Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Power User Splunk > Beyond Basic Search - Mod 1 > Flashcards

Beyond Basic Search - Mod 1 Flashcards

1
Q

What is this an example of?

Search for a single word (e.g., error) or group of words (e.g., error password)

A

This is an example of Keywords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NOT, OR, AND are what in the Splunk language?

A

Booleans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Must NOT, OR, AND booleans be uppercase?

A

Yes, these Booleans are always uppercase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Are phrases like “web error” different from “web AND error”?

A

Yes, these examples are different

OR is implied not AND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the rules for using Wildcards in Splunk’s search language?

A

Starting searches with a wildcard and adding Wildcards in the middle of the search string are inefficient ways to use Wildcards

Tailing wildcards are a best practice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the comparisons used in Splunk’s search language?

A

=, !=, ,>=

=, != are used in alphanumeric searches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This command returns a table containing only specified fields in result set.

A

table command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This command renames a field in results.

A

rename command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This command includes or excludes specified fields.

A

fields command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This command removes duplicates from results

A

dedup command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This command sorts results by specified field.

A

sort command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

This command adds field values from an external source (e.g., csv files)

A

lookup command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some of the key/values that are case sensitive in Splunk?

A 
Boolean operators (uppercase)
Field names
Field values from lookup (default, but configurable)
Regular expressions
eval and where commands
Tags

Page 17 Mod 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are some of the key/values that are case insensitive in Splunk?

A 
Command names
Command clauses
Search terms
Statistical functions
Field values

Page 17 Mod 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

As events come in, where does Splunk place them?

A

Into an index’s hot bucket (only writable bucket)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the transition that takes place as the buckets age in Splunk?

A

They roll from hot to warm to cold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does each bucket have?

A

Its own raw data, metadata, and index files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the metadata keep track of?

A

Source, sourcetype and host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

When you search, Splunk uses what to choose which buckets to search?

A

Time Range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Splunk uses the bucket indexes to find what?

A

Qualifying events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

After time what are the most powerful keywords?

A

Host, source, and sourcetype

22
Q

What makes searches more efficient?

A

Including as many search terms as possible

Page 20 Mod 1

23
Q

What are some of the things a transforming command can do in Splunk?

A
  • Massage raw data into a data table
  • ‘Transforms’ specified cell values for each event into numerical values that you can use for statistical purposes
  • Is required to ‘transform’ search results into visualizations

Commands Include

  • top
  • rare
  • chart
  • timechart
  • stats
  • geostats

Page 23 Mod 1

24
Q

What are the transforming commands in Splunk?

A
  • top
  • rare
  • stats
  • chart
  • timechart
  • geostats

Page 23 Mod 1

25
Q

What do non-transforming searches return using the Fast Mode?

A

Events - fields sidebar displays only those fields required for the search

  • Patterns
  • No statistics or visualizations
26
Q

What does Fast Mode focus on?

A

Emphasizes performance, returning only essential and required data

27
Q

What kind of search results do you get when using transforming searches in Fast Mode?

A
  • Statistics and visualizations
  • no Events
  • no Patterns
28
Q

What is the default search mode in Splunk?

A

Smart Mode

29
Q

When searching in Smart Mode what kind of search results do you get with non-transforming searches?

A

Events - fields sidebar displays all fields

  • Patterns
  • no Statistics or visualizations
30
Q

Which search mode gives you the best results for your search?

A

Smart Mode

31
Q

How does Verbose Mode function?

A

Emphasized completeness by returning all possible field and event data

32
Q

For transforming searches, what kind of results do you get using Smart Mode?

A

Statistics or visualizations

  • no Events
  • no Patterns
33
Q

For non-transforming searches, what results do you get using Verbose Mode?

A

Event - fields sidebar displays all fields
Patterns
- no Statistics or visualizations

34
Q

Using transforming searches, what results do you get with Verbose Mode?

A

Events
Patterns
Statistics or visualizations

35
Q

?

Dense is a type of search. What are the attributes of Dense?

A
  • a large percentage of the data matches the search
  • use cases: computing stats, reporting
    index=web sourcetype=access_combined
    | timechart count
36
Q

?

Sparse is a type of search. What are the attributes of Sparse?

A
  • a small percentage of data matches the search
  • use cases: troubleshooting, error analysis
    index=web sourcetype=access_combined status=404 | timechart count
37
Q

?

Super Sparse is a type of search. What are the attributes of Super Sparse?

A
  • returns a small number of results from each index bucket matching the search
  • I/0 intensive as the indexer looks through all of an index’s buckets
  • with a lot of data, with a lot of buckets, it can take a long time to finish
    index=network sourcetype=cisco_wsa_squid action=denied src_ip=10.2.3.11
38
Q

?

Rare is a type of search. What are the attributes of Rare?

A
  • the indexer checks all buckets to find results, but bloom filters eliminate those buckets that don’t include search results
  • use cases: user behavior tracking
    index=web sourcetype=access_combine sessionID=1234
39
Q

?

What search type does this indexer throughput belong to:
Up to 50k matching EPS (events per second) CPU bound

A

Dense

40
Q

?

What search type does this indexer throughput belong to:
Up to 5k matching EPS (events per second) CPU bound.

A

Sparse

41
Q

?

What search type does this indexer throughput belong to:
Up to 2 seconds per index bucket I/0 bound

A

Super Sparse

42
Q

?

What search type does this indexer throughput belong to:
Up to 10-50 index buckets/second I/0 bound

A

Rare

43
Q

Search Job Inspector allows you to examine what Splunk?

A
  • Overall stats of search (e.g., records processed and returned, processing time)
  • How the search was processed
  • Where Splunk spent its time
44
Q

What is the Search Job Inspector used for?

A

Used to troubleshoot search’s performance and understand the impact of knowledge objects on processing (e.g., event types, tags, lookups)

45
Q

Can any search job be inspected?

A

Only those that are not expired

46
Q

The search job inspector has how many components and what are they?

A

It has 3 components and they are:
Header
Execution costs
Search job properties

47
Q

Top of search jo inspector provides what kind of info?

A

Basic info along with time to run and number of events scanned.

48
Q

What does Execution Costs provide?

A

Details on cost to retrieve results, such as:

  • command.search.index
  • command.search.filter
  • command.search.rawdata
49
Q

Time to search the index for the location to read in rawdata files

A

command.search.index

50
Q

Time to filter out events that do not match

A

command.search.filter

51
Q

Time to read events from the rawdata files

A

command.search.rawdata

Power User Splunk (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions