A scheduled report is configured to email results to a distribution list. The report runs successfully, but the recipients do not receive the email. What should the admin check first?

Check the report's permissions to ensure the recipients have access.

Change the report's time range to a shorter period.

Verify that the email server settings in Splunk are configured correctly.

Recreate the report with a different schedule.

A scheduled report that runs every hour has not been generated for the last three hours. The admin checks the report's status and sees 'Failed'. What should the admin do first to troubleshoot the issue?

Delete the report and recreate it with the same settings.

Change the time range to 'Last 15 minutes' to reduce the search load.

Check the report's job history and inspect the error message for the failed runs.

Increase the schedule frequency to every 30 minutes to get more attempts.

A scheduled report is owned by a user who leaves the company. The report continues to run, but other users cannot view it. What is the most likely reason?

The report's data source is no longer available.

The report's time range is invalid.

The report's schedule is disabled because the owner is gone.

The report's permissions are set to 'Private', so only the owner (or users with explicit access) can view it.

A scheduled report that runs every hour has been failing intermittently. The admin reviews the job history and sees that the failures occur only during peak hours. The error message indicates 'Search job terminated due to resource exhaustion'. What should the admin do to resolve this issue?

Disable the report and run it manually during off-peak hours.

Optimize the search to reduce resource usage, such as using summary indexing or more efficient search commands.

Change the time range to 'Last 15 minutes' to reduce the data scanned.

Increase the schedule frequency to every 30 minutes to spread out the load.

A security analyst needs to review the count of failed login attempts every morning at 8:00 AM for the previous day. The analyst wants to receive this information without manually running a search each day. Which Splunk feature should the analyst use?

Save the search as a report and manually run it each morning.

Use a dashboard panel with a time range picker set to Last 24 hours.

Create a scheduled report that runs daily at 8:00 AM with a time range of Last 24 hours.

Create an alert that triggers when the count of failed logins exceeds a threshold.

SplunkCore Certified User

Domain 8Objective 1

Describe Scheduled Reports SPLK-1001 Practice Questions (Page 2)

Part of the Creating Scheduled Reports and Alerts domain, which accounts for 5% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~1–2 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

5%of the exam

Questions 6–10

6application · medium
A scheduled report is configured to email results to a distribution list. The report runs successfully, but the recipients do not receive the email. What should the admin check first?
Select an answer first
7application · medium
A scheduled report that runs every hour has not been generated for the last three hours. The admin checks the report's status and sees 'Failed'. What should the admin do first to troubleshoot the issue?
Select an answer first
8application · medium
A scheduled report is owned by a user who leaves the company. The report continues to run, but other users cannot view it. What is the most likely reason?
Select an answer first
9expert · hard
A scheduled report that runs every hour has been failing intermittently. The admin reviews the job history and sees that the failures occur only during peak hours. The error message indicates 'Search job terminated due to resource exhaustion'. What should the admin do to resolve this issue?
Select an answer first
10application · medium
A security analyst needs to review the count of failed login attempts every morning at 8:00 AM for the previous day. The analyst wants to receive this information without manually running a search each day. Which Splunk feature should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.