Splunk Flashcards
Fundamentals 1 and 2
Machine data is always structured.
False
Machine data makes up for more than _____% of the data accumulated by organizations.
90
Machine data can give you insights into:
Application performance Security Hardware monitoring Sales User Behavior
Machine data is only log files on web servers.
False
Which of these is NOT a main component of Splunk?
compress and archive
The index does not play a major role in Splunk.
False
Data is broken into single events by:
in a consistent format.
Which role defines what apps a user will see by default?
Admin
Which two apps ship with Splunk Enterprise?
Search & Reporting
Home App
There are ______ components to the Search and Reporting app’s default interface.
7
What is the most efficient way to filter events in Splunk?
reverse chronological order
Commands that create statistics or visualizations are called ____________.
transforming commands
The Search & Reporting App has how many search modes?
3
Which character acts as a wildcard in the Splunk Search Language?
*
What are Boolean operators in Splunk?
…
Which is not a comparison operator in Splunk?
&=
Field names are _____________.
case sensitive
What could be said of the circled field below:
A dest 4
it contains four values
its was extracted at search time
it contains string values
After a report is saved, you can no longer edit the search.
False
Search commands can be used with search terms to do the following:
Create charts
Compute statistics
Format data
If we want to see events after running a transforming command, we need to switch to this mode.
Verbose
Any search that returns these values can be viewed as a chart.
Statistical
Charts can be based on numbers, time or location.
True
________ are searches gathered together in a single pane of glass.
Dashboards
An alert is an action triggered by a ____________.
saved search
Alerts can send an email.
True
These are knowledge objects that provide the data structure for pivot.
data models
Which roles can create data models?
Admin and Power
You can think of adding child data model objects as an _________ Boolean in the Splunk search language.
AND
The instant pivot button is displayed in the statistics and visualization tabs when a _______ search is used.
non-transforming
Unlike pivot, reports created with instant pivot can not be saved.
False
Splunk breaks data into ___________.
events
Field values are _______.
case insensitive
Which 2 apps ship with Splunk Enterprise?
Search & Reporting
Home App
These searches will return the same results?
password fail
“password fail”
False
Which is not a comparison operator in Splunk?
OR
Data is broken into single events by:
sourcetype
Which is not a comparison operator in Splunk?
%=
A time range picker can be included in a report.
True
Charts can be based on numbers, time or location.
True
Which of these is not a main component of Splunk?
Compress and archive
The index does not play a major role in Splunk.
False
Admin, Power, User
Out of the box there are 3 main roles
How can you view all sourcetypes?
Click Data Summary in the Searching & Reporting app
What is shown in the Data Summary?
Host, Sources, and Sourcetypes on separate tabs
What timezone is data displayed for, in searches?
The local timezone set in your profile.
Search terms are case sensitive or insensitive?
insensitive
AND, OR, NOT
What booleans are supported in splunk search?
Symbol for “does not equal”
!=
In what chronological order are events displayed, after a search?
Reverse chronological order (newest first)
Each event has these field value pairs.
timestamp, host, source, sourcetype
Time range abbreviations for seconds
s
Time range abbreviations for minutes
m
Time range abbreviations for hours
h
Time range abbreviations for days
d
Time range abbreviations for weeks
w
Time range abbreviations for months
mon
Time range abbreviations for year
y
What are the commands for specifying a time range in a search string?
earliest and latest
eg: earliest=-h latest=@d
Does narrowing the time range by dragging the selection bars across the timeline re-execute the search?
No, it only filters the results
What formats may search results be exported to?
CSV, XML, JSON
What does “event sampling” do?
Instead of returning all the results, from a search, it returns a random sampling of events.
What does an event sample of 1:100 indicate?
Each event, found in a search, has a 1 in 100, or 1% change of being included in the sample result set.
What is a Field?
searchable key/value pairs from event data.
How does Splunk discover fields?
Based on sourcetype and key/value pairs found in the data.
What percentage of search results have the fields listed under “Interesting Fields”?
20% of events have these fields present in them.
What are the three search modes?
Fast, Smart, Verbose
What is the default search mode?
Smart
Field names are case sensitive or insensitive?
Case sensitive
True/False: Splunk is subnet/CIDR aware for IP fields?
True
How does NOT affect search results?
Returns everything except the events matching the NOT boolean
What is a dashboard?
One or more panels displaying data visually in a useful way.
What command changes the name of a field in search?
rename
When should quotes be used around values in search?
When including spaces or special characters
What command allows you to include/exclude fields in your search?
fields
What is the difference between +/- with the fields command?
+ (include) occurs before field extraction and improves performance
- (exclude) occurs after field extraction, and no performance improvement
How can you reduce the returned results with the sort command?
The limit option
e.g: | sort limit=20 -categoryID, product_name
What command finds the most common values of a given field?
top
How many results are returned by the top command, by default?
10
What two columns are automatically returned by the top command?
count & percent
What option changes the number of results returned by the top command?
limit (limit=0 returns unlimited results)
What command returns the least common field values?
rare
What command allows you to calculate statistics on data that matches your search criteria?
stats
What option allows you to rename fields, within the stats command?
as
What stats command shows all field values for a given field?
list
What stats command shows all unique field values for a given field?
values
To get multi-series tables you need to set up the underlying search with commands like…
chart or timechart
What are the seven chart types?
line, area, column, bar, bubble, scatter, pie
What eval command allows you to format for currency?
tostring
What command allows you to create a single event from a group of events that share the same value in a given field?
transaction
Max events displayed by transaction command
1,000
What is the transforms.conf flag to switch whether or not a lookup field value is case-sensitive or not?
case_sensitive_match
What is a way to normalize data over any default field?
Field Aliases
What are nicknames that you create for related field/value pairs?
Tags
Where can you view a list of all Tags?
Settings > Tags > List by field value pair
A method of categorizing events based on a search
Event Type
What may be run from an event in your search results to interact with external resources or run another search?
Workflow Actions
Workflow action to pass information to an external web resource.
GET
Workflow action to send field values to an external resource.
POST
Workflow action to use field values to perform a secondary search.
Search
Macros must be surrounded with what character?
backticks
What tool provides a methodology to normalize data?
Common Information Model (CIM)
Which search will return the same events as the search in the searchbar?
password failed
password AND failed
What is the most efficient way to filter events in Splunk?
By time.
Which is not a comparison operator in Splunk?
?=
How is the asterisk used in Splunk search?
As a wildcard
As general practice, inclusion is better than exclusion in a Splunk search.
True
What command would you use to remove the status field from the returned events?
fields -
Finish the rename command to change the name of the status field to HTTP Status.
sourcetype=access* status=404 | rename ______
status as “HTTP Status”
Would the clientip column be removed in the results of this search? Why or why not?
sourcetype=access* | rename clientip as “user” | table user status | fields - clientip
No, because the name was changed.
What is missing from this search?
sourcetype=acc* status=404 | rename clientip as “User ID” | table USer ID status host
Quotation marks around User ID
Which command removes results with duplicate field values?
Dedup
To display the most common values in a specific field, what command would you use?
sourcetype=vendor_sales | ______ Vendor
top
How many events are shown by default when using the top or rare command?
10
Finish this search to return unlimited results.
sourcetype=access_combined action=purchase | rare product_name _________
limit=0
Which of these is NOT a stats function?
addtotals
Which clause would you use to rename the count field?
sourcetype=vendor_sales | stats count(linecount) ______ “Units Sold”
as
Which stats function would you use to find the average value of a field?
avg
If a search returns this, you can view the results as a chart.
Statistical values
When using the chart command, the x-axis should always be numeric.
False
The timechart command clusters data in time intervals dependent on:
Time range selected
Finish this search to remove any results that do not contain a value in the product_name field.
sourcetype=access_c* status>299 | chart count over host by product_name _______
usenull=f
When using the search below, what axis would time be on?
sourcetype=vendor_sales | timechart count(linecount)
x
The Trendline Command requires this many arguments:
3
In the following search, what should the empty argument contain?
sourcetype=linux_secure | iplocation ______
An IP address.
The Geostats Command requires both latitude and longitude data to use on a map.
True
Data created using the Iplocation Command can not be used with the Geostats Command.
False
Which command do you use when creating a choropeth map?
geom
Which Splunk search command allows you to perform mathematical functions on field values?
Eval
Which is the correct argument order when using the eval if function?
if (Boolean, Is True, Is False)
If you want to format values without changing their characteristics, which would you use?
The Fieldformat Command.
By default, the Fillnull Command replaces null values with this:
0
You can only use one Eval Command per search.
False
This command allows you to correlate related events on a field or list of fields that span time.
transaction
Which of these is NOT a field created with the transaction command?
maxcount
__________ should be used when you want to see the results of a calculation, or you need to group events on a field value.
Stats
_________ should be used when you need to see events correlated together, or when events need to be grouped on start and end values.
Transactions
What should you use with the transaction command to set the maximum total time between the earliest and latest events returned.
maxspan
This stats function will return unique values for a given field.
Value
Results of the Eval Commands always replace the existing field.
False
Which roles can create Private Knowledge Objects?
User, Power, Admin
Which roles can create knowledge objects shared across all apps?
Admin
Knowledge objects can be used to normalize data?
True
A Common Information Model (CIM) is supported by Splunk.
True
What are the predefined ways knowledge objects can be shared?
All apps
Private
Specifiic App
When using a .csv file for lookups, the first row in the file represents this.
field names
Which is the correct order to use when creating a lookup?
Define a lookup table
Define a lookup
Create and automatic lookup
Finish this search command so that it displays data from the http_status.csv lookup file.
__________ http_status.csv
inputlookup
Finish this search so that it uses the http_status.csv lookup to return events.
sourcetype=access_c* NOT status=200 | _________ http_status code as status
lookup
You can only have one field alias per field.
False
Field Aliases ___________________
Can be referenced by lookup tables.
Are applicable to a specified app context.
Make correlation easier.
Calculated fields are shortcuts for _______________.
Eval Commands
Calculated fields can use lookup tables.
False
The easiest way to extract a field is from ____________, allowing you to skip a few steps.
The event actions menu
When editing a field extraction, you will be working with _________________.
The regular expression.
You can extract multiple fields with the field extractor.
True
______________ is a field extraction method for events that contain fields separated by a character.
delimiter
Fields extracted with the field extractor
Are persistent
Are specific to a host, source or sourcetype.
Are reusable in multiple searches.
You can only add one tag per field value pair.
False
Which search would limit an “alert” tag to the “host” field?
tag::host=alert
__________ allow you to categorize events based on search terms.
Event Types
Tags can be added to event types.
True
Event types do NOT show up in the field list.
False
Splunk suggests naming your Knowledge Objects using _______ segmented keys.
6
A workflow action can _________________.
Send field values to external resources.
Pass variables to a URL.
Execute a secondary search.
This workflow action sends field value to external resources.
POST
This workflow action passes variables in a URL.
GET
To escape the “fieldname” value which command would you use? $_________fieldname$
!
____________ are based on searches that run on a scheduled interval or in real-time.
Alerts
Which actions can be triggered by an alert?
List in triggered alerts
Send Email
Run a script
Alerts can be shared to all apps.
True
Once an alert is created, you can no longer edit its defining search/
False
A real-time alert type is useful when you want to know as soon as your trigger condition is met.
True
Search Macros _______________
Allow you to store entire search strings, including pipes and eval statements.
Are time range independent.
Can pass arguments to the search.
What is the proper syntax for using a macro called “dostuff”
sourcetype=gamelog |
‘dostuff’
You can pipe the results of a Macro to other commands.
True
What is the correct way to name a macro with two arguments?
dostuff(2)
Validating macro arguments can be done with which type of command?
Add a root object
Root search objects benefit from acceleration.
False
_________ objects can be added to a root event object to narrow down the search.
Child
What attributes can be added to an object?
Auto-Extracted Eval Expression Lookup Regular Expression Geo IP
You can add additional child objects to either existing objects or the root object.
True
After you configure a lookup, its fields can be found in the fields sidebar and you can use them in a search.
True
No matter what user role creates the field alias, it is always set to Private by default.
True
Running concurrent reports and the searches behind them puts very low demand on your system hardware.
False
Search macros can only be used once in a given search.
False
The results of a macro can not be piped to other commands.
False
When building your data model, Splunk suggests you use root search objects whenever possible.
False
What are the 3 main processing components of Splunk?
Forwarders
Indexers
Search Heads
Raw data in an index is stored in a ________ form.
compressed
Forwarders are typically installed on _____________.
Machines where the data originates
The ___________ handle search management while ___________ perform the searches.
- search heads
2. indexers
A group of indexers configured to replicate each other’s data is called a ________.
Index Cluster
__________ is often the biggest bottle neck in the Splunk indexing pipeline.
Disk I/O
Search heads do not require as much ______ as indexers but require more _________.
- disk space
2. CPU power
Adding more machines no matter the hardware will make your deployment perform better.
False
Splunk indexers and Search Heads on virtual machines should have ____ of the vCPU reserved to them.
100%
Keeping ____ synchronized across your deployment, makes sure events are returned in the proper order.
time
What command is used to start the Splunk Enterprise server?
./splunk start
This command can be used to make Splunk start each time the server is booted.
./splunk enable boot-start
When logging into Splunk Enterprise for the first time, a username of ______ and a password of are used.
- admin
2. changeme
The _______ folder inside the Splunk Enterprise installation directory contains licenses and configuration files.
etc
Splunk Enterprise commands are executed from the ________ directory.
bin
The following are Splunk Enterprise processing tiers.
Data input
Indexing
Search Management
Event separation happens during the ________ segment of the data pipeline.
parsing
Events are written to disk during the _______ segment of the data pipeline.
Indexing
The functions of the data pipeline vary drastically depending on the deployment.
False
Splunk Enterprise licenses specify how much data you can index per __________.
day
Any editing done to .conf files should be done in the ________ directory.
local
The ________ index is used when an index is not specified at input time.
main
Having multiple indexes allows:
Faster searches
Access limiting
Multiple retention policies
As data is input into Splunk Enterprise, it is first placed into a ________ bucket.
hot
Some differences between hot and warm buckets are:
Hot buckets are writable, warm buckets are not.
Hot buckets are searched first.
The naming convention.
When a bucket is frozen, by default it is moved to a different location before deleting.
False
The timezone setting in a user’s account will effect the timestamp shown in events.
True
_______________ define what users can do in Splunk.
Roles
Only the ________ role can use the Delete Command by default.
can_delete
The ______ role has the most capabilities of the predefined splunk roles.
admin
When mixing authentication sources, scripted authentication will always take precedence.
False
In most production environments, _______ will be used as your main source of data input.
forwarders
Splunk uses ____________ to categorize the type of data being indexed.
sourcetypes
The server that data is forwarded to is called the ______________.
receiver
Indexing on a Heavy Forwarder does not affect your license.
False
The following can be used to build apps for Splunk:
Simple XML
Splunk JavaScript
SDKs
When migrating from a single instance deployment to a distributed environment, you will want to use the existing instance as an _______.
indexer
An indexer in a distributed search environment is called a __________.
search peer
It is a best practice to ____________ forwarders across all indexers in a search peer group.
load balance
The management port is required when adding a search peer to a search head.
True
DMC stands for
Distributed Management Console
In most Splunk deployments, _________ serve as the primary way data is supplied for indexing.
forwarders
Search strings are sent from the
Search head
Forwarders are typically installed on __________
Machines where the data originates
A server acting as a ___________ require the same hardware as a single deployment server.
Indexer
Splunk Enterprise can be installed virtual environments.
True
In a windows environment, a local system user will have access to:
all data on the local system
Search requests are processed by the ____________.
Indexer
____________ is the system process that handles indexing, searching, forwarding and the web interface for Splunk Enterprise.
Splunkd
Splunk Enterprise should always be run as root in a *NIX environment.
False
It is suggested that you have a single deployment instance available for _________.
testing and development
A total of ____ cores are recommended per search head.
16
This component is NOT installed from the Splunk Enterprise Package.
Universal Forwarder
Splunk Enterprise deployment typically has ___ processing tiers.
3
The segment of the data pipeline that stores user’s knowledge objects is the _______ segment.
indexing
Any editing done to .conf files should be done in the _____ directory.
local
The default management port for Splunkd is:
8089
Search Heads require more _____ than indexers.
CPU Power
The .conf files can only be edited using the Splunk web interface.
False
Event separation happens during the __________ segment of the data pipeline.
parsing
Events are written to disk during the ____ segment of the data pipeline.
indexing
A license violation causes all data to stop being indexed.
False
The functions of the data pipeline vary drastically depending on the deployment.
False
Parsing and Indexing are both part of the ____ processing tier.
Indexing
You can click a search term in the results to add it to the search class.
True
The Splunk search language supports the ? wildcard.
False
Using the export function, you can export an unlimited number of results.
True
Field NAMES are case sensitive
True
This search user=* displays only events that contain a value for user
True
The following searches will return the same results: SEARCH 1: web AND error SEARCH 2: web and error
False
Field names are case…
sensitive
Use this command to exclude fields used in the search to make the results easier to read.
fields -
These users can create objects that are shared across ALL apps
admin
Machine data is always structured
False
Machine data makes up __% of the data accumulated by organizations
90
Machine data is only log files on web servers
False
The index does not play a major role in Splunk
False
Data is broken into single events by ___
Sourcetype
Time stamp are stored ____
in a consistent format
which role defines what apps a user will see by default
admin
which two apps ship with Splunk Enterprise
Search & Reporting, Home App
What is the most efficient way to filter events in Splunk?
By time
When search is run, events are returned in ____
reverse chronological order
which is not a valid option when editing a report?
Rename
Wildcards can be used with field value searches
True
A power user can allow read/write permissions on a report
True
If we want to see events after running a transforming command, we need to switch to this mode.
Verbose
Charts can be based on numbers, time or location
True
_____ are searches gathered together into a single pane of glass
Dashboards
Pivots can not be saved as reports or dashboard panels
False
The instant pivot button is displayed in the statistics and visualization tabs when a ____ search is used
non-transforming
These are knowledge objects that provide the data structure for pivot
Data models
You can think of adding child data model objects as an ___ boolean in the Splunk search engine
AND
Unlike pivot, reports created with instant pivot can not be saved.
False
which role can create data models?
admin
Splunk breaks down data input into individual ___
events
From the search jobs page, you can click the job link to ___
view the results of the instance of that search
Fields are searchable key/value pairs
True
Field have names
True
Default Fields are added to every event
True
Administrators CANNOT configure default fields
True
The interesting fields in the field sidebar will be the same for every search against the same index
False
Interesting fields are those that have values in over 20% of events
True
which search mode returns all event and field data?
verbose mode
Select this in the field sidebar to automatically pipe your search results to the timechart command
top values by time
How can you view all sourcetypes?
Click Data Summary in the Searching & Reporting app
What is shown in the Data Summary?
Host, Sources, and Sourcetypes on separate tabs
What timezone is data displayed for, in searches?
The local timezone set in your profile.
Search terms are case sensitive or insensitive?
insensitive
What booleans are supported in splunk search?
AND, OR, NOT
Symbol for “does not equal”
!=
Current search time is 09:37:12. What is the time range equation to search back 5 minutes on the minute?
-5m@m
What are the commands for specifying a time range in a search string?
earliest and latest
eg: earliest=-h latest=@d
Does narrowing the time range by dragging the selection bars across the timeline re-execute the search?
No, it only filters the results
How does Splunk discover fields?
Based on sourcetype and key/value pairs found in the data.
What is the default search mode?
Smart
True/False: Splunk is subnet/CIDR aware for IP fields?
True
When should quotes be used around values in search?
When including spaces or special characters
What command allows you to include/exclude fields in your search?
fields
How can you reduce the returned results with the sort command?
The limit option
e.g: | sort limit=20 -categoryID, product_name
What command returns the least common field values?
rare
What command allows you to calculate statistics on data that matches your search criteria?
stats
What option allows you to rename fields, within the stats command?
as
What stats command shows all field values for a given field?
list
What stats command shows all unique field values for a given field?
values
To get multi-series tables you need to set up the underlying search with commands like…
chart or timechart
What is the transforms.conf flag to switch whether or not a lookup field value is case-sensitive or not?
case_sensitive_match
Where can you view a list of all Tags?
Settings > Tags > List by field value pair
A method of categorizing events based on a search
Event Type
True/False. Machine data is always structured.
False
True/False. Machine data is only generated by web servers.
False
What are the three main processing components of Splunk?
Indexers, Forwarders, Search Heads
What are search requests processed by?
Indexer
Which function is not a part of a single instance deployment?
Clustering
In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.
Forwarders
What does a single-instance deployment of Splunk Enterprise handle?
Input, Parsing, Indexing, and Searching
_________ define what users can do in Splunk.
Roles
This role will only see their own knowledge objects and those that have been shared with them.
User
Splunk uses ________ to categorize the type of data being indexed.
source type
True/False. The monitor input option will allow you to continuously monitor files.
True
Files indexed using the the upload input option get indexed _____.
once
Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.
Source types
In most production environments, _______ will be used as your the source of data input.
forwarders
Which following search mode toggles behavior based on the type of search being run?
Smart
True/False. The time stamp you see in the events is based on the time zone in your user account.
True
Having separate indexes allows:
Multiple retention policies, ability to limit access, and faster searches.
True/False. Time to search can only be set by the time range picker.
False
This symbol is used in the “Advanced” section of the time range picker to round down to nearest unit of specified time.
@
As a general practice, exclusion is better than inclusion in a Splunk search.
False
True/False. Excluding fields using the Fields Command will benefit performance.
False
Would the ip column be removed in the results of this search? sourcetype=a* | rename IP as “User” | fields - ip
No, because the name was changed.
Which command removes results with duplicate field values?
dedup
What command would you use to remove the status field from the returned events? sourcetype=a* status=404 | ________ status
fields -
How would you show the top five vendors without showing the percentage field?
… | top Vendor limit=5 showperc=f
How would you show the top five vendors, rename the count field to “Number of Sales”, and add a row for the number of sales of vendors not listed in the top five?
… | top Vendor limit=5 countfield=”Number of Sales” userother=t
How would you search for the top three products sold by each vendor?
… | top product_name by Vendor limit=3 countfield=”Number of Sales” showperc=f
How would you show the top five vendors that sold the least amount of product?
… | rare Vendor limit=5 showcount”Number of Sales” showperc=f useother=t
How would you show the five games that sold the least by each of the vendors?
… | rare product_name by Vendor limit=5 showcount=”Number of Sales” showperc=f useother=t
How would you count the number of failed logins? Change the column name to “Potential Issues”.
… | stats count as “Potential Issues”
How would you count the number of events that contain a vendor action field? Also count the total number of events.
… | stats count(vendor_action) as ActionEvents, count as TotalEvents
How would you count the number of events by user, app, and vendor?
… | stats count by user, app, vendor_action
How many unique websites have your employees visited, displayed as “Websites visited”?
… | stats dc(s_hostname) as “Websites visited:”
How much bandwidth did employees spend at each website? This needs to be sorted in descending order.
… | stats sum(sc_bytes) as Bandwidth by s_hostname | sort -Bandwidth
How would you show the number of units sold by a vendor for each specific product as well as the average selling price?
… | stats count as “Units Sold” avg(sale_price) as “Average Selling Price” by product_name
How would you show each unique website a user has visited?
… | stats value(s_hostname) by cs_username
Which stats function would you use to find the average value of a field?
avg
To display the most common values in a specific field, what command would you use?
top
True/False. A time range picker can be included in a report.
True
True/False. Charts can be based on numbers, time, or location.
True
If a search returns this, you can view the results as a chart.
Statistical Values
The instant pivot button is displayed in the statistics and visualization tabs when a _______ search is run.
non-transforming
True/False. A lookup is categorized as a dataset.
True
To keep from overwriting exiting fields with your Lookup you can use the ____________ clause.
outputnew
In a dashboard, a time range picker will only work on panels that include a(n) __________ search.
inline
True/False. Pivots can be saved as dashboards panels.
True
These are knowledge objects that provide the data structure for pivot.
Data models
External data used by a Lookup can come from sources like:
CSV, scripts, geospatial data
True/False. When zooming on the event timeline, a new search is run.
False
Search strings are sent from the _________.
search head
True/False. Events are always returned in chronological order.
False
These roles can create reports:
Admin, Power, User
Which role(s) can create data models?
Admin, power
Adding child data model objects is like the ______ Boolean in the Splunk search language.
AND
When using a .csv file for Lookups, the first row in the file represents this.
field names
True/False. Alerts can be shared to all apps.
True
True/False. Alerts can send an email.
True
The default username and password for a newly installed Splunk instance is:
admin and changeme
When a search is sent to splunk, it becomes a _____.
search job
True/False. Field values are case sensitive.
False
Which clause would you use to rename the count field?
as
True/False. Real-time alerts will run the search continuously in the background.
True
True/False. Alerts can run uploaded scripts.
True
A search job will remain active for ___ minutes after it is run.
10
True/False. You can launch and manage apps from the home app.
True
The User role cannot create reports.
False
Shared search jobs remain active for _______ by default.
7 days
Pivots cannot be saved as reports panels. T/F
False
Once an alert is created, you can no longer edit its defining search. T/F
False
Returns a multivalued field that contains a list of the commands used in X
Basic example
The following example returns a multivalued field X, that contains ‘search’, ‘stats’, and ‘sort’.
… | eval x=commands(“search foo | stats count | sort count”)
commands(x)
Returns a multivalue result based on all of values specified.
Basic example
… | eval fullName=mvappend(initial_values, “middle value”, last_values)
mvcount(MVFIELD)
Removes all of the duplicate values from a multivalue field.
Basic example
… | eval s=mvdedup(mvfield)
mvdedup(X)
Filters a multivalue field based on an arbitrary Boolean expression X.
Basic examples
The following example returns all of the values in field email that end in .net or .org.
… | eval n=mvfilter(match(email, “.net$”) OR match(email, “.org$”))
mvfilter(X)
Finds the index of a value in a multivalue field that matches the REGEX.
Basic example
… | eval n=mvfind(mymvfield, “err\d+”)
mvfind(MVFIELD,”REGEX”)
Returns a set of values from a multivalue field described by STARTINDEX and ENDINDEX.
Basic examples
Because indexes start at zero, the following example returns the third value in “multifield”, if the value exists.
… | eval n=mvindex(multifield, 2)
mvindex(MVFIELD,STARTINDEX,ENDINDEX)
Takes all of the values in a multivalue field and appends them together delimited by STR.
The following search creates the base field with the values. The search then creates the joined field by using the result of the mvjoin function.
… | eval base=mvrange(1,6), joined=mvjoin(‘base’,” OR “)
mvjoin(MVFIELD,STR)
Creates a multivalue field with a range of numbers between X and Y, incrementing by Z.
Basic examples
The following example returns a multivalue field with the values 1, 3, 5, 7, 9.
… | eval mv=mvrange(1,11,2)
mvrange(X,Y,Z)
Returns the values of a multivalue field sorted lexicographically.
Basic example
… | eval s=mvsort(mvfield)
mvsort(X)
Takes two multivalue fields, X and Y, and combines them by stitching together the first value of X with the first value of field Y, then the second with the second, and so on. The third argument, Z, is optional and is used to specify a delimiting character to join the two values. The default delimiter is a comma.
Basic example
… | eval nserver=mvzip(hosts,ports)
mvzip(X,Y,”Z”)
Returns an mvfield spitting X by the delimited character Y
Basic example
… | eval n=split(foo, “;”)
split(X,”Y”)
In most production environments, _______ will be used as your the source of data input.
Forwarders
Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.
Source types
Splunk uses ________ to categorize the type of data being indexed.
Sourcetypes
The monitor input option will allow you to continuously monitor files.
True
When zooming in on the event time line, a new search is run.
False
When a search is sent to splunk, it becomes a _____.
Search job
The time stamp you see in the events is based on the time zone in your user account.
True
These are booleans in the Splunk Search Language.
And
Not
Or
Having separate indexes allows:
Multiple retention policies
Ability to limit access
Faster Searches
Which command removes results with duplicate field values?
Dedup
Which one of these is not a stats function?
addtotals
Data models are made up of ___________.
Datasets
Which role(s) can create data models?
Power
Admin
A lookup is categorized as a dataset.
True
When using a .csv file for Lookups, the first row in the file represents this.
Field names
Finish this search command so that it displays data from the http_status.csv Lookup file.
inputlookup
External data used by a Lookup can come from sources like:
Geospatial data
CSV files
Scripts
To keep from overwriting existing fields with your Lookup you can use the ____________ clause.
outputnew
Real-time alerts will run the search continuously in the background.
True
Once an alert is created, you can no longer edit its defining search.
False
Alerts can be shared to all apps.
True
Alerts can send an email.
True
How do you use exact phrases?
Double quotes around the exact word or phrase (CS)
What are the properties of Fields?
Field value pairs are used to search an extracted field (Field name CS, Field value CI)
What are the comparison operators available to use in Splunk search language and what a…….
=, !=, , >=
What are Splunk Search Terms
- Keywords
- Booleans
- Phrases
- Fields
- Wildcards
- Comparison Operators
- time
- specificity - the more you tell the search engine, the better your results
- inclusion is better than exclusion
What are Commands?
Commands tell Splunk what we want to do with the search results such as:
- creating charts
- computing statistics
- formatting
True/False. Machine data is always structured.
False
True/False. Machine data is only generated by web servers.
False
What are search requests processed by?
Indexer
In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.
Forwarders
What does a single-instance deployment of Splunk Enterprise handle?
Input, Parsing, Indexing, and Searching
True/False. The monitor input option will allow you to continuously monitor files.
True
How would you show the top five vendors without showing the percentage field?
… | top Vendor limit=5 showperc=f
How would you show the top five vendors, rename the count field to “Number of Sales”, and add a row for the number of sales of vendors not listed in the top five?
.. | top Vendor limit=5 countfield=”Number of Sales” userother=t
How would you search for the top three products sold by each vendor?
… | top product_name by Vendor limit=3 countfield=”Number of Sales” showperc=f
How would you show the top five vendors that sold the least amount of product?
… | rare Vendor limit=5 showcount”Number of Sales” showperc=f useother=t
How would you show the five games that sold the least by each of the vendors?
… | rare product_name by Vendor limit=5 showcount=”Number of Sales” showperc=f useother=t
How would you count the number of failed logins? Change the column name to “Potential Issues”.
… | stats count as “Potential Issues”
How would you count the number of events that contain a vendor action field? Also count the total number of events.
… | stats count(vendor_action) as ActionEvents, count as TotalEvents
How would you count the number of events by user, app, and vendor?
… | stats count by user, app, vendor_action
How many unique websites have your employees visited, displayed as “Websites visited”?
… | stats dc(s_hostname) as “Websites visited:”
How much bandwidth did employees spend at each website? This needs to be sorted in descending order.
… | stats sum(sc_bytes) as Bandwidth by s_hostname | sort -Bandwidth
How would you show the number of units sold by a vendor for each specific product as well as the average selling price?
… | stats sum(sc_bytes) as Bandwidth by s_hostname | sort -Bandwidth
How would you show each unique website a user has visited?
… | stats value(s_hostname) by cs_username
What attributes describe the field: a dest 4
String value, contains 4 values
True/False. You can launch and manage apps from the home app.
True
The User role cannot create reports.
False
A Splunk Enterprise term that describes any Unix or Linux-based system.
nix
A type of custom alert action that conforms to the common action model.
adaptive response action
