SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
Exhibit
index=apache | timechart count by source | rename count as "MyCount"
Refer to the exhibit. The user wants to display the count over time for each source. However, the chart shows only one line labeled 'MyCount'. What is the problem?
⚠ Common exam trap
Splunk often tests the nuance that `timechart count by source` creates multiple fields with names like `count: source_value`, and candidates mistakenly think `rename count as "MyCount"` will rename all of them, leading them to overlook the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `rename` command after `timechart` renames incorrectly; `timechart count by source` creates multiple fields, and `rename count as "MyCount"` does not rename them.
`timechart count by source` generates separate fields for each source value (e.g., `count: source1`, `count: source2`), not a single field named `count`. The subsequent `rename count as "MyCount"` fails to match any existing field, so the chart displays only one line labeled `MyCount` (which is actually a null or default aggregation). To rename all source-specific count fields, you must use a wildcard or rename each field individually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The index name is misspelled.
Why it's wrong here
Index spelling might affect data but not the labeling issue.
- ✗
The `timechart` command should not have `by source`.
Why it's wrong here
Without `by source`, it would show a single total count, not per source.
- ✓
The `rename` command after `timechart` renames incorrectly; `timechart count by source` creates multiple fields, and `rename count as "MyCount"` does not rename them.
Why this is correct
The `rename` command should use a pattern like `rename * as "*"` or rename each series individually.
- ✗
The chart type is line chart by default.
Why it's wrong here
The chart type is not the issue; it's the labeling.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.