SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
A large e-commerce company uses Splunk Enterprise to analyze sales data. The marketing team requests a real-time dashboard showing total revenue per product category, updated every 5 seconds. A new Splunk user creates a dashboard panel with the search `index=sales | stats sum(price) by category | sort - sum(price)`. The dashboard works initially, but after 30 minutes, it stops updating and displays the error 'Search failed: too many results'. The user is concerned about the impact on system performance. The data volume is approximately 1 TB per day. Which of the following should the user do to create a reliable dashboard that updates frequently without causing performance issues?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a scheduled summary search that aggregates sales data by category every 5 minutes, and use the 'loadjob' command in the dashboard to load the summary results.
Creating a scheduled summary search that pre-aggregates sales data by category every 5 minutes, and then using 'loadjob' in the dashboard to load those pre-computed results, is the most efficient approach. This drastically reduces the load on indexers because the heavy aggregation runs only every 5 minutes, while the dashboard refreshes every 5 seconds by loading the small pre-summarized results. Option A is correct. Option B ('streamstats' with last 5 minutes) still scans the full raw data on every refresh and does not reduce the result set size sufficiently, as 'streamstats' accumulates all events. Option C reduces display but still performs the full aggregation on every 5-second refresh, causing performance issues. Option D uses 'timechart' with span=5s in real-time mode, which is extremely resource-intensive and will likely lead to similar 'too many results' errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a scheduled summary search that aggregates sales data by category every 5 minutes, and use the 'loadjob' command in the dashboard to load the summary results.
Why this is correct
Summary indexing pre-computes the aggregation, reducing the load on indexers and allowing the dashboard to refresh quickly without heavy searches.
- ✗
Use the 'streamstats' command to incrementally calculate revenue and limit the time range to the last 5 minutes to reduce the result set.
Why it's wrong here
While incrementally better, this still requires scanning recent data and may not scale well with high data volumes.
- ✗
Reduce the search to only show the top 5 categories by using 'head 5' and set a 5-second auto-refresh on the dashboard.
Why it's wrong here
This still runs a heavy search every 5 seconds, which can cause performance issues and may still hit resource limits.
- ✗
Change the search to use the 'timechart' command with 'span=5s' and set the search to real-time mode.
Why it's wrong here
Real-time searches on large datasets consume significant resources and may fail or slow down, as seen.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.