A user runs a search for error events and sees results for the last 15 minutes. The user now wants to see the same search results for the last hour. What is the most efficient way to update the search?

Change the search to 'index=_internal | head 100' to see more events.

Type a new search from scratch with 'earliest=-60m'.

Open a new search tab and run the same query with 'Last 60 minutes'.

Click the time range picker, select 'Last 60 minutes', and click Search.

What does the relative time token 'yesterday' represent in a Splunk search?

The entire previous calendar day from 00:00 to 23:59

The last 24 hours from the current time

The time from midnight to now on the previous day

A user has a saved search that reports on errors from the last 24 hours. The user wants to see the same report for the last 7 days. What is the most efficient way to update the saved search?

Edit the search string to include 'earliest=-7d' and save it.

Create a new saved search with the same query and 'Last 7 days' time range.

Open the saved search, change the time range to 'Last 7 days' in the time range picker, and save the changes.

Run the search with 'Last 7 days' and then create a report from the results.

Which search syntax correctly specifies a time range from 1 hour ago to now?

index=web earliest=now latest=-1h

index=web earliest=-1h latest=now

SplunkCore Certified User

Domain 2Objective 2

Set the Time Range of a Search SPLK-1001 Practice Questions (Page 4)

Part of the Basic Searching domain, which accounts for 22% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

22%of the exam

Questions 16–20

16application · easy
A user runs a search for error events and sees results for the last 15 minutes. The user now wants to see the same search results for the last hour. What is the most efficient way to update the search?
Select an answer first
17foundation · easy
What does the relative time token 'yesterday' represent in a Splunk search?
Select an answer first
18application · medium
A user has a saved search that reports on errors from the last 24 hours. The user wants to see the same report for the last 7 days. What is the most efficient way to update the saved search?
Select an answer first
19foundation · easy
Which search syntax correctly specifies a time range from 1 hour ago to now?
Select an answer first
20foundation · easy
Which of the following is a valid absolute time format for the 'earliest' modifier in Splunk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.