hardMultiple ChoiceObjective-mapped
SPLK-1001 Practice Question: A data model for web traffic has a child dataset…
A data model for web traffic has a child dataset 'Error_Pages' that should only include events with status code 5xx. The admin wants to ensure that when the data model is used with tstats, only these events are searched. Which definition should they use in the data model?
⚠ Common exam trap
Splunk often tests the distinction between constraints (which define dataset membership) and filters (which are applied at search time), leading candidates to mistakenly choose filters because they think they restrict events in the same way.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a constraint: status>=500 AND status<=599
Constraints in a Splunk data model define the base search that restricts which events are included in a child dataset. By adding a constraint of `status>=500 AND status<=599`, the Error_Pages dataset will only contain events with HTTP status codes in the 5xx range. When `tstats` is used against this dataset, it automatically respects the constraint, ensuring only those events are searched without needing additional filters at query time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a constraint: status>=500 AND status<=599
Why this is correct
Constraints define which events belong to a dataset for acceleration.
- ✗
Add a filter: status>=500 AND status<=599
Why it's wrong here
Filters are not part of the data model definition for acceleration.
- ✗
Use a tag: error_tag for status>=500
Why it's wrong here
Tags are not used within data models for dataset filtering.
- ✗
Use a calculated field: error=(status>=500)
Why it's wrong here
Calculated fields derive values but do not limit events.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.