After running a search, a user sees a timeline at the top of the results page and a list of events below. They want to see only events that occurred in the last 5 minutes of the search time range. What is the most efficient way to do this?

Use the 'Field sidebar' to filter by the 'time' field.

Click on the last 5-minute segment of the timeline to zoom in.

Edit the search query to add `| head 5` to limit the results.

Change the time range picker to 'Last 5 minutes' and re-run the search.

A user is new to Splunk and wants to understand where to find the search bar, the app navigation, and the main menu. Which area of the Splunk web interface contains all of these elements?

The 'Search & Reporting' app's results page.

The top bar of the Splunk web interface.

The left sidebar on the home page.

A new Splunk user wants to see all events from the last hour that mention the word 'error'. They have just logged in and are on the Splunk home page. What is the most direct way to accomplish this?

Use the 'Reports' page to find a pre-built report that shows errors from the last hour.

Navigate to the 'Search & Reporting' app, open the 'Field sidebar', and click on the 'error' field to see events.

Type `error` into the search bar and press Enter, then adjust the time range picker to 'Last 60 minutes'.

Create a new dashboard and add a panel that displays all events containing 'error'.

A user runs a search and sees a large number of events. They want to quickly see the most common values for the 'user' field. Where should they look?

In the field sidebar, click on the 'user' field to see its top values.

In the search bar, type `| top user` to see the top values.

In the events list, scan through each event to find the user.

In the timeline, look for the peak times.

SplunkCore Certified User

Domain 1Objective 5

Basic Navigation in Splunk SPLK-1001 Practice Questions (Page 1)

Part of the Splunk Basics domain, which accounts for 5% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~1–2 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

5%of the exam

Questions 1–5

1foundation · easy
In the Splunk search results page, which area lists the fields that are extracted from your events and shows their values?
Select an answer first
2application · medium
After running a search, a user sees a timeline at the top of the results page and a list of events below. They want to see only events that occurred in the last 5 minutes of the search time range. What is the most efficient way to do this?
Select an answer first
3application · medium
A user is new to Splunk and wants to understand where to find the search bar, the app navigation, and the main menu. Which area of the Splunk web interface contains all of these elements?
Select an answer first
4application · medium
A new Splunk user wants to see all events from the last hour that mention the word 'error'. They have just logged in and are on the Splunk home page. What is the most direct way to accomplish this?
Select an answer first
5application · medium
A user runs a search and sees a large number of events. They want to quickly see the most common values for the 'user' field. Where should they look?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.