A compliance team needs a daily report of all user login failures from the previous day. They want this report to be generated automatically every morning at 8 AM. Which alert type should they use?

Rolling-window alert over 24 hours

Scheduled alert running daily at 8 AM

Scheduled alert running every hour

Real-time alert with a rolling window

A Splunk admin creates an alert and shares it with the 'IT' role. Later, a user with the 'IT' role reports that they cannot see the alert in the Alerts list. The admin confirms the alert is enabled and the schedule is active. What is the most likely reason the user cannot see the alert?

The alert's owner is the admin and the user does not have permission to view alerts owned by others

The alert's permissions are set to 'private' instead of being shared with the IT role

The alert's schedule is set to run only during business hours

The alert's trigger condition is set to 'number of results is greater than 100'

What is the purpose of alert throttling in Splunk?

To limit how often notifications are sent for the same trigger condition

To limit the number of results returned by the search

To restrict which users can view the alert

To reduce the frequency of the alert search schedule

A Splunk user has a saved search that identifies failed login attempts. The user wants to be notified whenever the search returns any results. What is the first step to create an alert from this saved search?

Open the saved search and click 'Edit' then 'Alert'

Create a new search and then save it as an alert

Run the search and then click 'Save As Alert'

Navigate to the Alerts page and click 'New Alert'

A Splunk admin configures an alert to send an email and add results to a summary index. During testing, the email is sent but the summary index is not updated. What is the most likely cause?

The summary index action is not enabled or the index name is incorrect

The alert's trigger condition is set to 'number of results is greater than 0'

Throttling is enabled and suppresses the summary index action

The alert is a real-time alert and does not support summary index actions

SplunkCore Certified User

Domain 8Objective 4

Create Alerts SPLK-1001 Practice Questions (Page 1)

Part of the Creating Scheduled Reports and Alerts domain, which accounts for 5% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~1–2 in this domain), expect 1–1 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

5%of the exam

Questions 1–5

1application · medium
A compliance team needs a daily report of all user login failures from the previous day. They want this report to be generated automatically every morning at 8 AM. Which alert type should they use?
Select an answer first
2expert · hard
A Splunk admin creates an alert and shares it with the 'IT' role. Later, a user with the 'IT' role reports that they cannot see the alert in the Alerts list. The admin confirms the alert is enabled and the schedule is active. What is the most likely reason the user cannot see the alert?
Select an answer first
3foundation · easy
What is the purpose of alert throttling in Splunk?
Select an answer first
4application · medium
A Splunk user has a saved search that identifies failed login attempts. The user wants to be notified whenever the search returns any results. What is the first step to create an alert from this saved search?
Select an answer first
5expert · hard
A Splunk admin configures an alert to send an email and add results to a summary index. During testing, the email is sent but the summary index is not updated. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.