SPLK-1002 Advanced Visualization and Lookups Practice Question
A dashboard uses a timechart to show CPU usage over 24 hours. The time range selector is set to 'Last 7 days'. The chart displays data only for the last 24 hours. Which visualization setting is MOST likely causing this?
⚠ Common exam trap
Splunk often tests the distinction between 'Time range override' (which changes the time window) and 'Span' (which changes the bucket size), leading candidates to confuse a bucket interval setting with a time range restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The chart's 'Time range override' is set to 24 hours.
The 'Time range override' setting on a visualization explicitly overrides the dashboard's global time picker. When set to a fixed duration like 24 hours, the chart ignores the 'Last 7 days' selection and only displays data for that specific window. This explains why the chart shows only the last 24 hours despite the dashboard time range being 7 days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The chart's 'Time range override' is set to 24 hours.
Why this is correct
A time range override on the panel overrides the dashboard selector.
- ✗
The 'Max rows' is set to 24.
Why it's wrong here
Max rows limits displayed rows, not time range.
- ✗
The 'Span' is set to 1 hour.
Why it's wrong here
Span affects granularity, not total time range.
- ✗
The data source only retains 24 hours.
Why it's wrong here
Not specified in stem.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.