Configure Scheduled Reports SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An admin needs to create a scheduled report that runs every 15 minutes, but only during business hours (9 AM to 5 PM) on weekdays. They want to avoid running it outside these hours. Which cron expression should they use?

   • A*/15 * * * 1-5
   • B0,15,30,45 9-17 * * *
   • C*/15 9-17 * * *
   • D*/15 9-17 * * 1-5
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A scheduled report runs every 30 minutes and typically takes 5 minutes to complete. Recently, the search has started taking 45 minutes due to increased data volume. The admin notices overlapping runs and delayed results. They need the report to complete without overlaps, but they cannot change the search query. What should they do?

   • ADisable the report and re-enable it after each run.
   • BChange the schedule to run every hour.
   • CReduce the time range to 'Last 15 minutes'.
   • DSet the schedule priority to 'High'.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A Splunk administrator wants a scheduled report to run at 2:30 AM every day. Which cron expression should be used in the schedule settings?

   • A* * 2 30 *
   • B30 2 * * *
   • C2 30 * * *
   • D0 2 30 * *
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An admin needs to update the search query of an existing scheduled report to include a new field. The report is currently active and emailing results. What is the correct way to make this change?

   • AEdit the scheduled report and modify the search query, then save.
   • BCreate a new report with the same name and overwrite the old one.
   • CDisable the report, edit the search, and re-enable it.
   • DDelete the report and create a new one with the updated search.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A scheduled report is failing to run because the search takes too long and exceeds the default time limit. The admin has already optimized the search as much as possible. What is the most appropriate next step?

   • AIncrease the search time limit for the scheduled report in its settings.
   • BChange the schedule to run less frequently.
   • CReduce the time range of the search.
   • DDisable the report and run it manually when needed.
   Reveal Solution Discussion Select an answer first