Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Advanced Power User > Fundamentals 3 > Flashcards

Fundamentals 3 Flashcards

1
Q

What the count aggregation function do?

A

Returns the number of occurrences of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What the dc aggregation function do?

A

Returns the count of distinct values of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What the sum aggregation function do?

A

Returns the sum of the values of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What the min aggregation function do?

A

Returns the minimum value of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What the max aggregation function do?

A

Returns the maximum value of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What the avg aggregation function do?

A

Returns the average of the values of field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What the median aggregation function do?

A

Returns the middle-most value of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What the range aggregation function do?

A

Returns the difference between the max and min values of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What the stdev (Standard Deviation) aggregation function do?

A

Returns the sample standard deviation of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What the var (Variance) aggregation function do?

A

Returns the sample variance of the field X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When aggregation functions are used?

A

When you want to summarize values from events into a single meaningful value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

These aggregation functions can be used with which commands?

A

stats, chart and timechart.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

All aggregation functions accept what type of fields?

A

Numeric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How to match a specific field value to be used on the count function?

A

Using eval, like count(eval(field=”value”))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When do you use phrases as names, how you need to call the field name on a eval expression?

A

Using single quotes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What the fieldsummary command do?

A

Calculate summary statistics for fields in your events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What the is_exact column on the fieldsummary result means?

A

If there are more values than returned in the distinct count, this is set to 0, if not, as a 1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In the fieldsummary, how many distinct values for a field will be returned? How it can be changed?

A

100, by using maxvals=X argument.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What the appendpipe command do?

A

It’s used to append a subpipeline search data to your results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What the list multivalue function do?

A

Returns a list of up to 100 values of the field X as a multivalue entry.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does the eventstats command do?

A

Generate statistics for fields in searched events and save into new fields on the results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does the streamstats command do?

A

Generate statistics for fields in searched events and save into new fields on the results, but in a stream manner, in a per-event basis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What the current argument of streamstats do?

A

Include the current event in the sum, default is True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What the window argument of streamstats do?

A

Specifies the number of events to use when computing the statistics. Default is 0 (all)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What the time_window argument of streamstats do?

A

Specify the time windows which the sum is done. Falt is None.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which are the three main arguments of streamstats?

A

current, window and time_window.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the three types of operations that can be done with eval?

A

Arithmetic, concatenation and Boolean.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What will happen to numbers that are concatenated?

A

They will be in the string form.

29
Q

What are the three functions to conversion for the eval command?

A

tostring(), tonumber() and printf().

30
Q

What the tostring() do?

A

Cast a value to a string.

31
Q

What the tonumber() do?

A

Cast a value to a number.

32
Q

What the printf() do?

A

Enable you to build a string using formating and optional arguments.

33
Q

With which commands tostring(), tonumber() and printf() works?

A

eval, fieldformat and where.

34
Q

What are the eval functions for calculating date and time?

A

now(), time(). strftime(), strptime() and relative_time()

35
Q

What the now() function of eval do?

A

Returns the time that the search is started.

36
Q

What the time() function of eval do?

A

Return the time an event was processed by the eval command

37
Q

What the strftime() function of eval do?

A

Convert an epoch into a time string.

38
Q

What the strptime() function of eval do?

A

Convert a time string into an epoch.

39
Q

What the relative_time() function of eval do?

A

Return a timestamp relative to specified time.

40
Q

What are the text funtions of eval command?

A

upper(), lower(), substring() and replace().

41
Q

What the upper() and lower() functions of eval command do?

A

Change string case.

42
Q

What the substr() function of eval command do?

A

This function returns a substring of X, starting at the index specified by Y with the number of characters specified by Z. If Z is not provided, the function returns the rest of the string.

43
Q

What the replace() function of eval command do?

A

This function returns a string formed by substituting string Z for every occurrence of regex string Y in string X. The third argument Z can also reference groups that are matched in the regex.

44
Q

What are the conditional functions of eval command?

A

if(), case(), coalesce(), match(), cidrmatch(), true(), false(), nullif(), isbool(), isint(), isnotnull(), isnull(), isnum(), isstr() and typeof().

45
Q

How many arguments the if function have? Which are they?

A

3 arguments: (bool expression, argument_to_return_true, argument_to_return_false)

46
Q

What is the case of using case instead of if?

A

When we need to validate Multiple values.

47
Q

What the coalesce() function of eval do?

A

Takes a list of arguments, and return to the new field, the first value that is not NULL.

48
Q

How the match() function of eval work?

A

It takes two arguments, a value and a regex, if the regex matches the value, it returns True.

49
Q

How the cidrmatch() function of eval works?

A

It takes two arguments, a CIDR string and a IP value to compare with, if the CIDR matches with the IP, it returns True.

50
Q

What are the eval statistic functions?

A

min(), max() and random()

51
Q

What is a subsearch?

A

A subsearch is a search enclosed square brackets that pass results to the outer searches.

52
Q

What the where command does?

A

Uses eval expressions to filter results.

53
Q

What does the fieldformat command do?

A

Change the format of a field value.

54
Q

What does the makeresults command do?

A

Is a generating command that will create a defined number of search results, can be used for testing data that is not ingested yet or to build data that will be used on other searches.

55
Q

How lookups are invoked?

A

Using the lookup command

56
Q

In which file a kv store is defined?

A

At the local directory of the app, in the collections.conf file.

57
Q

How KV store is populated?

A

By posting JSON on Splunk’ REST API or outputlookup command.

58
Q

What does the outputlookup command do?

A

Allows writing results from a search into a lookup file or a KV store collection, overwriting existing content in lookup files.

59
Q

What are the types of lookups?

A

File-based, External, KV Store, Geospatial and dbconnect lookups.

60
Q

As a best practice, where to place the lookup?

A

At the end of the search.

61
Q

How lookups can be created from alerts?

A

Using the “Output results to lookup option” in Alert Actions.

62
Q

What role is required to log events from alerts?

A

admin or edit_tcp.

63
Q

Splunk is based on which programming language Regex?

A

Perl

64
Q

What the erex command do?

A

Extract data from a field when you do not know the regular expression to use.

65
Q

What the rex command do?

A

Matches the value of the specified field against the unanchored regular expression and extracts the named groups into fields of the corresponding names.

66
Q

What is regex backtracking?

A

Backtracking occurs when a regular expression pattern contains optional quantifiers or alternation constructs, and the regular expression engine returns to a previously saved state to continue its search for a match.

67
Q

What is Self-Describing data?

A

Is data that includes the schema embedded into data.

68
Q

Which formats are examples of Self-Describing data?

A

JSON, XML.

69
Q

What does the spath command do?

A

Enables you to extract information from the structured data formats XML and JSON. The command stores this information in one or more fields. The command also highlights the syntax in the displayed events list.

Splunk Advanced Power User (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions