A Splunk analyst is investigating a search for payment gateway errors over the last 72 hours. The timeline shows a large cluster of bars between 18:00 and 20:00 each evening. The analyst zooms into the 18:00–20:00 window on Tuesday and sees that the cluster is actually a series of small spikes. The analyst wants to see the events from 18:30 to 19:00 on Tuesday, but also wants to maintain the ability to quickly return to the 72-hour view to check if the pattern repeats on other days. What is the best workflow?

Select the 18:30–19:00 range on Tuesday and click Zoom to selection, then use the Reset button to return to the 72-hour view when needed.

Click on the bar at 18:45 on Tuesday and then click the Zoom to selection button.

Change the time picker to 'Last 30 minutes' and re-run the search to see the 18:30–19:00 window.

Use the pan controls to slide the timeline to 18:30–19:00 on Tuesday, then click the Zoom to selection button.

A Splunk user is investigating a search for database connection errors over the last 7 days. The timeline shows a repeating pattern of tall bars every day at 12:00. The user wants to see only the events from 11:45 to 12:15 on Wednesday to check if a specific deployment caused the spike. What is the most direct way to accomplish this?

Click on the tall bar at 12:00 on Wednesday and then click the Zoom to selection button.

Drag across the timeline to select the 11:45–12:15 range on Wednesday, then click the Zoom to selection button.

Change the time picker to 'Last 30 minutes' and re-run the search.

Use the pan controls to center Wednesday 12:00 on the timeline, then click the Zoom to selection button.

A help desk analyst is reviewing a search for VPN connection failures over the last 3 days. The timeline shows a cluster of tall bars between 08:00 and 10:00 each morning. The analyst wants to see only the events from 08:30 to 09:00 on Tuesday to identify the specific users affected. What should the analyst do?

Click and drag on the timeline to select the 08:30–09:00 range on Tuesday, then click the Zoom to selection button.

Use the pan controls to move the timeline so Tuesday 08:30 is centered, then click the Zoom to selection button.

Click on the tallest bar in the Tuesday cluster and then click the Zoom to selection button.

Change the time picker to 'Last 30 minutes' and re-run the search.

How can you zoom in on a specific time range using the timeline in Splunk?

Type a time range in the search bar

Use the scroll wheel over the timeline

Double-click on the tallest bar

Click and drag across the desired time range on the timeline

SplunkCore Certified User

Domain 2Objective 5

Use the Timeline SPLK-1001 Practice Questions (Page 3)

Part of the Basic Searching domain, which accounts for 22% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

5concepts

22%of the exam

Questions 11–15

11expert · hard
A Splunk analyst is investigating a search for payment gateway errors over the last 72 hours. The timeline shows a large cluster of bars between 18:00 and 20:00 each evening. The analyst zooms into the 18:00–20:00 window on Tuesday and sees that the cluster is actually a series of small spikes. The analyst wants to see the events from 18:30 to 19:00 on Tuesday, but also wants to maintain the ability to quickly return to the 72-hour view to check if the pattern repeats on other days. What is the best workflow?
Select an answer first
12application · medium
A Splunk user is investigating a search for database connection errors over the last 7 days. The timeline shows a repeating pattern of tall bars every day at 12:00. The user wants to see only the events from 11:45 to 12:15 on Wednesday to check if a specific deployment caused the spike. What is the most direct way to accomplish this?
Select an answer first
13application · medium
A help desk analyst is reviewing a search for VPN connection failures over the last 3 days. The timeline shows a cluster of tall bars between 08:00 and 10:00 each morning. The analyst wants to see only the events from 08:30 to 09:00 on Tuesday to identify the specific users affected. What should the analyst do?
Select an answer first
14foundation · easy
In the Splunk Search app, which component of the search results page provides a visual representation of how events are distributed over time?
Select an answer first
15foundation · easy
How can you zoom in on a specific time range using the timeline in Splunk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.

Use the Timeline SPLK-1001 Practice Questions (Page 3)

Questions 11–15

In the Splunk Search app, which component of the search results page provides a visual representation of how events are distributed over time?

How can you zoom in on a specific time range using the timeline in Splunk?

Keep studying — Basic Searching