Which mouse action is used to select a specific time range on the timeline?

Right-click and choose 'Select Time Range'

Click and drag across the desired time range

Hover over the timeline and press the spacebar

A Splunk user runs a search for all email delivery failures over the last 7 days. The timeline shows a consistent pattern of bars, but the bars are noticeably shorter on Sunday compared to other days. What is the most likely interpretation of this pattern?

Fewer email delivery failures occurred on Sunday compared to other days.

The search results are incomplete because the email server was down on Sunday.

The timeline is displaying data at a different time interval on Sunday.

The email server was more efficient on Sunday, so fewer failures occurred.

An analyst is reviewing a search for authentication failures over the past 48 hours. After zooming into a 6-hour window, the analyst wants to see the events that occurred just before and after that window without losing the current zoom level. What should the analyst do?

Click the Reset button to return to the full 48-hour view, then zoom back into the 6-hour window.

Click on a bar at the edge of the timeline to select that time bucket.

Use the pan (left/right arrow) controls on the timeline to slide the visible window to the adjacent time periods.

Change the time picker to 'Last 6 hours' and re-run the search.

When interpreting the timeline, what does the width of each bar represent?

The size of the search results in megabytes

The time interval covered by that bar

The number of events in that interval

The number of fields in the events

A SOC analyst is investigating a search for malware detection events over the past 30 days. The timeline shows a steady baseline of bars, but there is a single extremely tall bar on the 15th day. The analyst zooms into that day and sees that the tall bar is actually composed of two distinct peaks: one at 09:00 and one at 17:00. The analyst wants to compare the events from both peaks side by side to determine if they are related. What is the most effective approach?

Change the time picker to 'Last 24 hours' and re-run the search to see both peaks in one view.

Select the 09:00 peak, zoom in, note the events, then reset and select the 17:00 peak to compare.

Select the entire day (00:00–23:59) and zoom to that range, then use the timeline to visually compare the two peaks.

Use the pan controls to move between the two peaks without changing the zoom level.

SplunkCore Certified User

Domain 2Objective 5

Use the Timeline SPLK-1001 Practice Questions (Page 1)

Part of the Basic Searching domain, which accounts for 22% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

5concepts

22%of the exam

Questions 1–5

1foundation · easy
Which mouse action is used to select a specific time range on the timeline?
Select an answer first
2application · easy
A Splunk user runs a search for all email delivery failures over the last 7 days. The timeline shows a consistent pattern of bars, but the bars are noticeably shorter on Sunday compared to other days. What is the most likely interpretation of this pattern?
Select an answer first
3application · medium
An analyst is reviewing a search for authentication failures over the past 48 hours. After zooming into a 6-hour window, the analyst wants to see the events that occurred just before and after that window without losing the current zoom level. What should the analyst do?
Select an answer first
4foundation · easy
When interpreting the timeline, what does the width of each bar represent?
Select an answer first
5expert · hard
A SOC analyst is investigating a search for malware detection events over the past 30 days. The timeline shows a steady baseline of bars, but there is a single extremely tall bar on the 15th day. The analyst zooms into that day and sees that the tall bar is actually composed of two distinct peaks: one at 09:00 and one at 17:00. The analyst wants to compare the events from both peaks side by side to determine if they are related. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.