SPLK-1002 Advanced Visualization and Lookups Practice Question

Arrange the steps to create a scheduled report in Splunk in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Run a search, Save as report, Set schedule, Set time range

Scheduled reports require saving a search as a report, then configuring its schedule and time range.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Run a search, Save as report, Set schedule, Set time range
Why this is correct
This is the correct order because you must first run a search, then save it as a report to create a persistent object. After saving, you configure the schedule (e.g., frequency) and then define the time range for the scheduled run.
✗
Run a search, Set schedule, Save as report, Set time range
Why it's wrong here
This is incorrect because you cannot set a schedule on a search that hasn't been saved as a report yet. The schedule option is only available after saving the report.
✗
Set schedule, Run a search, Save as report, Set time range
Why it's wrong here
This is incorrect because you cannot set a schedule before running a search and saving it as a report. The schedule is configured on an existing report, not before its creation.
✗
Run a search, Save as report, Set time range, Set schedule
Why it's wrong here
This is incorrect because the time range is typically configured as part of the schedule settings. You set the schedule first, then define the time range within that schedule configuration.

Go deeper