Creating and Managing Fields Mod 8 Flashcards

1
Q

What does Field Auto-Extraction do?

A

Splunk automatically discovers many fields based on source type and key/value pairs found in the data?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Prior to search time, some fields are already stored with the event in the index, what are those fields?

A
  • Meta fields: host, source, and sourcetype

- Internal fields: _time and _raw

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

At search time what does the field discovery do?

A

It discovers fields directly related to the search’s results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

True or False: Splunk may also extract other fields from raw event data that aren’t directly related to the search.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What allows you to extract your own fields in Splunk?

A

Using the Field Extractor (FX)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When should you use the Field Extractor (FX)?

A

Use Field Extractor (FX) to extract fields that are static and that you use often in searches

  • GUI
  • Extract fields from events using regex or delimiter
  • Extracted fields persist as knowledge objects
  • Can be shared and re-used in multiple searches
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can you access the Field Extractor?

A
  • Settings
  • Fields Sidebar
  • Event Acitons menu
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When should you use the Field Extraction method Regex?

A
  • use this option when your event contains unstructured data like a system log file
  • Field Extractor attempts to extract fields using a Regular Expression that matches similar events
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When should you use the Field Extraction method Delimiter?

A
  • use this option when your event contains structured data like a .csv file
  • the data doesn’t have headers and the fields must be separated by delimiters (spaces, commas, pipes, tabs, or other characters)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to do you get to Regex Field Extractions from settings?

A
  • settings
  • fields
  • Fields extractions
  • Open Field Extractor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

After you open up the Field Extractor for Regex what are the next steps?

A
  1. Select the Data Type
    - sourectype
    - source
  2. Select the source type
  3. Select a sample event by clicking on it
  4. Click Next >
  5. Select Regular Expression
  6. Click Next >
  7. Select the value(s) you want to extract
  8. Provide a field name
  9. Click Add Extraction
  10. Preview the sample events
  11. Click Next >
  12. Validate the proper field values are extracted
  13. Click Next >
  14. Review the name for the newly extracted fields and set permissions
  15. Click finish
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What events are included in the extraction?

A

Only events with the highlighted string are extracted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

True or False: An extractions name is provided by default.

A

True, however, this name can be changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do you edit a regex for Field Extraction?

A
  1. From Select Method, click Regular Expression
  2. Click Next >
  3. Select the field to extract
  4. Provide a field name
  5. Click Add Extraction
  6. Click show Regular Expression >
  7. Click edit the regular Expression
  8. Update the regular expression
  9. Click Save
  10. Review the extractions name and set permissions
  11. Click > Finish
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or False: After you edit the regular expression, you cannot go back to the Field Extractor UI.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When should you use Delimited Field Extractions?

A

Use delimited field extractions when the event log does not have a header and fields are separated by spaces, commas, or characters

17
Q

Delimited field extractions from settings.

A
  • Settings
  • Fields
  • Field Extractions
  • Open Field Extractor
18
Q

After opening field extractor what do you do next to finish?

A
  1. Select the data type
    - sourcetype
    - source
  2. Select the source type
  3. Select a sample event
  4. Click Next >
  5. Select Delimiters
  6. Click Next >
  7. Select the Delimiter used in your event
  8. Click the pencil icon next to the default field name
  9. Enter a new field name
  10. Click rename field
  11. Repeat these steps for all fields
  12. After all the fields are renamed, click Next>
  13. Name your extraction
  14. Click Finish>