 1

An organization has a large dataset and wants to create a daily report of top 10 error messages. The search takes a long time to run. Which optimization approach reduces run time while maintaining accuracy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use summary indexing to pre-aggregate. Summary indexing pre-aggregates data at search time and stores the results in a summary index. The daily report can then run against this pre-computed summary rather than scanning the entire raw dataset, drastically reducing run time while preserving accuracy because the aggregation is done once.

Answer

Use | rare instead of | top

Answer

Use | head 10 early in the search

Answer

Increase the time range

Question 2

In a dashboard, a user wants to click on a bar in a chart and navigate to another dashboard with relevant data for that bar. Which feature should they configure?

Accepted Answer

Drilldown. Drilldown is the correct feature because it allows a user to click on a data point (e.g., a bar in a chart) and navigate to another dashboard, passing the relevant field values as tokens to filter the target dashboard's data. This is a built-in capability in Splunk dashboards, configurable via the 'Drilldown' editor or XML attributes like `drilldown` on chart elements.

Answer

Link to search

Answer

Custom URL

Answer

Tokens

Question 3

Which three of the following are best practices for creating efficient dashboards? (Choose three.)

Accepted Answer

Use summary indexing to pre-aggregate data. Option A is correct because summary indexing pre-computes and stores aggregated results in a separate index, so dashboard panels can run fast searches against small summary data instead of scanning large raw datasets. Option B is correct because base searches (or base search/post-process patterns) let multiple panels reuse one shared search result set, eliminating duplicated search logic and reducing overall search load. Option C is correct because tokens allow user input (such as a dropdown or time range selection) to be passed between panels, enabling dynamic, reusable dashboards without hard-coding values or duplicating queries. Option D is not a best practice because real-time searches continuously consume resources and are typically reserved for narrow, short-term monitoring rather than efficient dashboard design. Option E is not a best practice because the | map command iterates over results and runs a subsearch per row, which is resource-intensive and scales poorly on large result sets.

Answer

Use real-time searches to ensure data is current

Answer

Use the | map command to iterate over large result sets

Question 4

A security analyst needs to create a report that shows the count of failed login attempts by user over the last 24 hours, updated every hour. The report should be accessible to the SOC team but not to other users. Which sequence of steps should the analyst follow?

Accepted Answer

Run the search, click 'Save As' -> 'Report', set permissions to 'Shared in App' with SOC role, then 'Schedule' hourly.. Splunk reports are saved searches that can be scheduled and have permissions applied. To make the report accessible only to the SOC team, the analyst should set permissions to 'Shared in App' and assign the SOC role, then configure an hourly schedule. This satisfies both the access restriction and the recurring update requirement without creating an alert.

Answer

Run the search, click 'Save As' -> 'Report', set schedule to hourly, then create an alert action to email the report to the SOC team.

Answer

Run the search, click 'Save As' -> 'Dashboard Panel', add to a SOC dashboard, then schedule the dashboard.

Answer

Run the search, click 'Save As' -> 'Alert', set permissions to private, then schedule the alert to trigger hourly.

Question 5

An analyst created a report that runs a search over the last 7 days. The report is scheduled to run daily. Each time the report runs, it takes a long time and impacts other searches. What is the best way to improve performance without changing the data model?

Accepted Answer

Enable report acceleration on the report.. Report acceleration pre-computes and stores the results of a report's search in a summary cache, allowing subsequent runs to retrieve the cached data instead of re-executing the full search over the raw data. This drastically reduces runtime and resource consumption without altering the underlying data model or the report's logic.

Answer

Change the schedule to run weekly instead of daily.

Answer

Change the time range to 'Last 24 hours' to reduce data scanned.

Answer

Create a summary index and populate it with a separate scheduled search.

Question 6

Which visualization type is best suited to show the proportion of errors by category (e.g., HTTP 404, 500, 403) as parts of a whole?

Accepted Answer

Pie chart. A pie chart is the correct choice because it is specifically designed to display the proportional distribution of categorical data as parts of a whole. In Splunk, the `pie` visualization type visually represents the relative size of each error category (e.g., HTTP 404, 500, 403) as slices of a circle, making it immediately clear which category accounts for the largest share of errors.

Answer

Single value

Answer

Column chart

Answer

Scatter plot

Question 7

An analyst creates a dashboard with multiple panels. One panel shows a table of top users by login count. The analyst wants to add a second panel that updates based on the user clicked in the first panel. Which feature should be used?

Accepted Answer

Enable drilldown on the first panel to set a token, and reference that token in the second panel's search.. Drilldown in Splunk allows you to pass context from one panel to another by setting tokens when a user clicks on a value. The first panel's drilldown can set a token (e.g., `$clicked_user$`) which is then referenced in the second panel's search using `| search user=$clicked_user$`. This enables dynamic filtering without requiring separate reports or manual interaction.

Answer

Schedule the first panel as a report and the second as a related report.

Answer

Use the same chart type for both panels to ensure consistency.

Answer

Set both panels to use the same time range picker.

Question 8

A newly created dashboard panel is not displaying data, showing only 'No results found'. The search query works correctly in the Search app. What is the most likely cause?

Accepted Answer

The dashboard's time range picker is set to a different range than the search was tested with.. The most common reason a dashboard panel shows 'No results found' despite the search working in the Search app is a mismatch in the time range. The dashboard's time range picker may be set to a different absolute or relative time (e.g., 'Last 15 minutes' vs. 'All time') than the search was tested with, causing the query to return no events within the dashboard's time boundary.

Answer

The dashboard has not been shared with the user's role.

Answer

The search contains a syntax error that is not caught by the dashboard editor.

Answer

The panel is not based on a saved report.

Question 9

An analyst needs to create a dashboard that displays real-time data (streaming) for operational monitoring. Which panel type supports real-time data?

Accepted Answer

A panel with a search that uses the 'Real-time' time range option.. The 'Real-time' time range option in Splunk allows a dashboard panel to continuously stream and update data as it is indexed, providing live operational monitoring. This is the only panel type that supports true real-time data, as it sets the search to run continuously with a rolling window (e.g., last 60 seconds) rather than relying on a fixed or scheduled time range.

Answer

A panel based on a scheduled alert.

Answer

A panel based on a saved search with a fixed time range.

Answer

A panel based on a saved report with a scheduled time range.

Question 10

Which TWO options are valid when adding a panel to a dashboard from an existing report? (Choose two.)

Accepted Answer

The panel can be added as a table, chart, or single value based on the report's results.. Option A is correct because when you add a panel to a dashboard from an existing report, the report's results can be visualized as a table, chart, or single value, allowing you to choose the most appropriate visualization for the dashboard. Option D is correct because the panel initially uses the report's search string as its search query, but this search can be edited after the panel is added to the dashboard, giving flexibility to customize the data shown. Option B is incorrect because panels can be added to dashboards across different apps, not only the app where the report was created. Option C is incorrect because the report is not merely added as a link; its search and results are used to create a panel. Option E is incorrect because a report's scheduled run time is not inherited by the dashboard; scheduling is separate from dashboard panel configuration.

Answer

The panel can only be added to the same app where the report was created.

Answer

The report is added as a link to the dashboard.

Answer

The report's scheduled run time is inherited by the dashboard.

Question 11

A security analyst creates a dashboard to monitor failed login attempts over the past 24 hours. Which visualization type is most appropriate for showing the trend of failed logins over time?

Accepted Answer

Line chart. A line chart is the most appropriate visualization for showing the trend of failed login attempts over time because it plots continuous data points along a time axis, allowing the analyst to easily identify patterns, spikes, or declines in the event count. In Splunk, a timechart command (e.g., `timechart count by action`) generates data that is best rendered as a line chart to display the temporal progression of failed logins over the past 24 hours.

Answer

Single value

Answer

Pie chart

Answer

Scatter plot

Question 12

A dashboard panel using a bar chart shows a large number of values on the x-axis, making the chart unreadable. Which dashboard option should be used to limit the number of bars shown?

Accepted Answer

Limit in the chart options. The 'Limit' option in the chart configuration allows you to specify the maximum number of data points (bars) displayed on the x-axis. By setting a limit, you reduce the number of bars shown, preventing overcrowding and making the chart readable. This is a direct control over the cardinality of the x-axis values in Splunk's visualization settings.

Answer

Overlay in the chart options

Answer

Color by field in the chart options

Answer

Stack mode in the chart options

Question 13

A SOC manager creates a dashboard with multiple time-range pickers (one global, one per panel). The global picker is set to 'Last 7 days' but one panel uses its own picker set to 'Last 24 hours'. When the dashboard loads, which time range will the panel use?

Accepted Answer

The panel's own picker setting of 'Last 24 hours'. In Splunk dashboards, when a panel has its own time-range picker configured, it overrides the global time-range picker for that specific panel. The panel will use its own picker setting of 'Last 24 hours' regardless of the global setting of 'Last 7 days'. This behavior ensures that individual panels can display data for different time ranges as needed.

Answer

The dashboard default of 'Last 24 hours'

Answer

A combination of both: the last 7 days but limited to 24 hours

Answer

The global picker setting of 'Last 7 days'

Question 14

A power user creates a dashboard with a panel that uses a search returning 10,000 events. The dashboard should display a single value representing the count of unique users. Which search approach is most efficient?

Accepted Answer

Search index=main | stats dc(user) as unique_users. The most efficient because it uses the `stats dc(user)` command directly, which calculates the distinct count of the `user` field in a single pass over the data. This avoids unnecessary data movement or intermediate processing, making it optimal for a dashboard panel that needs to display a single value from 10,000 events.

Answer

Search index=main | eval user=lower(user) | stats dc(user)

Answer

Search index=main | fields user | dedup user | stats count

Answer

Search index=main | table user | stats dc(user)

Question 15

A user creates a report that summarizes error codes by frequency. They want to share it with the team so others can view but not edit. Which permission should the user set on the report?

Accepted Answer

The 'read' permission for the team. The 'read' permission (Option D) is correct because it grants view-only access to the report, allowing team members to see the summarized error codes without the ability to modify or delete the report. In Splunk, permissions are managed via roles and object-level access control, where 'read' enables viewing but not editing, which aligns with the user's requirement to share the report for viewing only.

Answer

The 'edit' permission for the team

Answer

The 'share' permission for the team

Answer

The 'write' permission for the team