Use the Chart Command SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A dashboard developer wants to create a stacked column chart showing the count of errors by error code, split by the server name. The search is `index=errors | chart count by error_code, server_name`. The chart renders, but the developer notices that the columns are not stacked as expected. What is the most likely reason?

   • AThe chart command is limited to 10 columns, so the server columns are being truncated
   • BThe chart command produces a table where each server is a separate column, and the visualization needs to be configured as stacked in the dashboard XML
   • CThe count function cannot be used with stacked charts
   • DThe error_code field has too many distinct values, preventing stacking
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   A Splunk search returns a chart command that produces a table with many rows. Which chart command option would you add to restrict the number of rows returned in the results table?

   • Alimit
   • Bformat
   • Cusenull
   • Dcount
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which chart command function returns the number of distinct values for a specified field?

   • A| chart dc(user_id)
   • B| chart values(user_id)
   • C| chart sum(user_id)
   • D| chart count(user_id)
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Splunk admin is troubleshooting a dashboard panel that shows a line chart of the count of events over time, split by event type. The search is `index=main | chart count by _time, event_type`. The chart renders, but the x-axis shows only a few time buckets instead of a continuous time series. What is the most likely cause?

   • AThe chart command is limited to 10 results by default, so only a few time buckets are shown
   • BThe event_type field has too many distinct values, causing the chart to collapse time buckets
   • CThe _time field is being treated as a categorical field rather than a time field in the chart command
   • DThe count function is not compatible with time-based charts
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A DevOps engineer wants to create a chart showing the 95th percentile of response time per service. The fields are `service_name` and `response_time`. Which search correctly calculates the 95th percentile?

   • Aindex=api | chart avg(response_time) by service_name
   • Bindex=api | chart p95(response_time) by service_name
   • Cindex=api | chart percentile(response_time, 95) by service_name
   • Dindex=api | chart max(response_time) by service_name
   Reveal Solution Discussion Select an answer first