Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Power User 8.x > Module 12: Creating Data Models > Flashcards

Module 12: Creating Data Models Flashcards

1
Q

What is a Pivot use for?

A

Creating reports and dashboards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

As a knowledge manager, what are your responsibilities?

A

For building the data model that provides the datasets for Pivot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are Data Models?

A

Hierarchically structured datasets that generate searches and drive Pivot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are Pivot reports based on?

A

They are created based on datasets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How is each event, search or transaction saved when using Data Models?

A

They are saved as a separate dataset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A data model can consist of 3 types of datasets, what are they?

A
  • events
  • searches
  • transactions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does an event dataset contain?

A

Constraints and fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a constraint when using a data model?

A

Constraints are essentially the search broken down into a hierarchy. Basically search terms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are fields in a data model?

A

Fields are properties associated with the events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or False: Does each constraint inherit the parent search string?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Like constraints, fields are inherited from what object?

A

The parent object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you create a data model?

A
  • Settings
  • Data Models
    The ID is automatically populated from Title but can be overridden
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What do you add if you want to constraints in order to narrow down your search?

A

You should add child events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do you click in order to view the events that the constraint returns?

A

Click the Preview button

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do you add a Root Event?

A
  • Add field
  • Auto-Extracted
  • The inherited attributes are default fields
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When adding fields auto-extracted can?

A

Can be default fields or manually extracted fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When adding fields the eval expression is?

A

A new field based on an expression that you define

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When adding fields lookup can?

A

Leverage an existing lookup table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

When adding fields regular expression can?

A

Extract a new field based on regex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When adding fields Geo IP can?

A

Add geographical fields such as latitude/longitude, country, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are auto-extracted fields?

A

Fields that already exist for the constraint can be added as attributes to the data model

22
Q

What are the field types in data models?

A
  • String: field values are recognized as alpha-numeric
  • Number: field values are recognized as numeric
  • Boolean: field values are recognized as true/false or 1/0
  • IPV4: field values are recognized as IP addresses. This is an important field type, as at least one IPV4 attribute type must be present in the data model in order to add a Geo UP attribute
23
Q

What are the different options when using the field flags?

A
  • Optional: this field doesn’t have to appear in every event
  • Required: only events that contain this field are returned in Pivot
  • Hidden: this field is not displayed to Pivot users when they select the dataset in Pivot. Use the hidden option for fields that are only being used to define another field, such as an eval expression
  • Hidden&Required: only events that contain this field are returned, and the fields are hidden from use in Pivot
24
Q

Can you use an eval expression to define a new field?

A

Yes you can use an eval expression

25
Q

When adding a lookup as a field, how should you treat them?

A

Treat them as an automatic lookup

26
Q

What do you use to test your lookup field?

A

Use the preview to test your lookup settings and use the events and values tab to verify your results

27
Q

Can you define a new field using a regular expression?

A

Yes you can use a regular expression

28
Q

What do map visualizations require?

A

Latitude/Longitude fields

29
Q

When using the Geo IP lookup what must be configured?

A

At least one IP field must be configured as an IPv4 type

30
Q

While the map function isn’t available in Pivot, the data model can be called using the?

A

pivot command and

31
Q

When you are creating a new child dataset what should you give it?

A

Give it one or more additional constraints

32
Q

Child datasets inherit all fields from where?

A

Parent events and you can add more fields to child datasets

33
Q

How do you test the data model?

A
  • Click Pivot to access the select a dataset window

- choose an object from the selected data model to begin building the report

34
Q

True or False: Will the new Pivot window automatically populate with a count of events for the selected dataset?

A

True

35
Q

When using fields with Pivots how are the fields associated with each dataset?

A

As splits for rows or columns

36
Q

What is another way to filter events in the Pivot interface?

A

By using fields

37
Q

What are data model search datasets?

A

Arbitrary searches that include transforming commands to define the dataset that they represent

38
Q

Can search datasets also have fields?

A

Yes they can, by clicking the “Add Field” button

39
Q

What do data model transaction datasets do?

A

Enable the creation of datasets that represent transactions. Use fields that have already been added to the model using event or search datasets

40
Q

True or False: Can you add a transaction to the data model?

A

True

41
Q

After adding a transaction to a data model you can then add?

A

An eval expression or any other field (lookup, regular expression, GeoIP) to your transaction to further define the results.

42
Q

What are some of the things that you should consider when using Search and Transaction Datasets?

A
  • there must be at least one event or search dataset before adding a transaction dataset
  • search and transaction datasets cannot benefit from persistent data model acceleration
  • as you learn to create data models, consider the types of reports your users will run
43
Q

When a data model is created, the owner can determine access based on the following permissions:

A 
- Who can see the data models:
owner
app
all apps
- Which users can perform which actions (Read/Write)
everyone
power
user
admin-defined roles, if applicable
44
Q

What should you use the Splunk Web interface for?

A
  • download and upload data models
  • backup important data models
  • collaborate with other Splunk users to create/modify/test data models
  • move data models from a test environment to production instance
45
Q

An ___ supported browser must be used to download data models

A

HTML 5

46
Q

What does data model acceleration do?

A
  • Uses automatically created summaries to speed completion times for pivots
  • Takes the form of inverted time-series index file (tsidx) that have been optimized for speed
47
Q

What happens with persistent data model acceleration?

A

All fields in the model become “indexed” fields

48
Q

Only root events can be accelerated. If there are multiple root events, which one gets accelerated?

A

Only the first root event gets accelerated

49
Q

You must have one or the either in order to accelerate a data model?

A

Admin permissions or the accelerate_datamodel capability

50
Q

Can private data models be accelerated?

A

No, they cannot be accelerated

51
Q

Can accelerated data models be edited?

A

No, accelerated data models cannot be edited

Splunk Power User 8.x (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions