SPLK-1002 Advanced Visualization and Lookups Practice Question
Exhibit
Refer to the exhibit. | timechart span=1h count by host limit=5
An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.
The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.
Why this is correct
Adding useother=t groups remaining hosts into 'Other' to account for total count.
- ✗
The limit parameter is misused; it should be 'limit=0' to show all hosts.
Why it's wrong here
Setting limit=0 shows all, but the issue is the missing 'other' category.
- ✗
The timechart command automatically uses 'other' for the remaining hosts.
Why it's wrong here
It does not automatically use 'other'; useother=t required.
- ✗
The limit parameter applies to the entire search, not per bucket.
Why it's wrong here
The limit applies per bucket in timechart.
- ✗
The limit parameter restricts the number of series per bucket, but not the overall count aggregation.
Why it's wrong here
The limit restricts the number of series; the 'other' category is not included by default.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.