18.3 Splunk Reports and Alerts

Question 1

What are the three primary methods for accessing data in Splunk?

Answer 1

1. Monitoring logs from a system, device, or application that it has direct access to.
2. Forwarding logs from devices into Splunk.
3. Uploading logs directly into your Splunk repository.

Question 2

What is Splunk’s primray feature?

Answer 2

Searching

Question 3

Splunk uses ______ search.

Answer 3

Splunk uses time-based search

Question 4

Splunk has the ability to display search results in an easy-to-read format using the ______ feature.

Answer 4

Splunk has the ability to display search results in an easy-to-read format using the **Statistics** feature.

• Splunk uses the Statistics feature to display specific data points from your search results in a simple spreadsheet.
• The stats command is the most basic Splunk command to create a statistical report, though there are other commands and methods we can use to create statistical reports.

Question 5

The _____ command creates additional fields to be added to a statistical report.

Answer 5

The eval command creates additional fields to be added to a statistical report.

Question 6

Explain the follwong SPL query:

source=”statsreport.csv” | eval BruteForce = if(‘EventCode’=”4740”,”Potential Brute Force”, “Not Brute Force”)

Answer 6

• • source="statsreport.csv": Searches through all the results from the statsreport.csv file.
• eval BruteForce: Creates a new field called BruteForce.
• if('EventCode'="4740",: States the expression, If the event code field has a value of 4740.
• "Potential Brute Force",: Continues the statement with, If true, name this value Potential Brute Force. This is the value to display if the expression for the event is true.
• "Not Brute Force": Continues the statement with, If false, name this value Not Brute Force.

Question 7

The _____ and _____ commands can display data in an easy-to-consume format, similar to a spreadsheet.

Answer 7

The stats and top commands can display data in an easy-to-consume format, similar to a spreadsheet.