quiz 1 Flashcards
Machine data is always structured.
False
Machine data is only generated by web servers.
False
Machine data makes up for more than ___% of the data accumulated by organizations.
90%
index data
collect data from any source
search & investigate
data
add knowledge
label data for uniform
Which of these is not a main component of Splunk? earch and investigate
Collect and index data
Compress and archive
Add knowledge
Compress and archive
What are the three main processing components of Splunk?
Forwarders
Search Heads
Indexers
Which function is not a part of a single instance deployment? Clustering
Searching
Indexing
Parsing
Clustering
In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.
Forwarders
Search requests are processed by the ___________.
Indexers
from the splunk bar you can
switch between apps, edit account, view messages, edit configs, monitor search jobs, help
app bar
navigate system
what are transforming commands
commands that create statistics and visualizations
search job is active for
10 minutes
shared job good for
7 days
order of boolean
not, or, and
field values are case sensitive
false
wildcards can be used in field searches
yes
field names are
case sensitive
what attributes describe “a dest 4”
a means contains string values and 4 values
@ symbol does
round down. if 9:37, you will get results up until 9
different index examples
security data, web data
Having separate indexes allows:
Faster Searches.
Multiple retention policies
Ability to limit access
As a general practice, exclusion is better than inclusion in a Splunk search.
False
What is the most efficient way to filter events in Splunk?
by time
Time to search can only be set by the time range picker.
False
Time to search can only be set by the time range picker.
False
What command would you use to remove the status field from the returned events?
fields -
Finish the rename command to change the name of the status field to HTTP Status.
status as “HTTP Status”
Which command removes results with duplicate field values?
Dedup
Which one of these is not a stats function?
Addtotals Count List Sum Avg
Addtotals
A time range picker can be included in a report.
true
In a dashboard, a time range picker will only work on panels that include a(n) __________ search.
inline
The User role can not create reports.
false
_____________ are reports gathered together into a single pane of glass.
Dashboards
The instant pivot button is displayed in the statistics and visualization tabs when a _______ search is run
non-transforming
Data models are made up of ___________.
datasets
Adding child data model objects is like the ______ Boolean in the Splunk search language.
AND
These are knowledge objects that provide the data structure for pivot.
Data models
Pivots can be saved as dashboards panels.
True
A lookup is categorized as a dataset.
True
External data used by a Lookup can come from sources like:
CSV files
Scripts
Geospatial data
When using a .csv file for Lookups, the first row in the file represents this.
Field names
To keep from overwriting existing fields with your Lookup you can use the ____________ clause.
outputnew
Finish this search command so that it displays data from the http_status.csv Lookup file.
inputlookup
Alerts can run uploaded scripts.
True
Alerts can be shared to all apps.
True
Real-time alerts will run the search continuously in the background.
true
Alerts can send an email.
True
Once an alert is created, you can no longer edit its defining search.
False
Machine data makes up for more than ___% of the data accumulated by organizations.
90%
Which function is not a part of a single instance deployment?
clustering
Splunk uses ________ to categorize the type of data being indexed
source type
Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.
Source types
Which following search mode toggles behavior based on the type of search being run?
Smart
When a search is sent to splunk, it becomes a _____.
search jobs
Shared search jobs remain active for _______ by default.
7 days
Field names are ________.
case sensitive
Field values are case sensitive.
false
Time to search can only be set by the time range picker.
False
What is the most efficient way to filter events in Splunk?
By time.
Would the ip column be removed in the results of this search? Why or why not?
No, because the name was changed.
What command would you use to remove the status field from the returned events?
fields -
Excluding fields using the Fields Command will benefit performance.
false
Which clause would you use to rename the count field?
as
How many results are shown by default when using a Top or Rare Command?
10
_____________ are reports gathered together into a single pane of glass.
dashboards
inish this search command so that it displays data from the http_status.csv Lookup file.
inputlookup
