Creating Reports, Dashboards and Visualizations →hardMultiple ChoiceObjective-mapped

SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations

Exhibit

dashboard.xml:
<dashboard>
  <label>Web Performance</label>
  <row>
    <panel>
      <title>Error Rate</title>
      <chart>
        <search>index=web sourcetype=access_combined status>=400 | timechart count by status</search>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
    <panel>
      <title>Response Time</title>
      <chart>
        <search>index=web sourcetype=access_combined | stats avg(response_time) by host</search>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
</dashboard>

Refer to the exhibit. A Splunk admin created this dashboard XML. When viewing the dashboard, the "Response Time" panel shows no data. What is the most likely cause?

⚠ Common exam trap

Test-takers frequently assume the field exists because the dashboard was designed for it, or they incorrectly blame the visualization type or the stats command syntax, rather than verifying the actual field availability in the underlying sourcetype.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The 'response_time' field does not exist in the access_combined sourcetype.

The dashboard XML references a field called 'response_time' in the search, but the access_combined sourcetype (commonly used by Splunk for web access logs) does not contain a field named 'response_time'. The access_combined sourcetype typically includes fields like status, bytes, referrer, useragent, etc., but not a dedicated response_time field. Without this field existing in the data, the stats command will return no results, causing the panel to show no data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The index 'web' does not contain any events.
Why it's wrong here
The first panel works, so index has data.
✗
The bar chart cannot display the results.
Why it's wrong here
Bar chart can display stats results.
✗
The stats command requires a by clause and host is not a valid field.
Why it's wrong here
host is a default field in Splunk.
✓
The 'response_time' field does not exist in the access_combined sourcetype.
Why this is correct
Correct. Access_combined sourcetype usually does not include response_time; it might be in other sourcetypes.

Go deeper

SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question