Using Fields and Lookups →mediumDrag & DropObjective-mapped

SPLK-1001 Using Fields and Lookups Practice Question

Drag and drop the steps to create a simple Splunk search that returns results for a specific error in the last 24 hours into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Select the Search & Reporting app, Enter the search query for the error, Set the time range to Last 24 hours, Run the search.

Basic search workflow involves selecting the app, entering the search with time range, executing, and reviewing results.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Select the Search & Reporting app, Enter the search query for the error, Set the time range to Last 24 hours, Run the search.
Why this is correct
This is correct because you first need to be in the Search & Reporting app, then enter your query, set the desired time range, and finally execute the search to retrieve results.
✗
Set the time range to Last 24 hours, Select the Search & Reporting app, Enter the search query for the error, Run the search.
Why it's wrong here
This is incorrect because you cannot set the time range before selecting the app; the time range picker is only available within the Search & Reporting app context.
✗
Enter the search query for the error, Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search.
Why it's wrong here
This is incorrect because you cannot enter a search query before selecting the Search & Reporting app; the search bar is not available otherwise.
✗
Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search, Enter the search query for the error.
Why it's wrong here
This is incorrect because running the search without entering a query would return no results or default data, not the specific error search.

Go deeper