SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
Exhibit
index=web sourcetype=access_combined | timechart span=1h count by status | eval status=if(status>=400, "error", "success") | stats sum(count) as total by _time, status | eval color=if(status="error", "red", "green") | table _time, status, total, color
Refer to the exhibit. A user runs this search in Splunk to create a timechart of web server status codes. The resulting chart shows no data for the "error" status. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The eval command after timechart does not affect the timechart series; the timechart already split by original status values.
The search redefines the 'status' field after the timechart command, but timechart already uses the original status values to create separate series. The eval command overwrites the field, but the timechart series are already fixed. To fix, the eval should be placed before timechart.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'status' field is not extracted from the sourcetype.
Why it's wrong here
Access_combined sourcetype typically has status field extracted automatically.
- ✓
The eval command after timechart does not affect the timechart series; the timechart already split by original status values.
Why this is correct
Correct. The timechart creates series based on the status field at that point; later eval does not change the series.
- ✗
The stats command after eval removes the status field.
Why it's wrong here
The stats command groups by status, so status is retained.
- ✗
The web server is not generating any errors.
Why it's wrong here
Incorrect; errors may exist but the search logic hides them.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.