Beyond Basic Search - Mod 1 Flashcards
What is this an example of?
Search for a single word (e.g., error) or group of words (e.g., error password)
This is an example of Keywords
NOT, OR, AND are what in the Splunk language?
Booleans
Must NOT, OR, AND booleans be uppercase?
Yes, these Booleans are always uppercase
Are phrases like “web error” different from “web AND error”?
Yes, these examples are different
OR is implied not AND
What are the rules for using Wildcards in Splunk’s search language?
Starting searches with a wildcard and adding Wildcards in the middle of the search string are inefficient ways to use Wildcards
Tailing wildcards are a best practice
What are the comparisons used in Splunk’s search language?
=, !=, ,>=
=, != are used in alphanumeric searches
This command returns a table containing only specified fields in result set.
table command
This command renames a field in results.
rename command
This command includes or excludes specified fields.
fields command
This command removes duplicates from results
dedup command
This command sorts results by specified field.
sort command
This command adds field values from an external source (e.g., csv files)
lookup command
What are some of the key/values that are case sensitive in Splunk?
Boolean operators (uppercase) Field names Field values from lookup (default, but configurable) Regular expressions eval and where commands Tags
Page 17 Mod 1
What are some of the key/values that are case insensitive in Splunk?
Command names Command clauses Search terms Statistical functions Field values
Page 17 Mod 1
As events come in, where does Splunk place them?
Into an index’s hot bucket (only writable bucket)
What is the transition that takes place as the buckets age in Splunk?
They roll from hot to warm to cold
What does each bucket have?
Its own raw data, metadata, and index files
What does the metadata keep track of?
Source, sourcetype and host
When you search, Splunk uses what to choose which buckets to search?
Time Range
Splunk uses the bucket indexes to find what?
Qualifying events
After time what are the most powerful keywords?
Host, source, and sourcetype
What makes searches more efficient?
Including as many search terms as possible
Page 20 Mod 1
What are some of the things a transforming command can do in Splunk?
- Massage raw data into a data table
- ‘Transforms’ specified cell values for each event into numerical values that you can use for statistical purposes
- Is required to ‘transform’ search results into visualizations
Commands Include
- top
- rare
- chart
- timechart
- stats
- geostats
Page 23 Mod 1
What are the transforming commands in Splunk?
- top
- rare
- stats
- chart
- timechart
- geostats
Page 23 Mod 1
What do non-transforming searches return using the Fast Mode?
Events - fields sidebar displays only those fields required for the search
- Patterns
- No statistics or visualizations
What does Fast Mode focus on?
Emphasizes performance, returning only essential and required data
What kind of search results do you get when using transforming searches in Fast Mode?
- Statistics and visualizations
- no Events
- no Patterns
What is the default search mode in Splunk?
Smart Mode
When searching in Smart Mode what kind of search results do you get with non-transforming searches?
Events - fields sidebar displays all fields
- Patterns
- no Statistics or visualizations
Which search mode gives you the best results for your search?
Smart Mode
How does Verbose Mode function?
Emphasized completeness by returning all possible field and event data
For transforming searches, what kind of results do you get using Smart Mode?
Statistics or visualizations
- no Events
- no Patterns
For non-transforming searches, what results do you get using Verbose Mode?
Event - fields sidebar displays all fields
Patterns
- no Statistics or visualizations
Using transforming searches, what results do you get with Verbose Mode?
Events
Patterns
Statistics or visualizations
?
Dense is a type of search. What are the attributes of Dense?
- a large percentage of the data matches the search
- use cases: computing stats, reporting
index=web sourcetype=access_combined
| timechart count
?
Sparse is a type of search. What are the attributes of Sparse?
- a small percentage of data matches the search
- use cases: troubleshooting, error analysis
index=web sourcetype=access_combined status=404 | timechart count
?
Super Sparse is a type of search. What are the attributes of Super Sparse?
- returns a small number of results from each index bucket matching the search
- I/0 intensive as the indexer looks through all of an index’s buckets
- with a lot of data, with a lot of buckets, it can take a long time to finish
index=network sourcetype=cisco_wsa_squid action=denied src_ip=10.2.3.11
?
Rare is a type of search. What are the attributes of Rare?
- the indexer checks all buckets to find results, but bloom filters eliminate those buckets that don’t include search results
- use cases: user behavior tracking
index=web sourcetype=access_combine sessionID=1234
?
What search type does this indexer throughput belong to:
Up to 50k matching EPS (events per second) CPU bound
Dense
?
What search type does this indexer throughput belong to:
Up to 5k matching EPS (events per second) CPU bound.
Sparse
?
What search type does this indexer throughput belong to:
Up to 2 seconds per index bucket I/0 bound
Super Sparse
?
What search type does this indexer throughput belong to:
Up to 10-50 index buckets/second I/0 bound
Rare
Search Job Inspector allows you to examine what Splunk?
- Overall stats of search (e.g., records processed and returned, processing time)
- How the search was processed
- Where Splunk spent its time
What is the Search Job Inspector used for?
Used to troubleshoot search’s performance and understand the impact of knowledge objects on processing (e.g., event types, tags, lookups)
Can any search job be inspected?
Only those that are not expired
The search job inspector has how many components and what are they?
It has 3 components and they are:
Header
Execution costs
Search job properties
Top of search jo inspector provides what kind of info?
Basic info along with time to run and number of events scanned.
What does Execution Costs provide?
Details on cost to retrieve results, such as:
- command.search.index
- command.search.filter
- command.search.rawdata
Time to search the index for the location to read in rawdata files
command.search.index
Time to filter out events that do not match
command.search.filter
Time to read events from the rawdata files
command.search.rawdata
