SPLK-1001 Creating Reports, Dashboards and Visualizations — Timed 10 Questions

Question 1

You are a Splunk administrator for a large e-commerce company. The marketing team has a dashboard that displays daily sales metrics, including revenue, number of transactions, and average order value. The dashboard is built using a single search that runs a 'timechart' command across all events. Recently, the dashboard has been timing out and failing to load during peak hours (10 AM - 2 PM) when traffic is highest. The team needs the dashboard to be available with minimal latency. You have the following options:

A. Reduce the time range on the dashboard to the last hour instead of the default last 24 hours.
B. Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.
C. Increase the search time limit in the Splunk settings to allow the search to run longer.
D. Split the single search into multiple smaller searches, each for a different metric, and run them concurrently on separate panels.

Which option best addresses the performance issue while maintaining data accuracy?

Accepted Answer

Create a summary index that pre-aggregates the sales metrics every hour and modify the dashboard to search this summary index.. Creating a summary index that pre-aggregates sales metrics every hour offloads heavy computation from real-time searches. The dashboard then queries this smaller, pre-computed dataset, drastically reducing search time and avoiding timeouts during peak hours, while maintaining data accuracy since the aggregation is done on the raw data. Other options are less effective: reducing time range (Option B) loses historical data; splitting into multiple searches (Option A) may increase I/O and CPU contention; increasing time limit (Option D) does not address the root cause of scanning large volumes of raw data.

Answer

Split the single search into multiple smaller searches.

Answer

Reduce the time range on the dashboard to the last hour.

Answer

Increase the search time limit in Splunk settings.

Question 2

Which three options correctly describe characteristics or behaviors of Splunk reports and visualizations? (Choose three.)

Accepted Answer

A report can be scheduled to run at a specific time and send results via email.. Options A, B, C, and D are all correct. Option A is correct because Splunk reports can be scheduled to run at specific times and send results via email. Option B is correct because the trellis layout splits a chart into multiple smaller charts based on a field. Option C is correct because a single report can be reused as a data source for multiple dashboard panels via its SID. Option D is correct because the Single Value visualization can display trend indicators and sparklines. Options E and F are incorrect: radial gauges are not the default visualization; time series charts do support the 'stacked' mode.

Answer

Time series charts cannot be used with the 'stacked' mode option.

Answer

The Single Value visualization can display trend indicators and sparklines.

Answer

Radial gauges are the default visualization type for all statistical reports.

Question 3

A security team needs to create a report that shows the number of distinct users who triggered a firewall block each day for the past 30 days. Which search and visualization combination should be used?

Accepted Answer

Use `dc(user)` with `timechart` and a column chart. `dc(user)` calculates the distinct count of users, and `timechart` automatically groups results by time (e.g., per day) over the specified 30-day range. A column chart is the appropriate visualization for displaying discrete daily counts, as it clearly shows trends over time.

Answer

Use `dc(user)` with `chart` and a column chart

Answer

Use `top user` with `timechart` and a pie chart

Answer

Use `count` with `chart` and a bar chart

Question 4

A user wants to create a dashboard panel that refreshes automatically every 60 seconds. Which setting must be configured in the panel's edit mode?

Accepted Answer

Set the Refresh Interval to 60 seconds. The dashboard panel's edit mode includes a 'Refresh Interval' setting that allows you to specify an automatic refresh period in seconds. Setting this to 60 causes the panel to re-run its underlying search and update the visualization every 60 seconds without manual intervention.

Answer

Add | delay 60 to the search

Answer

Schedule the search to run every 60 seconds

Answer

Set the Time Range to Last 60 seconds

Question 5

A dashboard includes a table showing server errors. The team wants to click a row and drill down to a detailed view of that server's events in a new search. Which configuration is required?

Accepted Answer

Set the drilldown action to 'Search' in the table's edit panel. Setting the drilldown action to 'Search' in the table's edit panel configures the dashboard to open a new search when a row is clicked. This uses the selected row's field values (e.g., server name) to populate the new search, enabling a detailed view of that server's events. The drilldown action is a built-in feature of Splunk's Simple XML dashboards, not a search command or external link.

Answer

Enable row expansion in the table options

Answer

Add a link to the search in the table using 'Link to external resource'

Answer

Use the `drilldown` search command in the underlying search

Question 6

Which TWO statements are true about saved reports in Splunk?

Accepted Answer

Saved reports can be used as data sources for dashboard panels.. Saved reports in Splunk can be used as data sources for dashboard panels. When you create a dashboard panel, you can select a saved report as its data source, which allows the panel to display the report's results. This enables reuse of report logic across multiple dashboards without rewriting the search.

Answer

All saved reports automatically send email alerts.

Answer

Saved reports are created exclusively from dashboard panels.

Answer

Saved reports cannot be edited after creation.

Question 7

Which THREE of the following are valid ways to add a visualization to a dashboard?

Accepted Answer

Paste a search query in the dashboard editor.. Pasting a search query directly into the dashboard editor is a standard method for creating a new panel. When you paste a search in the editor, Splunk automatically generates a visualization based on the search results, allowing you to configure the chart type and formatting within the dashboard context.

Answer

Create a report and then drag it onto the dashboard.

Answer

Upload a CSV file and select visualization type.

Question 8

Which TWO chart types are best suited for showing the distribution of categorical data?

Accepted Answer

Pie chart. Pie charts and column charts are both effective for displaying the distribution of categorical data because they visually compare parts of a whole or the frequency of distinct categories. In Splunk, the `pie` and `column` chart types are commonly used with the `chart` or `timechart` commands to aggregate event counts or statistical values by a categorical field, making it easy to see relative proportions or rankings.

Answer

Scatter chart

Answer

Line chart

Answer

Area chart

Question 9

Which THREE actions are possible when editing a dashboard in Studio?

Accepted Answer

Set a custom time range for the dashboard.. In Splunk Dashboard Studio, you can set a custom time range for the entire dashboard via the 'Time Range' picker in the editor. This overrides the default time range and applies to all panels that do not have their own explicit time range set, allowing consistent temporal scoping across the dashboard.

Answer

Edit the underlying search of a report used in a panel.

Answer

Export the dashboard as a PDF from the editor.

Question 10

A user wants to create a report that shows the top 5 most frequent error messages from the last 7 days. The search results should be sorted by count. Which search is correct?

Accepted Answer

error | top limit=5 message. The `top` command automatically counts the occurrences of each distinct value of the `message` field, sorts the results in descending order by count, and limits the output to the top 5 results. This directly fulfills the requirement of showing the top 5 most frequent error messages from the last 7 days, sorted by count.

Answer

error | top 5 message

Answer

error | rare message | head 5

Answer

error | stats count by message | sort -count