SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
A financial analyst creates a dashboard in Splunk Web to track daily transaction volumes. The dashboard has three panels: a table of top 10 merchants by transaction count, a bar chart of transactions by hour, and a single value showing total transaction amount. All panels use the same base search from the 'transactions' index. The analyst is in the 'finance' role. The dashboard runs fine in the analyst's session, but when the analyst shares the dashboard with the 'auditor' role, the auditor sees no data in any panel. The auditor role has read access to the dashboard and the 'transactions' index. What is the most likely cause?
⚠ Common exam trap
Splunk often tests the misconception that index-level read access alone guarantees data visibility in dashboards, ignoring the separate permission layer on saved search objects used as base searches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The base search used in the dashboard's panels is a saved search owned by the analyst, and the 'auditor' role does not have permissions to that saved search
The base search is a saved search owned by the analyst. When a dashboard uses a saved search as its base search, Splunk enforces permissions on that saved search object. Even though the auditor role has read access to the 'transactions' index, if the saved search itself is not shared with the auditor role (e.g., it remains private to the analyst), the dashboard panels will fail to retrieve data for the auditor. This is a common permission scoping issue in Splunk where data access is gated by the saved search object, not just the index.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The base search used in the dashboard's panels is a saved search owned by the analyst, and the 'auditor' role does not have permissions to that saved search
Why this is correct
If the base search is saved and owned by the analyst, other roles need explicit read permission on that search object.
- ✗
The 'auditor' role does not have read access to the 'transactions' index
Why it's wrong here
The scenario states the auditor has read access to the index.
- ✗
The dashboard's permission is set to 'private' and only the analyst can view it
Why it's wrong here
The analyst shared it to the auditor role, so read access is granted.
- ✗
The dashboard is set to run as the 'finance' role, and the 'auditor' role lacks the 'rbac_perm' privilege
Why it's wrong here
rbac_perm is not a valid Splunk privilege.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.