SPLK-1002 Advanced Visualization and Lookups Practice Question
A large e-commerce company uses Splunk to monitor its web application performance. The operations team has created a dashboard with a timechart showing the 95th percentile of page load times over the last 24 hours. Recently, the dashboard stopped showing data for the last hour. The Splunk administrator confirms that the index is receiving data and the sourcetype is correctly configured. The search string is:
`index=web_app sourcetype=access_combined earliest=-24h@h latest=@h | timechart perc95(page_load_time) by host`
The dashboard panel uses a base search and a post-process search. The base search is:
`index=web_app sourcetype=access_combined earliest=-7d@d latest=@h`
What is the most likely cause of the missing last hour of data?
⚠ Common exam trap
Splunk often tests the subtle behavior of time modifiers like `@h` and `@d`, where candidates mistakenly believe the data is missing due to indexing or sourcetype issues rather than the time range snapping to the start of the current hour.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The base search time range is set to latest=@h, which excludes data from the current partial hour.
The base search uses `latest=@h`, which snaps the end time to the beginning of the current hour (e.g., 14:00:00), excluding any data from the current partial hour (e.g., 14:00:01 to 14:59:59). Since the dashboard panel relies on this base search, the post-process search inherits that time range, causing the last hour of data to be missing even though the index is actively receiving data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The post-process search has a time range override that conflicts with the base search.
Why it's wrong here
Post-process searches inherit the base search time range; they cannot override it.
- ✗
The base search uses a macro that is not defined in the app context.
Why it's wrong here
There is no macro in the given search.
- ✗
The index is not being searched because the base search uses a wrong sourcetype.
Why it's wrong here
The sourcetype is correct as confirmed.
- ✓
The base search time range is set to latest=@h, which excludes data from the current partial hour.
Why this is correct
@h snaps to the beginning of the hour, missing the last 45 minutes.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.