SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
A user wants to create a bar chart showing the count of events by host for the last hour. Which command should be used?
⚠ Common exam trap
Splunk often tests the distinction between `stats` and `timechart` — candidates mistakenly choose `timechart` because they think a bar chart requires a time axis, but the question asks for a count by host over the last hour, not a trend over time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`index=* | stats count by host`
`stats count by host` produces a table of hosts and their event counts, which can be directly visualized as a bar chart. The user wants a count of events by host for the last hour, and `stats` with a `by` clause is the appropriate transforming command to aggregate counts per host without time-series splitting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`index=* | timechart count by host`
Why it's wrong here
`timechart` breaks data by time, resulting in multiple series, not a single bar chart per host.
- ✗
`index=* | top host`
Why it's wrong here
`top` shows only the most frequent hosts and includes additional fields.
- ✗
`index=* | chart count by host`
Why it's wrong here
The `chart count by host` command lacks a time-range filter, so it will return counts across all indexed data rather than restricting to the last hour as the scenario requires. This option is tempting because `chart count by host` correctly produces a bar chart with host on the x-axis and event count on the y-axis; it would be the correct choice if the question did not specify a time constraint and instead asked for a count of events by host across the entire dataset.
- ✓
`index=* | stats count by host`
Why this is correct
This produces a table of hosts and their counts, suitable for a bar chart.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.