Save a Search as a Report SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which action can you perform directly from the Reports listing page?

   • ACreate a new data model.
   • BEdit the report's search query.
   • CModify the indexer configuration.
   • DChange the report's underlying data source.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a capability that a report in Splunk provides beyond a basic saved search?

   • AIt can be written in a different search language than the original search.
   • BIt can be run only by users with the admin role.
   • CIt can be stored in a separate database from the original search.
   • DIt can be scheduled to run automatically at specified intervals.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A user has a saved search that they run manually. They want to create a report that runs on a schedule and can be shared. What is the most efficient way to achieve this?

   • AExport the saved search and import it as a report.
   • BCreate a new report from scratch and copy the search string.
   • CSchedule the saved search directly without saving it as a report.
   • DOpen the saved search, click Save As, select Report, and configure the schedule and permissions.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A report named 'Weekly Errors' is scheduled to run every Sunday at 11:00 PM. The report uses a time range of 'Last 7 days'. On Monday morning, the team notices the report shows data from the previous Sunday to the current Sunday, but they expected data from Monday to Sunday. What is the most likely cause?

   • AThe report's time range is set to 'All time' by default, which includes all data.
   • BThe report's schedule is set to run on Monday, but the time range is set to 'Last 7 days' from the creation date.
   • CThe time range 'Last 7 days' is relative to the scheduled run time, so it includes the previous 7 days up to Sunday 11:00 PM.
   • DThe report is using a rolling time range that updates every time the report is viewed.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Where can you find a list of all saved reports in Splunk Web?

   • ASearch page under the 'History' tab.
   • BSettings > Data Inputs.
   • CDashboards listing page.
   • DReports listing page under the Reports menu.
   Reveal Solution Discussion Select an answer first