SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
A team wants to add an interactive time range picker to a dashboard. The dashboard uses a base search with a token for earliest and latest. Which configuration is required?
⚠ Common exam trap
Splunk often tests the distinction between `input type='time'` (the correct element for a time range picker) and `input type='dropdown'` (which only provides a static list of options), leading candidates to mistakenly choose a dropdown with a time token.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add input type='time' token='time_tok' and use $time_tok$ in the search
The `input type='time'` element is the standard way to add an interactive time range picker in Splunk dashboards. By setting the `token` attribute to `time_tok` and referencing `$time_tok$` in the base search, the dashboard dynamically passes the selected time range to the search, overriding any static earliest/latest values.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the search's earliest and latest to -1h and now
Why it's wrong here
This hardcodes a fixed time range, not interactive.
- ✗
Use the built-in time range picker by adding <option> elements
Why it's wrong here
The built-in picker is added via input type='time', not <option> elements.
- ✗
Add input type='dropdown' token='time' and use $time$ in the search
Why it's wrong here
A dropdown input is not a time range picker; it selects from a list of options.
- ✓
Add input type='time' token='time_tok' and use $time_tok$ in the search
Why this is correct
This correctly creates a time range picker and links it to the search via token.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.