SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
An analyst created a report that runs a search over the last 7 days. The report is scheduled to run daily. Each time the report runs, it takes a long time and impacts other searches. What is the best way to improve performance without changing the data model?
⚠ Common exam trap
Watch out — candidates often confuse report acceleration with summary indexing (Option D) and assume the latter is the only way to pre-compute results, or they incorrectly think changing the time range (Option B) is a performance fix without realizing it alters the report's data scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable report acceleration on the report.
Report acceleration pre-computes and stores the results of a report's search in a summary cache, allowing subsequent runs to retrieve the cached data instead of re-executing the full search over the raw data. This drastically reduces runtime and resource consumption without altering the underlying data model or the report's logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the schedule to run weekly instead of daily.
Why it's wrong here
Reducing frequency doesn't speed up each individual run.
- ✗
Change the time range to 'Last 24 hours' to reduce data scanned.
Why it's wrong here
This changes the report results, which is not desired.
- ✓
Enable report acceleration on the report.
Why this is correct
Report acceleration pre-computes and caches results, speeding up subsequent runs.
- ✗
Create a summary index and populate it with a separate scheduled search.
Why it's wrong here
Creating a summary index fails here because populating it for a rolling 7-day window still requires the underlying raw data to be processed daily, merely shifting or duplicating the expensive search load rather than reducing it. The original report's slowness stems from this recurring processing. This option is tempting as summary indexes are excellent for accelerating reports that query historical, static aggregations or fixed time windows, such as daily totals, which can be pre-computed once and then quickly retrieved without re-processing raw events.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.