SPLK-1002 Advanced Visualization and Lookups Practice Question
You are a Splunk power user working for a healthcare organization. You have created a visualization that shows patient wait times by department over the last 30 days. The chart uses a timechart command with a 'stacked' option. Recently, the chart started showing negative values for some departments, which is impossible because wait times cannot be negative. You have verified that the raw data is correct and contains only positive wait times. The search is: index=healthcare sourcetype=patient_wait | timechart span=1d avg(wait_time) by department. The chart is displayed as a stacked area chart. The negative values appear only for a few departments sporadically. You suspect the issue is related to how null values are handled. What could be causing the negative values?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'stacked' option is misinterpreting null values as negative.
In stacked area charts, when there are null values (missing data points), the stacking algorithm can misinterpret them as negative values, causing the chart to show negative areas. This is a known behavior in Splunk's stacked area visualization. Option A is wrong because 'limit=0' in timechart controls the maximum number of series displayed, not the handling of null values. Option B is wrong because overlapping time ranges from indexing delays would cause duplication, not negative values. Option C is wrong because the 'other' category aggregates low-value series and does not cause negative values; it is unrelated to null value misinterpretation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The timechart command is using 'limit=0' which causes overcounting of series.
Why it's wrong here
limit=0 includes all series, does not create negatives.
- ✗
There is a counting error in the search due to overlapping time ranges from data indexing delays.
Why it's wrong here
Overlapping would affect counts but not produce negative values.
- ✗
The use of 'other' category in stacked charts can cause negative values when there are many series.
Why it's wrong here
The 'other' category aggregates, not causes negatives.
- ✓
The 'stacked' option is misinterpreting null values as negative.
Why this is correct
Stacked charts can interpret nulls as negative for series with gaps.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.