SPLK-1001 Practice Question: Creating Reports, Dashboards and Visualizations
Exhibit
index=web sourcetype=access_combined | chart count over host by status
Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?
⚠ Common exam trap
Many exam-takers choose a pie chart thinking it shows 'distribution,' but they overlook that a pie chart cannot handle multiple categories (hosts) simultaneously, whereas a stacked column chart correctly represents the hierarchical breakdown per host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stacked column chart
A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stacked column chart
Why this is correct
Shows composition per host.
- ✗
Line chart
Why it's wrong here
Line is for time-based trends.
- ✗
Pie chart
Why it's wrong here
Pie shows parts of a whole for one category.
- ✗
Scatter chart
Why it's wrong here
Scatter shows correlation between two numeric fields.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.