Creating Reports, Dashboards and Visualizations →mediumMultiple ChoiceObjective-mapped

SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations

Exhibit

| inputlookup app_errors.csv
| search error_code=* AND severity="high"
| table app_name, error_code, count
| sort - count
| head 10

Refer to the exhibit. A Splunk user runs this search against a lookup file containing application error data. The search returns fewer than 10 results. Which is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The search filter 'severity="high"' is too restrictive, resulting in fewer than 10 matching rows.

The search filters for severity='high', which may be a small subset. The head command limits to 10, but if fewer than 10 match, that's all that's returned.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The inputlookup command only returns the first 10 rows by default.
Why it's wrong here
inputlookup returns all rows unless filtered.
✗
The lookup file contains more than 10 rows.
Why it's wrong here
Not necessarily; the filter reduces results.
✓
The search filter 'severity="high"' is too restrictive, resulting in fewer than 10 matching rows.
Why this is correct
Correct. The filter limits results, so head returns all matches.
✗
The table command limits the number of results.
Why it's wrong here
Table only selects fields, not rows.

Go deeper

SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question