Splunk Flashcards
Fundamentals 1 and 2
1
Q
Machine data is always structured.
A
False
2
Q
Machine data makes up for more than _____% of the data accumulated by organizations.
A
90
3
Q
Machine data can give you insights into:
A
Application performance Security Hardware monitoring Sales User Behavior
4
Q
Machine data is only log files on web servers.
A
False
5
Q
Which of these is NOT a main component of Splunk?
A
compress and archive
6
Q
The index does not play a major role in Splunk.
A
False
7
Q
Data is broken into single events by:
A
in a consistent format.
8
Q
Which role defines what apps a user will see by default?
A
Admin
9
Q
Which two apps ship with Splunk Enterprise?
A
Search & Reporting
Home App
10
Q
There are ______ components to the Search and Reporting app’s default interface.
A
7
11
Q
What is the most efficient way to filter events in Splunk?
A
reverse chronological order
12
Q
Commands that create statistics or visualizations are called ____________.
A
transforming commands
13
Q
The Search & Reporting App has how many search modes?
A
3
14
Q
Which character acts as a wildcard in the Splunk Search Language?
A
*
15
Q
What are Boolean operators in Splunk?
A
…
16
Q
Which is not a comparison operator in Splunk?
A
&=
17
Q
Field names are _____________.
A
case sensitive
18
Q
What could be said of the circled field below:
A dest 4
A
it contains four values
its was extracted at search time
it contains string values
19
Q
After a report is saved, you can no longer edit the search.
A
False
20
Q
Search commands can be used with search terms to do the following:
A
Create charts
Compute statistics
Format data
21
Q
If we want to see events after running a transforming command, we need to switch to this mode.
A
Verbose
22
Q
Any search that returns these values can be viewed as a chart.
A
Statistical
23
Q
Charts can be based on numbers, time or location.
A
True
24
Q
________ are searches gathered together in a single pane of glass.
A
Dashboards
25
An alert is an action triggered by a ____________.
saved search
26
Alerts can send an email.
True
27
These are knowledge objects that provide the data structure for pivot.
data models
28
Which roles can create data models?
Admin and Power
29
You can think of adding child data model objects as an _________ Boolean in the Splunk search language.
AND
30
The instant pivot button is displayed in the statistics and visualization tabs when a _______ search is used.
non-transforming
31
Unlike pivot, reports created with instant pivot can not be saved.
False
32
Splunk breaks data into ___________.
events
33
Field values are _______.
case insensitive
34
Which 2 apps ship with Splunk Enterprise?
Search & Reporting
| Home App
35
These searches will return the same results?
password fail
"password fail"
False
36
Which is not a comparison operator in Splunk?
OR
37
Data is broken into single events by:
sourcetype
38
Which is not a comparison operator in Splunk?
%=
39
A time range picker can be included in a report.
True
40
Charts can be based on numbers, time or location.
True
41
Which of these is not a main component of Splunk?
Compress and archive
42
The index does not play a major role in Splunk.
False
43
Admin, Power, User
Out of the box there are 3 main roles
44
How can you view all sourcetypes?
Click Data Summary in the Searching & Reporting app
45
What is shown in the Data Summary?
Host, Sources, and Sourcetypes on separate tabs
46
What timezone is data displayed for, in searches?
The local timezone set in your profile.
47
Search terms are case sensitive or insensitive?
insensitive
48
AND, OR, NOT
What booleans are supported in splunk search?
49
Symbol for "does not equal"
!=
50
In what chronological order are events displayed, after a search?
Reverse chronological order (newest first)
51
Each event has these field value pairs.
timestamp, host, source, sourcetype
52
Time range abbreviations for seconds
s
53
Time range abbreviations for minutes
m
54
Time range abbreviations for hours
h
55
Time range abbreviations for days
d
56
Time range abbreviations for weeks
w
57
Time range abbreviations for months
mon
58
Time range abbreviations for year
y
59
What are the commands for specifying a time range in a search string?
earliest and latest
| eg: earliest=-h latest=@d
60
Does narrowing the time range by dragging the selection bars across the timeline re-execute the search?
No, it only filters the results
61
What formats may search results be exported to?
CSV, XML, JSON
62
What does "event sampling" do?
Instead of returning all the results, from a search, it returns a random sampling of events.
63
What does an event sample of 1:100 indicate?
Each event, found in a search, has a 1 in 100, or 1% change of being included in the sample result set.
64
What is a Field?
searchable key/value pairs from event data.
65
How does Splunk discover fields?
Based on sourcetype and key/value pairs found in the data.
66
What percentage of search results have the fields listed under "Interesting Fields"?
20% of events have these fields present in them.
67
What are the three search modes?
Fast, Smart, Verbose
68
What is the default search mode?
Smart
69
Field names are case sensitive or insensitive?
Case sensitive
70
True/False: Splunk is subnet/CIDR aware for IP fields?
True
71
How does NOT affect search results?
Returns everything except the events matching the NOT boolean
72
What is a dashboard?
One or more panels displaying data visually in a useful way.
73
What command changes the name of a field in search?
rename
74
When should quotes be used around values in search?
When including spaces or special characters
75
What command allows you to include/exclude fields in your search?
fields
76
What is the difference between +/- with the fields command?
+ (include) occurs before field extraction and improves performance
- (exclude) occurs after field extraction, and no performance improvement
77
How can you reduce the returned results with the sort command?
The limit option
| e.g: | sort limit=20 -categoryID, product_name
78
What command finds the most common values of a given field?
top
79
How many results are returned by the top command, by default?
10
80
What two columns are automatically returned by the top command?
count & percent
81
What option changes the number of results returned by the top command?
limit (limit=0 returns unlimited results)
82
What command returns the least common field values?
rare
83
What command allows you to calculate statistics on data that matches your search criteria?
stats
84
What option allows you to rename fields, within the stats command?
as
85
What stats command shows all field values for a given field?
list
86
What stats command shows all unique field values for a given field?
values
87
To get multi-series tables you need to set up the underlying search with commands like...
chart or timechart
88
What are the seven chart types?
line, area, column, bar, bubble, scatter, pie
89
What eval command allows you to format for currency?
tostring
90
What command allows you to create a single event from a group of events that share the same value in a given field?
transaction
91
Max events displayed by transaction command
1,000
92
What is the transforms.conf flag to switch whether or not a lookup field value is case-sensitive or not?
case_sensitive_match
93
What is a way to normalize data over any default field?
Field Aliases
94
What are nicknames that you create for related field/value pairs?
Tags
95
Where can you view a list of all Tags?
Settings > Tags > List by field value pair
96
A method of categorizing events based on a search
Event Type
97
What may be run from an event in your search results to interact with external resources or run another search?
Workflow Actions
98
Workflow action to pass information to an external web resource.
GET
99
Workflow action to send field values to an external resource.
POST
100
Workflow action to use field values to perform a secondary search.
Search
101
Macros must be surrounded with what character?
backticks
102
What tool provides a methodology to normalize data?
Common Information Model (CIM)
103
Which search will return the same events as the search in the searchbar?
password failed
password AND failed
104
What is the most efficient way to filter events in Splunk?
By time.
105
Which is not a comparison operator in Splunk?
?=
106
How is the asterisk used in Splunk search?
As a wildcard
107
As general practice, inclusion is better than exclusion in a Splunk search.
True
108
What command would you use to remove the status field from the returned events?
fields -
109
Finish the rename command to change the name of the status field to HTTP Status.
sourcetype=access* status=404 | rename ______
status as "HTTP Status"
110
Would the clientip column be removed in the results of this search? Why or why not?
sourcetype=access* | rename clientip as "user" | table user status | fields - clientip
No, because the name was changed.
111
What is missing from this search?
sourcetype=acc* status=404 | rename clientip as "User ID" | table USer ID status host
Quotation marks around User ID
112
Which command removes results with duplicate field values?
Dedup
113
To display the most common values in a specific field, what command would you use?
sourcetype=vendor_sales | ______ Vendor
top
114
How many events are shown by default when using the top or rare command?
10
115
Finish this search to return unlimited results.
sourcetype=access_combined action=purchase | rare product_name _________
limit=0
116
Which of these is NOT a stats function?
addtotals
117
Which clause would you use to rename the count field?
sourcetype=vendor_sales | stats count(linecount) ______ "Units Sold"
as
118
Which stats function would you use to find the average value of a field?
avg
119
If a search returns this, you can view the results as a chart.
Statistical values
120
When using the chart command, the x-axis should always be numeric.
False
121
The timechart command clusters data in time intervals dependent on:
Time range selected
122
Finish this search to remove any results that do not contain a value in the product_name field.
sourcetype=access_c* status>299 | chart count over host by product_name _______
usenull=f
123
When using the search below, what axis would time be on?
sourcetype=vendor_sales | timechart count(linecount)
x
124
The Trendline Command requires this many arguments:
3
125
In the following search, what should the empty argument contain?
sourcetype=linux_secure | iplocation ______
An IP address.
126
The Geostats Command requires both latitude and longitude data to use on a map.
True
127
Data created using the Iplocation Command can not be used with the Geostats Command.
False
128
Which command do you use when creating a choropeth map?
geom
129
Which Splunk search command allows you to perform mathematical functions on field values?
Eval
130
Which is the correct argument order when using the eval if function?
if (Boolean, Is True, Is False)
131
If you want to format values without changing their characteristics, which would you use?
The Fieldformat Command.
132
By default, the Fillnull Command replaces null values with this:
0
133
You can only use one Eval Command per search.
False
134
This command allows you to correlate related events on a field or list of fields that span time.
transaction
135
Which of these is NOT a field created with the transaction command?
maxcount
136
__________ should be used when you want to see the results of a calculation, or you need to group events on a field value.
Stats
137
_________ should be used when you need to see events correlated together, or when events need to be grouped on start and end values.
Transactions
138
What should you use with the transaction command to set the maximum total time between the earliest and latest events returned.
maxspan
139
This stats function will return unique values for a given field.
Value
140
Results of the Eval Commands always replace the existing field.
False
141
Which roles can create Private Knowledge Objects?
User, Power, Admin
142
Which roles can create knowledge objects shared across all apps?
Admin
143
Knowledge objects can be used to normalize data?
True
144
A Common Information Model (CIM) is supported by Splunk.
True
145
What are the predefined ways knowledge objects can be shared?
All apps
Private
Specifiic App
146
When using a .csv file for lookups, the first row in the file represents this.
field names
147
Which is the correct order to use when creating a lookup?
Define a lookup table
Define a lookup
Create and automatic lookup
148
Finish this search command so that it displays data from the http_status.csv lookup file.
| __________ http_status.csv
inputlookup
149
Finish this search so that it uses the http_status.csv lookup to return events.
| sourcetype=access_c* NOT status=200 | _________ http_status code as status
lookup
150
You can only have one field alias per field.
False
151
Field Aliases ___________________
Can be referenced by lookup tables.
Are applicable to a specified app context.
Make correlation easier.
152
Calculated fields are shortcuts for _______________.
Eval Commands
153
Calculated fields can use lookup tables.
False
154
The easiest way to extract a field is from ____________, allowing you to skip a few steps.
The event actions menu
155
When editing a field extraction, you will be working with _________________.
The regular expression.
156
You can extract multiple fields with the field extractor.
True
157
______________ is a field extraction method for events that contain fields separated by a character.
delimiter
158
Fields extracted with the field extractor
Are persistent
Are specific to a host, source or sourcetype.
Are reusable in multiple searches.
159
You can only add one tag per field value pair.
False
160
Which search would limit an "alert" tag to the "host" field?
tag::host=alert
161
__________ allow you to categorize events based on search terms.
Event Types
162
Tags can be added to event types.
True
163
Event types do NOT show up in the field list.
False
164
Splunk suggests naming your Knowledge Objects using _______ segmented keys.
6
165
A workflow action can _________________.
Send field values to external resources.
Pass variables to a URL.
Execute a secondary search.
166
This workflow action sends field value to external resources.
POST
167
This workflow action passes variables in a URL.
GET
168
To escape the "fieldname" value which command would you use? $_________fieldname$
!
169
____________ are based on searches that run on a scheduled interval or in real-time.
Alerts
170
Which actions can be triggered by an alert?
List in triggered alerts
Send Email
Run a script
171
Alerts can be shared to all apps.
True
172
Once an alert is created, you can no longer edit its defining search/
False
173
A real-time alert type is useful when you want to know as soon as your trigger condition is met.
True
174
Search Macros _______________
Allow you to store entire search strings, including pipes and eval statements.
Are time range independent.
Can pass arguments to the search.
175
What is the proper syntax for using a macro called "dostuff"
sourcetype=gamelog |
'dostuff'
176
You can pipe the results of a Macro to other commands.
True
177
What is the correct way to name a macro with two arguments?
dostuff(2)
178
Validating macro arguments can be done with which type of command?
Add a root object
179
Root search objects benefit from acceleration.
False
180
_________ objects can be added to a root event object to narrow down the search.
Child
181
What attributes can be added to an object?
```
Auto-Extracted
Eval Expression
Lookup
Regular Expression
Geo IP
```
182
You can add additional child objects to either existing objects or the root object.
True
183
After you configure a lookup, its fields can be found in the fields sidebar and you can use them in a search.
True
184
No matter what user role creates the field alias, it is always set to Private by default.
True
185
Running concurrent reports and the searches behind them puts very low demand on your system hardware.
False
186
Search macros can only be used once in a given search.
False
187
The results of a macro can not be piped to other commands.
False
188
When building your data model, Splunk suggests you use root search objects whenever possible.
False
189
What are the 3 main processing components of Splunk?
Forwarders
Indexers
Search Heads
190
Raw data in an index is stored in a ________ form.
compressed
191
Forwarders are typically installed on _____________.
Machines where the data originates
192
The ___________ handle search management while ___________ perform the searches.
1. search heads
| 2. indexers
193
A group of indexers configured to replicate each other's data is called a ________.
Index Cluster
194
__________ is often the biggest bottle neck in the Splunk indexing pipeline.
Disk I/O
195
Search heads do not require as much ______ as indexers but require more _________.
1. disk space
| 2. CPU power
196
Adding more machines no matter the hardware will make your deployment perform better.
False
197
Splunk indexers and Search Heads on virtual machines should have ____ of the vCPU reserved to them.
100%
198
Keeping ____ synchronized across your deployment, makes sure events are returned in the proper order.
time
199
What command is used to start the Splunk Enterprise server?
./splunk start
200
This command can be used to make Splunk start each time the server is booted.
./splunk enable boot-start
201
When logging into Splunk Enterprise for the first time, a username of ______ and a password of are used.
1. admin
| 2. changeme
202
The _______ folder inside the Splunk Enterprise installation directory contains licenses and configuration files.
etc
203
Splunk Enterprise commands are executed from the ________ directory.
bin
204
The following are Splunk Enterprise processing tiers.
Data input
Indexing
Search Management
205
Event separation happens during the ________ segment of the data pipeline.
parsing
206
Events are written to disk during the _______ segment of the data pipeline.
Indexing
207
The functions of the data pipeline vary drastically depending on the deployment.
False
208
Splunk Enterprise licenses specify how much data you can index per __________.
day
209
Any editing done to .conf files should be done in the ________ directory.
local
210
The ________ index is used when an index is not specified at input time.
main
211
Having multiple indexes allows:
Faster searches
Access limiting
Multiple retention policies
212
As data is input into Splunk Enterprise, it is first placed into a ________ bucket.
hot
213
Some differences between hot and warm buckets are:
Hot buckets are writable, warm buckets are not.
Hot buckets are searched first.
The naming convention.
214
When a bucket is frozen, by default it is moved to a different location before deleting.
False
215
The timezone setting in a user's account will effect the timestamp shown in events.
True
216
_______________ define what users can do in Splunk.
Roles
217
Only the ________ role can use the Delete Command by default.
can_delete
218
The ______ role has the most capabilities of the predefined splunk roles.
admin
219
When mixing authentication sources, scripted authentication will always take precedence.
False
220
In most production environments, _______ will be used as your main source of data input.
forwarders
221
Splunk uses ____________ to categorize the type of data being indexed.
sourcetypes
222
The server that data is forwarded to is called the ______________.
receiver
223
Indexing on a Heavy Forwarder does not affect your license.
False
224
The following can be used to build apps for Splunk:
Simple XML
Splunk JavaScript
SDKs
225
When migrating from a single instance deployment to a distributed environment, you will want to use the existing instance as an _______.
indexer
226
An indexer in a distributed search environment is called a __________.
search peer
227
It is a best practice to ____________ forwarders across all indexers in a search peer group.
load balance
228
The management port is required when adding a search peer to a search head.
True
229
DMC stands for
Distributed Management Console
230
In most Splunk deployments, _________ serve as the primary way data is supplied for indexing.
forwarders
231
Search strings are sent from the
Search head
232
Forwarders are typically installed on __________
Machines where the data originates
233
A server acting as a ___________ require the same hardware as a single deployment server.
Indexer
234
Splunk Enterprise can be installed virtual environments.
True
235
In a windows environment, a local system user will have access to:
all data on the local system
236
Search requests are processed by the ____________.
Indexer
237
____________ is the system process that handles indexing, searching, forwarding and the web interface for Splunk Enterprise.
Splunkd
238
Splunk Enterprise should always be run as root in a *NIX environment.
False
239
It is suggested that you have a single deployment instance available for _________.
testing and development
240
A total of ____ cores are recommended per search head.
16
241
This component is NOT installed from the Splunk Enterprise Package.
Universal Forwarder
242
Splunk Enterprise deployment typically has ___ processing tiers.
3
243
The segment of the data pipeline that stores user's knowledge objects is the _______ segment.
indexing
244
Any editing done to .conf files should be done in the _____ directory.
local
245
The default management port for Splunkd is:
8089
246
Search Heads require more _____ than indexers.
CPU Power
247
The .conf files can only be edited using the Splunk web interface.
False
248
Event separation happens during the __________ segment of the data pipeline.
parsing
249
Events are written to disk during the ____ segment of the data pipeline.
indexing
250
A license violation causes all data to stop being indexed.
False
251
The functions of the data pipeline vary drastically depending on the deployment.
False
252
Parsing and Indexing are both part of the ____ processing tier.
Indexing
253
You can click a search term in the results to add it to the search class.
True
254
The Splunk search language supports the ? wildcard.
False
255
Using the export function, you can export an unlimited number of results.
True
256
Field NAMES are case sensitive
True
257
This search user=* displays only events that contain a value for user
True
258
The following searches will return the same results: SEARCH 1: web AND error SEARCH 2: web and error
False
259
Field names are case...
sensitive
260
Use this command to exclude fields used in the search to make the results easier to read.
fields -
261
These users can create objects that are shared across ALL apps
admin
262
Machine data is always structured
False
263
Machine data makes up __% of the data accumulated by organizations
90
264
Machine data is only log files on web servers
False
265
The index does not play a major role in Splunk
False
266
Data is broken into single events by ___
Sourcetype
267
Time stamp are stored ____
in a consistent format
268
which role defines what apps a user will see by default
admin
269
which two apps ship with Splunk Enterprise
Search & Reporting, Home App
270
What is the most efficient way to filter events in Splunk?
By time
271
When search is run, events are returned in ____
reverse chronological order
272
which is not a valid option when editing a report?
Rename
273
Wildcards can be used with field value searches
True
274
A power user can allow read/write permissions on a report
True
275
If we want to see events after running a transforming command, we need to switch to this mode.
Verbose
276
Charts can be based on numbers, time or location
True
277
_____ are searches gathered together into a single pane of glass
Dashboards
278
Pivots can not be saved as reports or dashboard panels
False
279
The instant pivot button is displayed in the statistics and visualization tabs when a ____ search is used
non-transforming
280
These are knowledge objects that provide the data structure for pivot
Data models
281
You can think of adding child data model objects as an ___ boolean in the Splunk search engine
AND
282
Unlike pivot, reports created with instant pivot can not be saved.
False
283
which role can create data models?
admin
284
Splunk breaks down data input into individual ___
events
285
From the search jobs page, you can click the job link to ___
view the results of the instance of that search
286
Fields are searchable key/value pairs
True
287
Field have names
True
288
Default Fields are added to every event
True
289
Administrators CANNOT configure default fields
True
290
The interesting fields in the field sidebar will be the same for every search against the same index
False
291
Interesting fields are those that have values in over 20% of events
True
292
which search mode returns all event and field data?
verbose mode
293
Select this in the field sidebar to automatically pipe your search results to the timechart command
top values by time
294
How can you view all sourcetypes?
Click Data Summary in the Searching & Reporting app
295
What is shown in the Data Summary?
Host, Sources, and Sourcetypes on separate tabs
296
What timezone is data displayed for, in searches?
The local timezone set in your profile.
297
Search terms are case sensitive or insensitive?
insensitive
298
What booleans are supported in splunk search?
AND, OR, NOT
299
Symbol for "does not equal"
!=
300
Current search time is 09:37:12. What is the time range equation to search back 5 minutes on the minute?
-5m@m
301
What are the commands for specifying a time range in a search string?
earliest and latest
| eg: earliest=-h latest=@d
302
Does narrowing the time range by dragging the selection bars across the timeline re-execute the search?
No, it only filters the results
303
How does Splunk discover fields?
Based on sourcetype and key/value pairs found in the data.
304
What is the default search mode?
Smart
305
True/False: Splunk is subnet/CIDR aware for IP fields?
True
306
When should quotes be used around values in search?
When including spaces or special characters
307
What command allows you to include/exclude fields in your search?
fields
308
How can you reduce the returned results with the sort command?
The limit option
| e.g: | sort limit=20 -categoryID, product_name
309
What command returns the least common field values?
rare
310
What command allows you to calculate statistics on data that matches your search criteria?
stats
311
What option allows you to rename fields, within the stats command?
as
312
What stats command shows all field values for a given field?
list
313
What stats command shows all unique field values for a given field?
values
314
To get multi-series tables you need to set up the underlying search with commands like...
chart or timechart
315
What is the transforms.conf flag to switch whether or not a lookup field value is case-sensitive or not?
case_sensitive_match
316
Where can you view a list of all Tags?
Settings > Tags > List by field value pair
317
A method of categorizing events based on a search
Event Type
318
True/False. Machine data is always structured.
False
319
True/False. Machine data is only generated by web servers.
False
320
What are the three main processing components of Splunk?
Indexers, Forwarders, Search Heads
321
What are search requests processed by?
Indexer
322
Which function is not a part of a single instance deployment?
Clustering
323
In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.
Forwarders
324
What does a single-instance deployment of Splunk Enterprise handle?
Input, Parsing, Indexing, and Searching
325
_________ define what users can do in Splunk.
Roles
326
This role will only see their own knowledge objects and those that have been shared with them.
User
327
Splunk uses ________ to categorize the type of data being indexed.
source type
328
True/False. The monitor input option will allow you to continuously monitor files.
True
329
Files indexed using the the upload input option get indexed _____.
once
330
Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.
Source types
331
In most production environments, _______ will be used as your the source of data input.
forwarders
332
Which following search mode toggles behavior based on the type of search being run?
Smart
333
True/False. The time stamp you see in the events is based on the time zone in your user account.
True
334
Having separate indexes allows:
Multiple retention policies, ability to limit access, and faster searches.
335
True/False. Time to search can only be set by the time range picker.
False
336
This symbol is used in the "Advanced" section of the time range picker to round down to nearest unit of specified time.
@
337
As a general practice, exclusion is better than inclusion in a Splunk search.
False
338
True/False. Excluding fields using the Fields Command will benefit performance.
False
339
Would the ip column be removed in the results of this search? sourcetype=a* | rename IP as "User" | fields - ip
No, because the name was changed.
340
Which command removes results with duplicate field values?
dedup
341
What command would you use to remove the status field from the returned events? sourcetype=a* status=404 | ________ status
fields -
342
How would you show the top five vendors without showing the percentage field?
... | top Vendor limit=5 showperc=f
343
How would you show the top five vendors, rename the count field to "Number of Sales", and add a row for the number of sales of vendors not listed in the top five?
... | top Vendor limit=5 countfield="Number of Sales" userother=t
344
How would you search for the top three products sold by each vendor?
... | top product_name by Vendor limit=3 countfield="Number of Sales" showperc=f
345
How would you show the top five vendors that sold the least amount of product?
... | rare Vendor limit=5 showcount"Number of Sales" showperc=f useother=t
346
How would you show the five games that sold the least by each of the vendors?
... | rare product_name by Vendor limit=5 showcount="Number of Sales" showperc=f useother=t
347
How would you count the number of failed logins? Change the column name to "Potential Issues".
... | stats count as "Potential Issues"
348
How would you count the number of events that contain a vendor action field? Also count the total number of events.
... | stats count(vendor_action) as ActionEvents, count as TotalEvents
349
How would you count the number of events by user, app, and vendor?
... | stats count by user, app, vendor_action
350
How many unique websites have your employees visited, displayed as "Websites visited"?
... | stats dc(s_hostname) as "Websites visited:"
351
How much bandwidth did employees spend at each website? This needs to be sorted in descending order.
... | stats sum(sc_bytes) as Bandwidth by s_hostname | sort -Bandwidth
352
How would you show the number of units sold by a vendor for each specific product as well as the average selling price?
... | stats count as "Units Sold" avg(sale_price) as "Average Selling Price" by product_name
353
How would you show each unique website a user has visited?
... | stats value(s_hostname) by cs_username
354
Which stats function would you use to find the average value of a field?
avg
355
To display the most common values in a specific field, what command would you use?
top
356
True/False. A time range picker can be included in a report.
True
357
True/False. Charts can be based on numbers, time, or location.
True
358
If a search returns this, you can view the results as a chart.
Statistical Values
359
The instant pivot button is displayed in the statistics and visualization tabs when a _______ search is run.
non-transforming
360
True/False. A lookup is categorized as a dataset.
True
361
To keep from overwriting exiting fields with your Lookup you can use the ____________ clause.
outputnew
362
In a dashboard, a time range picker will only work on panels that include a(n) __________ search.
inline
363
True/False. Pivots can be saved as dashboards panels.
True
364
These are knowledge objects that provide the data structure for pivot.
Data models
365
External data used by a Lookup can come from sources like:
CSV, scripts, geospatial data
366
True/False. When zooming on the event timeline, a new search is run.
False
367
Search strings are sent from the _________.
search head
368
True/False. Events are always returned in chronological order.
False
369
These roles can create reports:
Admin, Power, User
370
Which role(s) can create data models?
Admin, power
371
Adding child data model objects is like the ______ Boolean in the Splunk search language.
AND
372
When using a .csv file for Lookups, the first row in the file represents this.
field names
373
True/False. Alerts can be shared to all apps.
True
374
True/False. Alerts can send an email.
True
375
The default username and password for a newly installed Splunk instance is:
admin and changeme
376
When a search is sent to splunk, it becomes a _____.
search job
377
True/False. Field values are case sensitive.
False
378
Which clause would you use to rename the count field?
as
379
True/False. Real-time alerts will run the search continuously in the background.
True
380
True/False. Alerts can run uploaded scripts.
True
381
A search job will remain active for ___ minutes after it is run.
10
382
True/False. You can launch and manage apps from the home app.
True
383
The User role cannot create reports.
False
384
Shared search jobs remain active for _______ by default.
7 days
385
Pivots cannot be saved as reports panels. T/F
False
386
Once an alert is created, you can no longer edit its defining search. T/F
False
387
Returns a multivalued field that contains a list of the commands used in X
Basic example
The following example returns a multivalued field X, that contains 'search', 'stats', and 'sort'.
... | eval x=commands("search foo | stats count | sort count")
commands(x)
388
Returns a multivalue result based on all of values specified.
Basic example
... | eval fullName=mvappend(initial_values, "middle value", last_values)
mvcount(MVFIELD)
389
Removes all of the duplicate values from a multivalue field.
Basic example
... | eval s=mvdedup(mvfield)
mvdedup(X)
390
Filters a multivalue field based on an arbitrary Boolean expression X.
Basic examples
The following example returns all of the values in field email that end in .net or .org.
... | eval n=mvfilter(match(email, "\.net$") OR match(email, "\.org$"))
mvfilter(X)
391
Finds the index of a value in a multivalue field that matches the REGEX.
Basic example
... | eval n=mvfind(mymvfield, "err\d+")
mvfind(MVFIELD,"REGEX")
392
Returns a set of values from a multivalue field described by STARTINDEX and ENDINDEX.
Basic examples
Because indexes start at zero, the following example returns the third value in "multifield", if the value exists.
... | eval n=mvindex(multifield, 2)
mvindex(MVFIELD,STARTINDEX,ENDINDEX)
393
Takes all of the values in a multivalue field and appends them together delimited by STR.
The following search creates the base field with the values. The search then creates the joined field by using the result of the mvjoin function.
... | eval base=mvrange(1,6), joined=mvjoin('base'," OR ")
mvjoin(MVFIELD,STR)
394
Creates a multivalue field with a range of numbers between X and Y, incrementing by Z.
Basic examples
The following example returns a multivalue field with the values 1, 3, 5, 7, 9.
... | eval mv=mvrange(1,11,2)
mvrange(X,Y,Z)
395
Returns the values of a multivalue field sorted lexicographically.
Basic example
... | eval s=mvsort(mvfield)
mvsort(X)
396
Takes two multivalue fields, X and Y, and combines them by stitching together the first value of X with the first value of field Y, then the second with the second, and so on. The third argument, Z, is optional and is used to specify a delimiting character to join the two values. The default delimiter is a comma.
Basic example
... | eval nserver=mvzip(hosts,ports)
mvzip(X,Y,"Z")
397
Returns an mvfield spitting X by the delimited character Y
Basic example
... | eval n=split(foo, ";")
split(X,"Y")
398
In most production environments, _______ will be used as your the source of data input.
Forwarders
399
Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.
Source types
400
Splunk uses ________ to categorize the type of data being indexed.
Sourcetypes
401
The monitor input option will allow you to continuously monitor files.
True
402
When zooming in on the event time line, a new search is run.
False
403
When a search is sent to splunk, it becomes a _____.
Search job
404
The time stamp you see in the events is based on the time zone in your user account.
True
405
These are booleans in the Splunk Search Language.
And
Not
Or
406
Having separate indexes allows:
Multiple retention policies
Ability to limit access
Faster Searches
407
Which command removes results with duplicate field values?
Dedup
408
Which one of these is not a stats function?
addtotals
409
Data models are made up of ___________.
Datasets
410
Which role(s) can create data models?
Power
| Admin
411
A lookup is categorized as a dataset.
True
412
When using a .csv file for Lookups, the first row in the file represents this.
Field names
413
Finish this search command so that it displays data from the http_status.csv Lookup file.
inputlookup
414
External data used by a Lookup can come from sources like:
Geospatial data
CSV files
Scripts
415
To keep from overwriting existing fields with your Lookup you can use the ____________ clause.
outputnew
416
Real-time alerts will run the search continuously in the background.
True
417
Once an alert is created, you can no longer edit its defining search.
False
418
Alerts can be shared to all apps.
True
419
Alerts can send an email.
True
420
How do you use exact phrases?
Double quotes around the exact word or phrase (CS)
421
What are the properties of Fields?
Field value pairs are used to search an extracted field (Field name CS, Field value CI)
422
What are the comparison operators available to use in Splunk search language and what a.......
=, !=, , >=
423
What are Splunk Search Terms
- Keywords
- Booleans
- Phrases
- Fields
- Wildcards
- Comparison Operators
- time
- specificity - the more you tell the search engine, the better your results
- inclusion is better than exclusion
424
What are Commands?
Commands tell Splunk what we want to do with the search results such as:
- creating charts
- computing statistics
- formatting
425
True/False. Machine data is always structured.
False
426
True/False. Machine data is only generated by web servers.
False
427
What are search requests processed by?
Indexer
428
In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.
Forwarders
429
What does a single-instance deployment of Splunk Enterprise handle?
Input, Parsing, Indexing, and Searching
430
True/False. The monitor input option will allow you to continuously monitor files.
True
431
How would you show the top five vendors without showing the percentage field?
... | top Vendor limit=5 showperc=f
432
How would you show the top five vendors, rename the count field to "Number of Sales", and add a row for the number of sales of vendors not listed in the top five?
.. | top Vendor limit=5 countfield="Number of Sales" userother=t
433
How would you search for the top three products sold by each vendor?
... | top product_name by Vendor limit=3 countfield="Number of Sales" showperc=f
434
How would you show the top five vendors that sold the least amount of product?
... | rare Vendor limit=5 showcount"Number of Sales" showperc=f useother=t
435
How would you show the five games that sold the least by each of the vendors?
... | rare product_name by Vendor limit=5 showcount="Number of Sales" showperc=f useother=t
436
How would you count the number of failed logins? Change the column name to "Potential Issues".
... | stats count as "Potential Issues"
437
How would you count the number of events that contain a vendor action field? Also count the total number of events.
... | stats count(vendor_action) as ActionEvents, count as TotalEvents
438
How would you count the number of events by user, app, and vendor?
... | stats count by user, app, vendor_action
439
How many unique websites have your employees visited, displayed as "Websites visited"?
... | stats dc(s_hostname) as "Websites visited:"
440
How much bandwidth did employees spend at each website? This needs to be sorted in descending order.
... | stats sum(sc_bytes) as Bandwidth by s_hostname | sort -Bandwidth
441
How would you show the number of units sold by a vendor for each specific product as well as the average selling price?
... | stats sum(sc_bytes) as Bandwidth by s_hostname | sort -Bandwidth
442
How would you show each unique website a user has visited?
... | stats value(s_hostname) by cs_username
443
What attributes describe the field: a dest 4
String value, contains 4 values
444
True/False. You can launch and manage apps from the home app.
True
445
The User role cannot create reports.
False
446
A Splunk Enterprise term that describes any Unix or Linux-based system.
nix
447
A type of custom alert action that conforms to the common action model.
adaptive response action
448
A type of app that runs on the Splunk platform and provides specific capabilities to other apps, such as getting data in, mapping data, or providing saved searches and macros. An add-on is not typically run as a standalone app. Instead, an add-on is a reusable component that supports other apps across a number of different use cases.
add-on
449
An unscheduled search
ad hoc search
450
Uses a saved search to look for events in real time or on a schedule.
alerts
451
A response, such as an email notification or webhook, to alert triggering or report completion.
alert action
452
An alternate name that you assign to a field, allowing you to use that name to search for events that contain that field.
alias
453
An application that runs on Splunk Enterprise and typically addresses several use cases.
app
454
Provides a way to save and retrieve data within your Splunk apps as collections of key-value pairs, letting you manage and maintain the state of your apps and store additional information.
App Key Value Store
455
a file generated by the Packaging Toolkit to describe a Splunk app, including dependencies and input groups.
app manifest
456
The action of adding to and maintaining a collection of historical data.
archiving
457
An event generated when an audited activity is performed in Splunk Enterprise.
audit event
458
A type of field extraction that uses the KV_MODE attribute in props.conf to automatically extract fields for events associated with a specific host, source, or source type.
Automatic key value field
459
A search on which you can base multiple similar searches.
base search
460
A filtering rule that excludes one or more members from a set.
blacklist
461
A data structure that you use to test whether an element is a member of a set.
bloom filter
462
A file system directory containing a portion of a Splunk Enterprise index.
bucket
463
is the remedial activity that occurs when a peer node goes offline.
bucket fixing
464
A tool which dynamically creates event types based on the analysis of a selected event.
Build Event Type utility
465
A field that represents the output of an eval expression.
calculated field
466
A user action within Splunk Enterprise.
capability
467
A method for displaying and working with language characters on computer systems.
character set encoding
468
The container for a set of data in an App Key Value Store, similar to a database table where each record has a unique key. Collections exist within the context of a given app.
collection
469
The Splunk Enterprise command-line interface (CLI) is a text interface that you use to enter system commands, edit configuration files, and run searches.
command-line interface
470
A Splunk utility that can be run from the command-line interface (CLI) to troubleshoot a Splunk Enterprise deployment.
command-line tool
471
A set of preconfigured data models that you can apply to your data at search time.
Common Information Model (CIM)
472
A support service level that entitles the user to public information sources for questions about Splunk Enterprise.
Community support
473
A data routing scenario where a forwarder selectively sends event data to receivers based on patterns in the event data.
conditional routing
474
How does Splunk help with Machine Data?
Index Data, Search and Investigate, Add Knowledge, Monitor and Alert, and Report & Analyze
475
Index
Collects data from any source. As data enters, inspectors go to work. Determines how to process the data. When it is matched it is labeled with a source type. Data is then broken into single events. Time stamps are identified and normalized to a consistent format. Events then stored in Splunk index where they can be searched.
476
Search
Find values across multiple sources allowing to analyze and run statistics.
477
Knowledge
Add knowledge objects to data. Effects how data is interpreted. Classified and enriched, and normalized for future use.
478
Monitor & Alert
Can Monitor infrastructure in real time to identify issues, problems, and attacks before they impact customers and services. Create alerts and automatically respond with a variety of actions.
479
Reports
Provides reports and the ability to do dashboards empowering groups in the organization by giving them the information they need organized into a single pane.
480
Forwarder Characteristics
(1) Require minimal resources, (2)little impact on performance, (3) Reside on the machine where the data originates.
481
Splunk Deployment Scalibility
Single Instance to a full distributed infrastructure.
482
Single Instance Deployment Splunk Instance
Input, Parsing, Indexing and Searching
483
When would you use a single-instance deployment
Perfect environment for proof of concept, personal use, learning, and night serve the need of small department-sized environments.
484
What would we have to do in a Full Scale Infrastructure Deployment?
Split the functionality across multiple specialized instances of Splunk enterprise. Add forwarders to send data to our indexers and eventually add multiple search heads and indexers to increase our indexing and search capacity. Search heads and indexes can also be clustered making sure data is always available and searchable.
485
Search requests are processed by?
Indexers
486
In most Splunk Deployments, this servers as the primary way data is supplied for indexing.
Forwarder
487
Reasons to Split Indexes
Separate indexes can make searches faster. Limits data amount Splunk searches. Returns events only from that index.Multiple indexes allow limiting access by user role in order to control who sees what data. Also helps with retention policies
488
Search
Limiting a search to time frame is a best practice.
489
Commands that Create Statistics and Visualizations
Called Transforming Commands which transform data into data tables.
490
Time for Search Job
By default will remain active for 10 minutes
491
Time for Shared Search Job
Remain active for 7 days
492
Escaping characters in Search
add backslash info="keyword1\"keyword2\"not in db"
493
Best Practices
Search by Time, inclusion is better than exclusion,filter command as early as possible in search,
494
Splunk Search Language Sytnax
1. Search Terms. 2. Commands. 3. Functions 4. Arguments 5. Clauses
495
Commands
Tells Splunk what we want to do with Search Results such as creating charts, computing statisitcs, and formatting
496
Functins
Explain how we want to chart, compute, and evaluate the results.
497
Arguments
Variables we want to apply to the functions
498
Clauses
Explain how we want the results grouped or defined.
499
Search Language Example
Search Term, Commands, Functions
500
Splunk has four important components, what are they?
Indexer - It indexes the machine data
Forwarder - Refers to Splunk instances that forward data to the remote indexers
Search Head - Provides GUI for searching
Deployment Server -Manages the Splunk components like indexer, forwarder, and search head in computing environment
501
What are the types of Splunk forwarder?
Universal Forwarders - It performs processing on the incoming data before forwarding it to the indexer.
Heavy Forwarders - It parses the data before forwarding them to the indexer works as an intermediate forwarder, remote collector.
502
What are the categories of SPL commands?
```
Sorting Results
Filtering Results
Grouping Results.
Filtering, Modifying and Adding Fields
Reporting Results
```
503
What are common port numbers used by Splunk?
```
Splunk Management Port 8089
Splunk Index Replication Port 8080
KV store 8191
Splunk Web Port 8000
Splunk Indexing Port 9997
Splunk network port 514
```
504
What are Splunk buckets?
A directory that contains indexed data is known as a Splunk bucket. It also contains events of a certain period.
505
Explain the bucket lifecycle ?
Bucket lifecycle includes following stages:
Hot - It contains newly indexed data and is open for writing. For each index, there are one or more hot buckets available
Warm - Data rolled from hot
Cold - Data rolled from warm
Frozen - Data rolled from cold. The indexer deletes frozen data by default but users can also archive it.
Thawed - Data restored from an archive. If you archive frozen data , you can later return it to the index by thawing (defrosting) it.
506
Define a Sample Failed password query
fail* password | stats count by src, dest, user, sourcetype | sort - count | where count > 2
507
In Linux, how do you start Splunk from a command line?
bin Directory, ./splunk start
508
Which command is used to create chart for map?
geostats
509
Which chart is not used for single value?
bar
510
Which tag is not the part to implement drilldown?
lable
511
Which tag is used to create input in form in simple xml?
fieldset
512
Which tag is used for search string in simplexml for dashboard?
query
513
What are the 3 main Splunk Bucket Types and their read/write and Backup abilities?
Hot -R/W-NoBackups | Warm-ROnly-YesBackups | Cold-ROnly-YesBackups
514
Storage Bucket locations?
Host & Warm: $SPLUNK_HOME/var/lib/splunk/defaultdb/db/*
Cold ~defaultdb/colddb/*
Thawed ~ defualtdb/thaweddb/*
515
Where does frozen bucket get stored?
N/A Frozen data gets deleted or archived into a directory location you specify.
516
The location where Splunk log files are stored?
$SPLUNK_HOME/var/log/splunk
517
True/False: Splunk stores log file in splunkd.log under $SPLUNK_HOME/var/log/splunk/
True - Splunk stores log file in splunkd.log under $SPLUNK_HOME/var/log/splunk/
518
Parsing can be done in which conf file? Inputs, Props Only? Transforms only? Props & transforms?
Parsing can be done in Props & transforms.
519
If I want to change the default Splunk data store location, I need to modify which file?
Modify the splunk-launch.conf to change the defualt splunk data store location.
520
Which conf file is used to create index in splunk? [Index.conf, indexes.conf, indexes, index]
indexes.conf is used to create index in splunk
521
In which file we need to add LDAP group details for authentication? Authorize.conf or Authentication.conf?
Authentication.conf is used to add LDAP groups.
522
In which files are role mappings done?
authorize.conf
523
What are macros in Splunk?
Search macros are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. Macros you define, are stored in macros.conf
524
How much disk space is required to store data in Splunk?
Splunk stores data in 2 type of files/directories 1) actual data in zip files takes ~15% of file size 2) index files takes ~35% of file size So around 50% of files size require to store that file and other than this space is required to store search results.
525
what is summary index in splunk?
Summary index is used to give fast result of report/dashboard. You can store any cron/save search result in summary index so that you can reduce the data in summary index.
526
What kind of information can we pull in via inputs.conf?
```
BATCH ("Upload a file" in Splunk Web):
TCP:
Data distribution:
UDP:
FIFO (First In, First Out queue):
Scripted Input:
File system change monitor (fschange monitor)
File system monitoring filters:
http: (HTTP Event Collector)
HTTP Event Collector (HEC) - Local stanza for each token
WINDOWS INPUTS:
Performance Monitor
Windows Event Log Monitor
Event Log whitelist and blacklist formats
Active Directory Monitor
Remote Queue Monitor
SQS specific settings
Windows Registry Monitor
Windows Host Monitoring
```
527
Command to setup splunk heavy forwarder?
splunk enable app SplunkForwarder -auth :
528
What is the Splunk precedence order Globally?
System local, App local, App default, System default.
529
What is the Splunk precedence order within app or user context?
User Directories for current user, App Directories for current running app, App Dirs for all other apps, System Dirs.
530
Migration: After moving Splunk index db, what would you edit to reflect this new location?
Edit $SPLUNK_HOME/etc/splunk-launch.conf
531
What file sets limits on disk usage?
server.conf
[diskUsage]
minFreeSpace =
532
What is the minimum free space in splunk?
5000MB or 5GB
533
What is TSIDX file and how is it used?
A time-series index file; A tsidx file associates each unique keyword in your data with location references to events, which are stored in a companion rawdata file. Together, the rawdata file and its related tsidx files make up the contents of an index bucket.
Each search you run scans tsidx files for the search keywords and uses their location references to retrieve from the rawdata file the events to which those keywords refer. To speed up searches, bloom filters narrow the set of tsidx files that Splunk Enterprise must search to get accurate results.
534
What Splunk file would be used to reduce TSIDX disk usage?
indexes.conf
[indexname]
enableTsidxreduction=True
timePeriodInSecBeforeTsidxReduction=86400
535
What is a Bloom Filter?
A data structure that you use to test whether an element is a member of a set. Splunk Enterprise uses bloom filters to decrease the time it requires to retrieve events from the index. This strategy is effective when you search for rare terms.
In Splunk Enterprise, bloom filters work at the index bucket level. The filters rule out buckets that do not contain keywords from the search being run. Splunk Enterprise saves time searching by focusing on the tsidx files within the bucket where the search keywords exist.
536
What Splunk files are used to manage Bloom filter retention and set Bloom Filter for specific index?
Retention is managed via limits.conf
| Create bloom filter for specific index via indexes.conf
537
Which file is used for role and mapping ?
Authorize.conf
538
[True or False]You can not search the data in frozen stage of bucket?
True
539
Attributes in indexes.conf to freeze data when it grows too old?
frozenTimePeriodInSecs
540
Which splunk License does not exist?
| Search head, forwarder, free, Splunk Enterprise?
Search head
541
Which command is used only to delete index web data ?
splunk clean eventdata -index web
542
What is the use of Add-on in splunk?
To Extract fields, parsing etc but do not provide dashboards.
543
What rights does power role have?
Can Edit all saved searches, alerts, objects, ect
544
What does can_delete role do?
Delete search or keyword
545
Which function is not a part of a single instance deployment?
Clustering
546
What does a single-instance deployment of Splunk Enterprise handle?
Input, Parsing, Indexing, and Searching
547
What are the three main default roles in Splunk Enterprise?
User, Power, Admin
548
_________ define what users can do in Splunk.
Roles
549
Splunk uses ________ to categorize the type of data being indexed.
Source Type
550
True/False. The monitor input option will allow you to continuously monitor files.
True
551
Which following search mode toggles behavior based on the type of search being run?
Smart
552
What is the order of evaluation for Boolean operations in Splunk?
NOT, OR, AND
553
What file needs to be configured on Indexer to start receiving data and what port?
inputs.conf for port 9997
554
Where is the servercalss.conf file stored and what does it do?
$SPLUNK_HOME/etc/system/local
Server classes are essentially categories. They use filters to control what clients they apply to, contain a set of applications, and may define deployment server behavior for the management of those applications.
555
What is a fishbucket?
Used to decipher file input issues.
A subdirectory where Splunk software tracks how far into a file indexing has progressed, to enable the software to detect when data has been added to the file and resume indexing. The fishbucket subdirectory contains seek pointers and CRCs for indexed files.
default location /opt/splunk/var/lib/splunk
556
How does the indexer store indexes?
As the indexer indexes your data, it creates a number of files. These files contain two types of data: The raw data in compressed form (rawdata) Indexes that point to the raw data, plus some metadata files (index files) Together, these files constitute the Splunk Enterprise index.
557
[True/False]Deployment server push configuration files to deployment client
False
558
Deployment client uses which configuration files to connect deployment server ?
serverclass.conf, deploymentclient.conf, inputs.conf, outputs.conf
deploymentclient.conf
559
[True/False]The deployment server does not automatically deploy apps in response to direct edits of serverclass.conf
True
560
A dedicated deployment server can handle how many clients ?
500 - 1000 Clients, even more than this and it depends of the periodicity, and the size of the bundles to deploy.
561
What is Splunk DMC?
Distributed Management Console;
Dashboard providing insight to your deployment. Install on Search head(not rec for prod), License master, or Deployment server.
562
Which stanza can be used to destroy a file after reading the file?[ fschange, monitor, batch, destroy ]
Batch - Use batch to set up a one time, destructive input of data from a source. For continuous, non-destructive inputs, use monitor. Remember, after the batch input is indexed, Splunk Enterprise deletes the file.
563
To receive data from forwarder in indexer in inputs.conf file, which is used in stanza ? [ tcp, splunktcp, udp, forwardertcp ]
splunktcp
564
What is splunk?
An application that ingests machine data, indexes it, and visualizes it for users to
565
Why would I want to learn splunk?
The money in the field is great, the amount of data that can be analyzed is incredible, 70% of companies are transitioning into splunk, allows you to gain new insight, there is a community called ninjas that allows you to be interactive with, and its fun!
566
What are the different flavors of spunk?
Enterprise, Cloud, Light
567
What is a forwarder
A script that sends data from a device to the splunk device
568
What is an event
A single entity such as an row in a table.
Or if you have an alert that comes into splunk which will be timestamped
569
What is SPL
Splunk Processing Language
570
and
a space is an implied ____ in a search string
571
by default, search results are NOT returned in ____ order.
chronological, alphabetical, ascii
572
Search controls that will NOT re-run a search
1. selecting a range of bars on the timeline
2. selecting a bar on the timeline
3. deselect
573
Using the export function, you can export a maximum of 2000 results
false
574
default fields are NOT added to every event in Splunk at INDEX time
false
575
these kinds of fields are identified in your data at INDEX time.
default fields
576
field discovery occurs at _____ time
search
577
the fields sidebar does NOT show________
all extracted fields
578
fast, optimized, verbose are all selectable search modes
false (fast, smart, verbose)
579
only splunk admninistrators can assign selected fields
false
580
which search mode automatically decides how to return fields based on your search?
smart
581
splunk alerts are based on historical searches only
false
582
splunk alerts can be based on searches that run ______
1. on a regular schedule
| 2. in real-time
583
A real-time alert is __________
constantly running in the background
584
dashboards are
views
585
Running a scheduled saved report ___________
returns a fresh result set
586
Once you create a report you can
1. add the report to a dashboard
2. open the report and edit it
3. accelerate slow running reports
587
the stats command will create a _______ by default
table
588
A pivot table is a _______
table, chart or visualization based on a datamodel set
589
after you create a pivot you can save it as a ___________
1. dashboard panel
| 2. report
590
which of the following would match this search? SEARCH: "accounting response"
accounting response for TradeID
591
true about Splunk search language
1. treats field values in a case-INsensitive manner
| 2. allows searching on a keyword
592
the following searches will NOT return the same results: search 1 purchase ==== search 2 action=purchase
true
593
use this command to control which fields are extracted at search time and to (typically) improve search
fields -
594
this command displays the least common values in a specific field
rare
595
this command returns an unlimited number of results. search: error | top host limit =9999
false
596
this list clause is used to group the output of a stats command by a specific name
rex
597
which of the following will show the maximum bytes?
sourcetype=access_* | stats max(bytes)
598
when a search returns _________, you can view the results as a list
statistical values
599
clicking a segment on a chart ________________
adds the highlighted value to the search criteria
600
lookups can be private for a user
true
601
use this command to use lookup fields in a search and see the lookup fields in the field sidebar
inputlookup
602
what is the correct order of steps for creating a new lookup?
1. create the lookup table
2. define the lookup
3. configure the lookup to run automatically
603
in automatic lookup definitions, you can only have 3 output fields maximum
false
604
lookups allow you to overwrite your raw event
true
605
which of the following are responsible for collecting data and sending it for further processing?
forwarders
606
which of the following are responsible for parsing incoming data and storing data on disc?
indexers
607
which of the following are responsible for dispatching a search request?
search head
608
it is not possible for a single instance of Splunk to manage the input, parsing, and indexing of machine data.
false
609
two types of splunk indexes
```
raw data (full log files)
index files (key keywords from logs)
```
610
raw data
full log files
611
index files
key keywords from logs
612
splunk preconfigured indexes
main
_internal
_audit:
613
_internal
Stores Splunk Enterprise internal logs and processing metrics.
614
_audit
Contains events related to the file system change monitor, auditing, and all user search history
615
main
This is the default Splunk Enterprise index. All processed data is stored here unless otherwise specified.
616
Splunk indexer working can be divided in two stages:
parsing phase and indexing phase
617
Parsing stage
While parsing splunk performs and extracts a set of default for each event like host, source, and sourcetype.
618
Source
The source of an event is the name of the file, stream, or other input from which the event originates
619
Sourcetype
The source type of an event is the format of the data input from which it originates like for windows .evt files from event viewer
620
Host
An event's host value is typically the hostname, IP address, or fully qualified domain name of the network host from which the event originated
621
Configuring character set encoding
Its nothing but way of storing character/words in memory
622
Identifying line termination using linebreaking rules
if your logs are very long or messy then it will break them in small parts easy to understand
623
Identifying timestamps or creating them if they don't exis
sort logs as per time or as they occurred.
624
Indexing stage
Splunk indexing process:
a) Breaking all events into segments called buckets that can then be searched upon. You can determine the level of segmentation, which affects indexing and searching speed, search capability, and efficiency of disk compression.
b) Building the index data structures.
c) Writing the raw data and index files to disk, where post-indexing compression occurs
Splunk parsing and indexing phases
625
How splunk stores Data?
Splunk stores all its data in directories on server called buckets. Buckets are nothing but directories on servers. A bucket moves through several stages as it ages - hot,warm,cold,frozen
626
Hot
this is the directory where all data is written and the most recent data is kept here.
Warm - the next tier down, read only and likely still searched
627
Cold
- rarely searched data as it has aged or been archived (rolled) to this bucket. While read only and still searchable, this is considered the archive tier.
628
Frozen
this is data that is pushed to a dead media like tape or deleted. There is a thawing process possible if not deleted completely to allow data to be pushed back into higher tier buckets
629
Freeze data when an index grows too large
Set maxTotalDataSizeMB
630
How to create new index in splunk?
There are multiple ways to create new index in splunk indexer. You can achieve it t through GUI/CLI or simply editing index.conf at
$splunk home/etc/system/local.
Simplest way is through GUI (front-end). If number of index are more then simply edit inputs.conf and add all index name to it. Below are steps for the same.
631
How to create a new index using index.conf?
To add a new index, add a stanza to indexes.conf in $SPLUNK_HOME/etc/system/local, identified by the name of the new index.
For example:
[newindex] homePath= coldPath= thawedPath= ...
632
Props.conf is used to define following configurations
Configuring timestamp recognition
Convertig timeformat to our default timeformat
Configuring linebreaking for multiline events.
Setting up character set encoding
Defining manual filed extarction regex
Allowing processing of binary files.
Configuring event segmentation.
Overriding Splunk's automated host and source type matching
Defining where to lookup for lookup table etc
633
Location of props.conf:
/opt/splunk/etc/system/default/props.conf --->never edit this file as its conatians default configuration
/opt/splunk/etc/system/local/props.conf ----->We can edit this file for configurations
634
How to configure props.conf in splunk?
There happens to be seven attributes you want to set in props.conf every time you bring data into Splunk
635
TIME_PREFIX
This is the first attribute is used to tell Splunk where to start to look for the timestamp in your event.
636
MAX_TIMESTAMP_LOOKAHEAD
Setting this attribute makes Splunk happy and run more efficiently because it will not have to spend any extra time and resources to find the time stamp. You can tell Splunk that your timestamp is 20 characters into your event so Splunk will not waste any time looking through the entire event.
637
TIME_FORMAT
Many people "sleep" on this attribute and shouldn't. It is very important to help Splunk interpret your data. With this attribute you are telling Splunk the format your time stamp is in using strptime Splunk will not have to try to figure out if 10/2/12 is October 2, 2012, February 10, 2012, or even something weird like December 2, 2010.
638
SHOULD_LINEMERGE
this attribute is the leader and decision maker of the group. Depending on the value of this attribute, other attributes are required. This setting should be set to "false" and used along with the LINE_BREAKER attribute, which can greatly increase processing speed.
639
LINE_BREAKER
This attribute looks the toughest and most intimidating. It identifies how your events should be broken apart. This is important because if this is not set correctly you can have data that is spread across multiple events. Using regular expressions, Splunk will look for that specific pattern and break up your events accordingly, and as mentioned before, this should be used in conjunction with SHOULD_LINEMERGE = false.
640
TRUNCATE
- This attribute is nothing to sneeze at. Measured in bytes, this attribute limits the length of an event (line of data), and will break when the limit is met. The default value is 10000 so set this to 999999 bytes or more depending on the size of your event. Because your data is not being broken up into multiline events (given SHOULD_LINEMERGE = false) you will want to ensure your events do not get broken up incorrectly.
641
TZ
the time zone attribute is probably the most forgotten of the group. You will want to set the time zone for each host in your Splunk environment. This will ensure the time is displayed correctly on your search head.
642
what is a bucket in splunk?
- a bucket are directories on servers in splunk: hot, warm, cold, frozen, thawed.
- events within splunk are broken down into
segments called buckets
- inside indexes, files, collection of databases, subdirectories
643
9997
port open for indexing
644
metadata
host, source, source type, time stamp
645
case(X,"Y",...)
Works like a case statement in shell scripting. This function takes pairs of arguments X and Y. The X arguments are Boolean expressions that will be evaluated from first to last. When the first X expression is encountered that evaluates to TRUE, the corresponding Y argument will be returned. The function defaults to NULL if none are true.
646
An admin does what?
Install apps, create knowledge objects for all users (what apps a user will see by default)
647
A power user does what?
Creates and shares knowledge objects for users of app, real-time searches
648
A Splunk user does what?
Only see own knowledge objects and those shared to them.
649
The seven main components in splunk searching and reporting?
1. Splunk bar
2. App bar
3. Search bar
4. Time range picker
5. How to search panel
6. What to search panel
7. Search History
650
The time range picker is set to _________ by default.
All-time
651
________ tab is default tab for searches
Event
652
_______ mode discovery off for event searches. No event or field data for stats searches.
Fast
653
______ mode all events and field data; switches to this mode after visualization
Verbose
654
______ mode (default-based on search string data). Field discovery ON for event searches. No event or field data for stats searches.
Smart
655
This search action button "Job V" does what?
Edit job settings, send job to background, inspect and delete job.
656
Saved searches are set to ______ by default.
private
657
________boolean is used if none is implied.
AND
658
Exact phrases use______
quotes
659
Use a _______ for searching a string with quotes in the string.
Backslash
| Example: info="user "chrisV4" not in database" info="user\"chrisV4\" not in database "
660
Three default search fields automatically selected?
Source, Host, Sourcetype
661
_______ sidebar shows all field extracted at search time.
Fields
662
_______ Fields appear in event, default-host, sourcetype, source
Selected
663
Clicking on a field shows a list of _______, ________, and ________.
values, count, and percentage
664
These fields can launch a quick report by clicking on them (4)
top values, top values by time, rare values, events with this field
665
Use ______ to limit search to only one sourcetype
sourcetype=
666
Field names _____ case sensitive- Values _______ case sensitive
are, are not
667
The field operators are used with numerical string values (symbols)
= != -->
668
These symbols are only used with numerical values?
> >= < <= -->
669
Using _____ and ____ (symbols) would return the same results.
NOT, !=
670
Use _______ to nest boolean searches
parenthesis
671
When creating reports you can edit, clone, embed, and delete under the ______ tab
report
672
What are the three ways to create visualizations?
1. Select a field from the fields sidebar
2. Use the pivot interface
3. Use the Splunk search language commands in the search bar with statistics and visualization tabs
673
Save visual reports as _______ or _______
report or dashboard pannel
674
Dashboards are searches gathered together and can use _______input or ________ visualization
form or custom
675
Default time for pivot is ______
all the time
676
_______ object is the main source of data
Root
677
_______ object acts like an AND boolean
Child
678
_________ pivot allows instant access to data without having a data model
Instant
679
Search terms include (6)
Keywords, booleans, phrases, fields, wildcards, and comparisons.
680
Comparison symbols
=, !=, <=, >, >=
681
Best practices to use while searching in Splunk (4)
1. Time is the most efficient filter
2. More you tell search the better your results
3. Inclusion is better than exclusion
4. Filter as early as possible
682
_____ are case insensitive.
| components of search language
Search terms
683
______ tell Splunk what we want to do with results (ex. stats)
(components of search language)
Commands
684
______how we want to deal with results (ex. list)
| components of search language
Functions
685
______ variables to apply to function (ex. Product name)
| components of search language
Arguments
686
_______ how we want results defined.
| components of search language
Clauses
687
_____ is used to pass current results to the next component
Pipe
688
_________ command works from left to right
Search
689
Once and item is filtered _____ it is no longer available in the search string
Out
690
_____ command include or exclude fields from search results.
Fields
691
Exclude a field by using ______ symbol
minus (-)
692
Primary fields _______ and _______ will always be extracted, but can also be removed by using the minus symbol
_time & _raw
693
Field_____happens after field______only affecting displayed results.
exclusion, extraction
694
________ command retains searched data in a tabulated format
table
695
In regards to a rename command, once a field is renamed the ______ name is not available to later search commands
original
696
This command removes events with duplicate values
Dedup
697
This command displays results in ascending or descending order.
Sort
698
This command combine fields from external sources to searched events, based on event field
Lookup
699
This command produces statistics of a search result
Stats command
700
This command shows number of events matching search criteria
Stats count
701
This command is the sum of numerical value
Stats Sum command
702
This is a command that preforms stats aggregation against time
Timechart command
703
___ split data by an additional field
by
704
Usenull = _____ will remove NULL values
f
705
5 Main components of Splunk ES
Index Data, Search & investigate, Add knowledge, Monitor & Alert, Report & Analyze.
706
len(x)
Description: This function returns the character length of a string X.
Basic example
... | eval n=len(field)
707
lower(x)
Description: This function takes one string argument and returns the string in lowercase.
Basic example
The following example returns the value provided by the field username in lowercase.
... | eval username=lower(username)
708
ltrim(x,y)
Description: This function takes one or two arguments X and Y, and returns X with the characters in Y trimmed from the left side. If Y is not specified, spaces and tabs are removed.
Basic example
The following example trims the leading spaces and all of the occurrences of the letter Z from the left side of the string. The value that is returned is x="abcZZ ".
... | eval x=ltrim(" ZZZZabcZZ ", " Z")
709
replace(x,y,z)
Description: This function returns a string formed by substituting string Z for every occurrence of regex string Y in string X. The third argument Z can also reference groups that are matched in the regex.
Basic example: The following example returns date, with the month and day numbers switched. If the input is 1/14/2017 the return value would be 14/1/2017.
... | eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")
710
rtrim(x,y)
Description: This function takes one or two arguments X and Y, and returns X with the characters in Y trimmed from the right side. If Y is not specified, spaces and tabs are removed.
Basic example: The following example returns n="ZZZZabc".
... | eval n=rtrim(" ZZZZabcZZ ", " Z")
711
spath(x,y)
Description: This function takes two arguments, an input source field X and an spath expression Y, that is the XML or JSON formatted location path to the value that you want to extract from X.
Basic example: The following example returns the hashtags from a twitter event.
index=twitter | eval output=spath(_raw, "entities.hashtags")
712
substr(x,y,z)
Description: This function returns a substring of X, starting at the index specified by Y with the number of characters specified by Z. If Z is not provided, the function returns the rest of the string
Basic example: The following example concatenates "str" and "ing" together, returning "string":
... | eval n=substr("string", 1, 3) + substr("string", -3)
713
trim(x,y)
Description: This function takes one or two arguments X and Y and returns X with the characters in Y trimmed from both sides. If Y is not specified, spaces and tabs are removed.
Basic example: The following example returns "abc".
... | eval n=trim(" ZZZZabcZZ ", " Z")
714
upper(x)
Description: This function takes one string argument and returns the string in uppercase.
Basic example: The following example returns the value provided by the field username in uppercase.
... | eval n=upper(username)
715
urldecode(x)
Description: This function takes one URL string argument X and returns the unescaped or decoded URL string.
Basic example
The following example returns "http://www.splunk.com/download?r=header".
... | eval n=urldecode("http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fr%3Dheader")
716
A group of indexers configured to replicate each other's data is called a ________.
Index Cluster
717
__________ is often the biggest bottle neck in the Splunk indexing pipeline.
Disk I/O
718
Search heads do not require as much ______ as indexers but require more _________.
1. disk space
| 2. CPU power
719
Adding more machines no matter the hardware will make your deployment perform better.
False
720
Splunk indexers and Search Heads on virtual machines should have ____ of the vCPU reserved to them.
100%
721
Keeping ____ synchronized across your deployment, makes sure events are returned in the proper order.
time
722
What command is used to start the Splunk Enterprise server?
./splunk start
723
This command can be used to make Splunk start each time the server is booted.
./splunk enable boot-start
724
When logging into Splunk Enterprise for the first time, a username of ______ and a password of are used.
1. admin
| 2. changeme
725
The functions of the data pipeline vary drastically depending on the deployment.
False
726
Splunk Enterprise licenses specify how much data you can index per __________.
day
727
Any editing done to .conf files should be done in the ________ directory.
local
728
The ________ index is used when an index is not specified at input time.
main
729
Having multiple indexes allows:
Faster searches
Access limiting
Multiple retention policies
730
As data is input into Splunk Enterprise, it is first placed into a ________ bucket.
hot
731
Some differences between hot and warm buckets are:
Hot buckets are writable, warm buckets are not.
Hot buckets are searched first.
The naming convention.
732
When a bucket is frozen, by default it is moved to a different location before deleting.
False
733
The timezone setting in a user's account will effect the timestamp shown in events.
True
734
Only the ________ role can use the Delete Command by default.
can_delete
735
When mixing authentication sources, scripted authentication will always take precedence.
False
736
In most production environments, _______ will be used as your main source of data input.
forwarders
737
Splunk uses ____________ to categorize the type of data being indexed.
sourcetypes
738
The server that data is forwarded to is called the ______________.
receiver
739
Indexing on a Heavy Forwarder does not affect your license.
False
740
The following can be used to build apps for Splunk:
Simple XML
Splunk JavaScript
SDKs
741
When migrating from a single instance deployment to a distributed environment, you will want to use the existing instance as an _______.
indexer
742
An indexer in a distributed search environment is called a __________.
search peer
743
It is a best practice to ____________ forwarders across all indexers in a search peer group.
load balance
744
The management port is required when adding a search peer to a search head.
True
745
Splunk Enterprise can be installed virtual environments.
True
746
____________ is the system process that handles indexing, searching, forwarding and the web interface for Splunk Enterprise.
Splunkd
747
Splunk Enterprise should always be run as root in a *NIX environment.
False
748
It is suggested that you have a single deployment instance available for _________.
testing and development
749
A total of ____ cores are recommended per search head.
16
750
Forwarders should never be installed on Windows servers.
False
751
SplunkWeb is accessed on port _______ by default.
8000
752
Properties in the _______ file allow you to configure how data is transformed as it is processed.
not later
753
The segment of the data pipeline that stores user's knowledge objects is the __________ segment.
not indexing
not data ainput
not parsing
754
This component is NOT installed from the Splunk Enterprise Package.
Universal Forwarder
755
Splunk Enterprise deployment typically has ___ processing tiers.
3
756
The segment of the data pipeline that stores user's knowledge objects is the _______ segment.
not parsing not data input
757
The default management port for Splunkd is:
8089
758
Search Heads require more _____ than indexers.
CPU Power
759
Splunk uses the ________ index when indexing it's own logs and metrics.
_internal
760
Event separation happens during the __________ segment of the data pipeline.
parsing
761
A license violation causes all data to stop being indexed.
False
762
The functions of the data pipeline vary drastically depending on the deployment.
False
763
properties in the _______ file allow you to configure how data is transformed as it is processed.
not alter.conf
764
Which Splunk search command allows you to perform mathematical functions on field values?
Eval
765
If you want to format values without changing their characteristics, which would you use?
The Fieldformat Command.
766
By default, the Fillnull Command replaces null values with this:
0
767
You can only use one Eval Command per search.
False
768
Knowledge objects can be used to normalize data?
True
769
A Common Information Model (CIM) is supported by Splunk.
True
770
What are the predefined ways knowledge objects can be shared?
All apps
Private
Specifiic App
771
Field aliases are used to __________ data.
normalize
772
You can only have one field alias per field.
False
773
Field Aliases ___________________
Can be referenced by lookup tables.
Are applicable to a specified app context.
Make correlation easier.
774
Calculated fields are shortcuts for _______________.
Eval Commands
775
Calculated fields can use lookup tables.
False
776
The easiest way to extract a field is from ____________, allowing you to skip a few steps.
The event actions menu
777
When editing a field extraction, you will be working with _________________.
The regular expression.
778
You can extract multiple fields with the field extractor.
True
779
______________ is a field extraction method for events that contain fields separated by a character.
delimiter
780
Fields extracted with the field extractor
Are persistent
Are specific to a host, source or sourcetype.
Are reusable in multiple searches.
781
You can only add one tag per field value pair.
False
782
Which search would limit an "alert" tag to the "host" field?
tag::host=alert
783
__________ allow you to categorize events based on search terms.
Event Types
784
Tags can be added to event types.
True
785
Event types do NOT show up in the field list.
False
786
Splunk suggests naming your Knowledge Objects using _______ segmented keys.
6
787
A workflow action can _________________.
Send field values to external resources.
Pass variables to a URL.
Execute a secondary search.
788
To escape the "fieldname" value which command would you use? $_________fieldname$
!
789
Which actions can be triggered by an alert?
List in triggered alerts
Send Email
Run a script
790
What is the correct way to name a macro with two arguments?
dostuff(2)
791
Validating macro arguments can be done with which type of command?
boolean expressions
| eval expressions
792
After creating your data model, the next step is to ___________
Add a root object
793
Root search objects benefit from acceleration.
False
794
_________ objects can be added to a root event object to narrow down the search.
Child
795
What attributes can be added to an object?
```
Auto-Extracted
Eval Expression
Lookup
Regular Expression
Geo IP
```
796
You can add additional child objects to either existing objects or the root object.
True
797
After you configure a lookup, its fields can be found in the fields sidebar and you can use them in a search.
True
798
No matter what user role creates the field alias, it is always set to Private by default.
True
799
Running concurrent reports and the searches behind them puts very low demand on your system hardware.
False
800
Search macros can only be used once in a given search.
False
801
The results of a macro can not be piped to other commands.
False
802
When building your data model, Splunk suggests you use root search objects whenever possible.
False
803
Some differences between hot and warm buckets are:
Hot buckets are writable, warm buckets are not.
Hot buckets are searched first.
The naming convention.
804
When a bucket is frozen, by default it is moved to a different location before deleting.
False
805
The timezone setting in a user's account will effect the timestamp shown in events.
True
806
Only the ________ role can use the Delete Command by default.
can_delete
807
The ______ role has the most capabilities of the predefined splunk roles.
admin`
808
When mixing authentication sources, scripted authentication will always take precedence.
False
809
An indexer in a distributed search environment is called a __________.
search peer
810
It is a best practice to ____________ forwarders across all indexers in a search peer group.
load balance
811
The management port is required when adding a search peer to a search head.
True
812
DMC stands for
Distributed Management Console
813
The segment of the data pipeline that stores user's knowledge objects is the __________ segment.
not indexing
not data ainput
not parsing
814
The default management port for Splunkd is:
8089
815
The following searches will return the same results: SEARCH 1: web AND error SEARCH 2: web and error
False
816
Time stamp are stored ____
in a consistent format
817
Max events displayed by transaction command
1,000
818
5 Main components of Splunk ES
Index Data, Search & investigate, Add knowledge, Monitor & Alert, Report & Analyze.
819
What does index data do? (3)
1. Collects data
2. Label data with source type
3. Stored in splunk index
820
Usenull = _____ will remove NULL values
f
821
append
Appends subsearch results to current results.
822
appendcols
Appends the fields of the subsearch results to current results. first results to first result. second to second etc.
823
appendpipe
Appends the result of the subpipeline applied to the current result set to results.
824
arules
Finds association rules between field values.
825
associate
Identifies correlations between fields.
826
contingency
Builds a contingency table for two fields.
827
counttable
Builds a contingency table for two fields.
828
ctable
Builds a contingency table for two fields.
829
correlate
Calculates the correlation between different fields.
830
diff
Returns the difference between two search results.
831
join
SQL-like joining of results from the main results pipeline with the results from the subpipeline.
832
selfjoin
Joins results with itself.
833
set
Performs set operations (union diff intersect) on subsearches.
834
stats
Provides statistics grouped optionally by fields. See Functions for stats chart and timechart in the Splunk Enterprise Search Reference.
835
transaction
Groups search results into transactions.
836
audit
Returns audit trail information that is stored in the local audit index.
837
dbinspect
Returns information about the specified index.
838
eventcount
Returns the number of events in an index.
839
metadata
Returns a list of source sourcetypes or hosts from a specified index or distributed search peer.
840
typeahead
Returns typeahead information on a specified prefix.
841
crawl
Crawls the filesystem for new sources to add to an index.
842
delete
Delete specific events or search results.
843
input
Adds sources to Splunk or disables sources from being processed by Splunk.
844
accum
Keeps a running total of the specified numeric field.
845
addinfo
Add fields that contain common information about the current search.
846
addtotals
Computes the sum of all numeric fields for each result.
847
delta
Computes the difference in field value between nearby results.
848
eval
Calculates an expression and puts the value into a field. See Functions for eval and where in the Splunk Enterprise Search Reference.
849
iplocation
Adds location information such as city country latitude longitude and so on based on IP addresses.
850
multikv
Extracts field-values from table-formatted events.
851
rangemap
Sets RANGE field to the name of the ranges that match.
852
relevancy
Adds a relevancy field which indicates how well the event matches the query.
853
strcat
Concatenates string values and saves the result to a specified field.
854
erex
Allows you to specify example or counter example values to automatically extract fields that have similar values.
855
extract and kv
Extracts field-value pairs from search results.
856
kvform
Extracts values from search results using a form template.
857
rex
Specify a Perl regular expression named groups to extract fields while you search.
858
spath
Provides a straightforward means for extracting fields from structured data formats XML and JSON.
859
xmlkv
Extracts XML key-value pairs.
860
convert
Converts field values into numerical values.
861
filldown
Replaces NULL values with the last non-NULL value.
862
fillnull
Replaces null values with a specified value.
863
makemv
Change a specified field into a multivalued field during a search.
864
nomv
Changes a specified multivalued field into a single-value field at search time.
865
reltime
Converts the difference between 'now' and '_time' to a human-readable value and adds adds this value to the field 'reltime' in your search results.
866
rename
Renames a specified field; wildcards can be used to specify multiple fields.
867
replace
Replaces values of specified fields with a specified new value.
868
analyzefields and af
Analyze numerical fields for their ability to predict another discrete field.
869
anomalies
Computes an "unexpectedness" score for an event.
870
anomalousvalue
Finds and summarizes irregular or uncommon search results.
871
cluster
Clusters similar events together.
872
kmeans
Performs k-means clustering on selected fields.
873
outlier
Removes outlying numerical values.
874
rare
Displays the least common values of a field.
875
iplocation
returns location information such as city country latitude longitude and so on based on IP addresses.
876
geostats
Generate statistics which are clustered into geographical bins to be rendered on a world map.
877
predict
Enables you to use time series algorithms to predict future values of fields.
878
trendline
Computes moving averages of fields.
879
x11
Enables you to determine the trend in your data by removing the seasonal pattern.
880
addtotals
Computes the sum of all numeric fields for each result.
881
bin and discretize
Puts continuous numerical values into discrete sets.
882
chart
Returns results in a tabular output for charting. See Statistical and charting functions in the Splunk Enterprise Search Reference.
883
contingency and counttable and ctable
Builds a contingency table for two fields.
884
correlate
Calculates the correlation between different fields.
885
eventcount
Returns the number of events in an index.
886
eventstats
Adds summary statistics to all search results.
887
gauge
Transforms results into a format suitable for display by the Gauge chart types.
888
makecontinuous
Makes a field that is supposed to be the x-axis continuous (invoked by chart/timechart)
889
outlier
Removes outlying numerical values.
890
rare
Displays the least common values of a field.
891
stats
Provides statistics grouped optionally by fields. See Statistical and charting functions in the Splunk Enterprise Search Reference.
892
streamstats
Adds summary statistics to all search results in a streaming manner.
893
timechart
Create a time series chart and corresponding table of statistics. See Statistical and charting functions in the Splunk Enterprise Search Reference.
894
top
Displays the most common values of a field.
895
trendline
Computes moving averages of fields.
896
untable
Converts results from a tabular format to a format similar to stats output. Inverse of xyseries and maketable.
897
xyseries
Converts results into a format suitable for graphing.
898
sendemail
Emails search results, either inline or as an attachment, to
| one or more specified email addresses
899
mvcombine
Combines events in search results that have a single differing field value into one result with a multivalue field of the differing field.
900
regex
Removes results that do not match the specified regular expression.
901
searchtxn
Finds transaction events within specified search constraints.
902
table
Creates a table using the specified fields.
903
uniq
Removes any search that is an exact duplicate with a previous result.
904
where
Performs arbitrary filtering on your data. See Evaluation functions in the Splunk Enterprise Search Reference.
905
untable
Converts results from a tabular format to a format similar to stats output. Inverse of xyseries and maketable.
906
gentimes
Returns results that match a time-range.
907
mvexpand
Expands the values of a multivalue field into separate events for each value of the multivalue field.
908
savedsearch
Returns the search results of a saved search.
909
search
Searches Splunk indexes for matching events. This command is implicit at the start of every search pipeline that does not begin with another generating command.
910
loadjob
Loads events or results of a previously completed search job.
911
typer
Calculates the eventtypes for the search results.
912
head
Returns the first number n of specified results.
913
reverse
Reverses the order of the results.
914
sort
Sorts search results by the specified fields.
915
tail
Returns the last number N of specified results
916
inputcsv
Loads search results from the specified CSV file.
917
loadjob
Loads events or results of a previously completed search job.
918
outputcsv
Outputs search results to a specified CSV file.
919
outputtext
Ouputs the raw text field (_raw) of results into the _xml field.
920
sendemail
Emails search results either inline or as an attachment to one or more specified email addresses.
921
map
A looping operator, performs a search over each search result.
922
search
Searches Splunk indexes for matching events. This command is implicit at the start of every search pipeline that does not begin with another generating command.
923
format
Takes the results of a subsearch and formats them into a single result.
924
join
SQL-like joining of results from the main results pipeline with the results from the subpipeline.
925
return
Specify the values to return from a subsearch.
926
set
Performs set operations (union diff intersect) on subsearches.
927
localize
Returns a list of the time ranges in which the search results were found.
928
reltime
Converts the difference between 'now' and '_time' to a human-readable value and adds adds this value to the field 'reltime' in your search results.
929
analyzefields
Analyze numerical fields for their ability to predict another discrete field. See Also anomalousvalue.
930
anomalies
Computes an "unexpectedness" score for an event. See Also anomalousvalue & cluster & kmeans & outlier.
931
anomalousvalue
Finds and summarizes irregular or uncommon search results. See Also analyzefields & anomalies & cluster & kmeans & outlier.
932
append
Appends subsearch results to current results. See Also appendcols & appendcsv & join & set.
933
appendcols
Appends the fields of the subsearch results to current results first results to first result second to second etc. See Also append & appendcsv & join & set.
934
appendpipe
Appends the result of the subpipeline applied to the current result set to results. See Also append & appendcols & join & set.
935
arules
Finds association rules between field values. See Also associate & correlate.
936
associate
Identifies correlations between fields. See Also correlate and contingency.
937
audit
Returns audit trail information that is stored in the local audit index.
938
autoregress
Sets up data for calculating the moving average. See Also accum & autoregress & delta & trendline & streamstats.
939
bin and discretize
Puts continuous numerical values into discrete sets. See Also chart and timechart.
940
bucketdir
Replaces a field value with higher-level grouping such as replacing filenames with directories. See Also cluster and dedup.
941
chart
Returns results in a tabular output for charting. See Functions for stats chart and timechart in the Splunk Enterprise Search Reference. See Also timechart
942
cluster
Clusters similar events together. See Also anomalies anomalousvalue cluster kmeans outlier
943
concurrency
Uses a duration field to find the number of "concurrent" events for each event. See Also timechart
944
contingency and counttable and ctable
Builds a contingency table for two fields. See Also associate correlate
945
convert
Converts field values into numerical values. See Also eval
946
correlate
Calculates the correlation between different fields. See Also associate & contingency
947
dbinspect
Returns information about the specified index.
948
delta
Computes the difference in field value between nearby results. See Also accum & autoregress & trendline & streamstats
949
diff
Returns the difference between two search results.
950
erex
Allows you to specify example or counter example values to automatically extract fields that have similar values. See Also extract & kvform & multikv & regex & rex & xmlkv
951
eventcount
Returns the number of events in an index. See Also dbinspect
952
eventstats
Adds summary statistics to all search results. See Also stats
953
extract and kv
Extracts field-value pairs from search results. See Also kvform & multikv & xmlkv & rex
954
fieldformat
Expresses how to render a field at output time without changing the underlying value. See Also eval & where
955
fields
Removes fields from search results.
956
fieldsummary
Generates summary information for all or a subset of the fields. See Also af & anomalies & anomalousvalue & stats
957
filldown
Replaces NULL values with the last non-NULL value. See Also fillnull
958
fillnull
Replaces null values with a specified value.
959
findtypes
Generates a list of suggested event types. See Also typer
960
foreach
Run a templatized streaming subsearch for each field in a wildcarded field list. See Also eval
961
format
Takes the results of a subsearch and formats them into a single result.
962
from
Retrieves data from a dataset such as a data model dataset a CSV lookup a KV Store lookup a saved search or a table dataset.
963
gauge
Transforms results into a format suitable for display by the Gauge chart types.
964
gentimes
Generates time-range results.
965
geostats
Generate statistics which are clustered into geographical bins to be rendered on a world map. See Also stats & xyseries
966
head
Returns the first number n of specified results. See Also reverse & tail
967
highlight
Causes Splunk Web to highlight specified terms.
968
history
Returns a history of searches formatted as an events list or as a table. See Also search
969
input
Adds sources to Splunk or disables sources from being processed by Splunk.
970
inputcsv
Loads search results from the specified CSV file. See Also loadjob & outputcsv
971
iplocation
Extracts location information from IP addresses.
972
join
SQL-like joining of results from the main results pipeline with the results from the subpipeline. See Also selfjoin & appendcols
973
kmeans
Performs k-means clustering on selected fields. See Also anomalies & anomalousvalue & cluster & outlier
974
kvform
Extracts values from search results using a form template. See Also extract & kvform & multikv & xmlkv & rex
975
loadjob
Loads events or results of a previously completed search job. See Also inputcsv
976
localize
Returns a list of the time ranges in which the search results were found. See Also map & transaction
977
makecontinuous
Makes a field that is supposed to be the x-axis continuous (invoked by chart/timechart) See Also chart & timechart
978
makemv
Change a specified field into a multivalued field during a search. See Also mvcombine & mvexpand & nomv
979
map
A looping operator performs a search over each search result.
980
metadata
Returns a list of source sourcetypes or hosts from a specified index or distributed search peer. See Also dbinspect
981
metasearch
Retrieves event metadata from indexes based on terms in the logical expression. See Also metadata & search
982
mstats
Calculates statistics for the measurement metric_name and dimension fields in metric indexes. See Also stats
983
multikv
Extracts field-values from table-formatted events.
984
multisearch
Run multiple streaming searches at the same time. See Also append & join
985
mvcombine
Combines events in search results that have a single differing field value into one result with a multivalue field of the differing field. See Also mvexpand & makemv & nomv
986
mvexpand
Expands the values of a multivalue field into separate events for each value of the multivalue field. See Also mvcombine & makemv & nomv
987
nomv
Changes a specified multivalued field into a single-value field at search time. See Also makemv & mvcombine & mvexpand
988
outlier
Removes outlying numerical values. See Also anomalies & anomalousvalue & cluster & kmeans
989
outputcsv
Outputs search results to a specified CSV file. See Also inputcsv & outputtext
990
outputtext
Ouputs the raw text field (_raw) of results into the _xml field. See Also outputtext
991
predict
Enables you to use time series algorithms to predict future values of fields. See Also x11
992
rangemap
Sets RANGE field to the name of the ranges that match.
993
rare
Displays the least common values of a field. See Also stats & top
994
regex
Removes results that do not match the specified regular expression. See Also rex & search
995
relevancy
Calculates how well the event matches the query.
996
reltime
Converts the difference between 'now' and '_time' to a human-readable value and adds adds this value to the field 'reltime' in your search results. See Also convert
997
rename
Renames a specified field; wildcards can be used to specify multiple fields.
998
replace
Replaces values of specified fields with a specified new value.
999
rest
Access a REST endpoint and display the returned entities as search results.
1000
return
Specify the values to return from a subsearch. See Also format & search
1001
reverse
Reverses the order of the results. See Also head & sort & tail
1002
rex
Specify a Perl regular expression named groups to extract fields while you search. See Also extract & kvform & multikv & xmlkv & regex
1003
rtorder
Buffers events from real-time search to emit them in ascending time order when possible.
1004
savedsearch
Returns the search results of a saved search.
1005
script and run
Runs an external Perl or Python script as part of your search.
1006
scrub
Anonymizes the search results.
1007
search
Searches Splunk indexes for matching events.
1008
searchtxn
Finds transaction events within specified search constraints. See Also transaction
1009
selfjoin
Joins results with itself. See Also join
1010
sendemail
Emails search results to a specified email address.
1011
set
Performs set operations (union, diff, intersect) on subsearches. See Also append & appendcols & join & diff
1012
setfields
Sets the field values for all results to a common value. See Also eval & fillnull & rename
1013
sort
Sorts search results by the specified fields. See Also reverse
1014
spath
Provides a straightforward means for extracting fields from structured data formats, XML and JSON. See Also xpath
1015
stats
Provides statistics, grouped optionally by fields. See Functions for stats, chart, and timechart in the Splunk Enterprise Search Reference. See Also eventstats & top & rare
1016
strcat
Concatenates string values.
1017
streamstats
Adds summary statistics to all search results in a streaming manner. See Also eventstats & stats
1018
table
Creates a table using the specified fields. See Also fields
1019
tags
Annotates specified fields in your search results with tags. See Also eval
1020
tail
Returns the last number n of specified results. See Also head & reverse
1021
timechart
Create a time series chart and corresponding table of statistics. See Functions for stats, chart, and timechart in the Splunk Enterprise Search Reference. See Also chart & bucket
1022
top
Displays the most common values of a field. See Also rare & stats
1023
transaction
Groups search results into transactions.
1024
transpose
Reformats rows of search results as columns.
1025
trendline
Computes moving averages of fields. See Also timechart
1026
typeahead
Returns typeahead information on a specified prefix.
1027
typer
Calculates the eventtypes for the search results. See Also typelearner
1028
uniq
Removes any search that is an exact duplicate with a previous result. See Also dedup
1029
untable
Converts results from a tabular format to a format similar to stats output. Inverse of xyseries and maketable.
1030
where
Performs arbitrary filtering on your data. See Functions for eval and where in the Splunk Enterprise Search Reference. See Also eval
1031
x11
Extracts XML key-value pairs. See Also extract & kvform & multikv & rex
1032
xmlkv
Unescapes XML.
1033
xpath
Redefines the XML path.
1034
xyseries
Converts results into a format suitable for graphing.
1035
What is the Difference between NOT and !=
Suppose you have the following fields: fieldA, FieldB, fieldC -- If you search for fieldB!=value3
You will get Results fieldB=value1, fieldB=value2
If fieldB does not exist, nothing is returned.
-----------------------------------------------------
Searching with NOT:
If you search for NOT fieldB=value3, the search returns everything except fieldB=value3:
fieldA=value1, fieldA=value2, fieldA=value3
fieldB=value1, fieldB=value2
fieldC=value1, fieldC=value2, fieldC=value3
If fieldB does not exist, NOT fieldB=value3 returns:
fieldA=value1, fieldA=value2, fieldA=value3
fieldC=value1, fieldC=value2, fieldC=value3
1036
seconds
s, sec, secs, second, seconds
1037
minutes
m, min, minute, minutes
1038
hours
h, hr, hrs, hour, hours
1039
days
d, day, days
1040
weeks
w, week, weeks
1041
months
mon, month, months
1042
quarters
q, qtr, qtrs, quarter, quarters
1043
years
y, yr, yrs, year, years
1044
For exact time ranges, the syntax for the time modifiers is %m/%d/%Y:%H:%M:%S. For example, the following search specifies a time range from 12 A.M. October 19, 2016 to 12 A.M. October 27, 2016.
earliest=10/19/2016:0:0:0 latest=10/27/2016:0:0:0
1045
The syntax for the snap to time unit is
[+|-]@.
1046
When snapping to the nearest or latest time
Splunk software always snaps backwards or rounds down to the latest time that is not after the specified time. For example, the current time is 15:45:00 and the snap to time is earliest=-h@h. The time modifier snaps to 14:00.
1047
You can also define the relative time modifier using only the snap to time unit.
to snap to a specific day of the week, use @w0 for Sunday, @w1 for Monday, and so forth. For Sunday, you can specify either w0 or w7.
1048
if you want to search for events in the previous month
specify earliest=-mon@mon latest=@mon. This example begins at the start of the previous month and ends at the start of the current month.
1049
Difference between relative time and relative snap to time
On April 28th, you decide to run a search at 14:05.
If you specify earliest=-2d, the search goes back exactly two days, starting at 14:05 on April 26th.
If you specify earliest=-2d@d, the search goes back to two days and snaps to the beginning of the day. The search looks for events starting from 00:00 on April 26th.
1050
earliest=1
If you want to search events from the start of UTC epoch time, use earliest=1. (earliest=0 in the search string indicates that time is not used in the search.)
When earliest=1 and latest=now or latest=, the search will run over all time. The difference is that:
Specifying latest=now (which is the default) does not return future events.
Specifying latest= returns future events, which are events that contain timestamps later than the current time, now.
1051
latest=now
Specify that the search starts or ends at the current time.
1052
@q, @qtr, or @quarter
Specify a snap to the beginning of the most recent quarter: Jan 1, Apr 1, July 1, or Oct 1.
1053
w0, w1, w2, w3, w4, w5, w6, and w7
Specify "snap to" days of the week; where w0 is Sunday, w1 is Monday, etc. When you snap to a week, @w or @week, it is equivalent to snapping to Sunday or @w0. You can use either w0 or w7 for Sunday.
1054
now
Now, the current time
| Wednesday, 05 February 2017, 01:37:05 P.M. now
1055
-60m
60 minutes ago
Wednesday, 05 February 2017, 12:37:05 P.M.
Equivalent modifiers -60m@s
1056
-1h@h
1 hour ago, to the hour
| Wednesday, 05 February 2017, 12:00:00 P.M.
1057
-1d@d
Yesterday
| Tuesday, 04 February 2017, 12:00:00 A.M.
1058
-24h
24 hours ago (yesterday)
| Tuesday, 04 February 2017, 01:37:05 P.M. Equivalent modifiers -24h@s
1059
-7d@d
7 days ago, 1 week ago today
| Wednesday, 28 January 2017, 12:00:00 A.M.
1060
-7d@m
7 days ago, snap to minute boundary Wednesday, 28 January 2017, 01:37:00 P.M.
1061
@w0
Beginning of the current week
| Sunday, 02 February 2017, 12:00:00 A.M.
1062
+1d@d
Tomorrow
| Thursday, 06 February 2017, 12:00:00 A.M.
1063
+24h
24 hours from now, tomorrow
| Thursday, 06 February 2017, 01:37:05 P.M. Equivalent modifiers +24h@s
1064
chained relative time offsets
You can also specify offsets from the snap-to-time or "chain" together the time modifiers for more specific relative time definitions.
1065
@d-2h
Snap to the beginning of today (12 A.M.) and subtract 2 hours from that time.
Resulting Time 10 P.M. last night.
1066
-mon@mon+7d
One month ago, snapped to the first of the month at midnight, and add 7 days.
Resulting Time The 8th of last month at 12 A.M.
1067
searches with relative time modifiers.
Example 1: Web access errors from the beginning of the week to the current time of your search (now).
eventtype=webaccess error earliest=@w0
This search returns matching events starting from 12:00 A.M. of the Sunday of the current week to the current time. Of course, this means that if you run this search on Monday at noon, you will only see events for 36 hours of data.
--------------------------------------------------------
Example 2: Web access errors from the current business week (Monday to Friday).
eventtype=webaccess error earliest=@w1 latest=+7d@w6
This search returns matching events starting from 12:00 A.M. of the Monday of the current week and ending at 11:59 P.M. of the Friday of the current week.
If you run this search on Monday at noon, you will only see events for 12 hours of data. Whereas, if you run this search on Friday, you will see events from the beginning of the week to the current time on Friday. The timeline however, will display for the full business week.
--------------------------------------------------------
Example 3: Web access errors from the last full business week.
eventtype=webaccess error earliest=-7d@w1 latest=@w6
This search returns matching events starting from 12:00 A.M. of last Monday and ending at 11:59 P.M. of last Friday
1068
access_combined
NCSA combined format http web server logs (can be generated by apache or other web servers)
Example:
10.1.1.43 - webdev [08/Aug/2005:13:18:16 -0700] "GET / HTTP/1.0" 200 0442 "-" "check_http/1.10 (nagios-plugins 1.4)"
1069
access_combined_wcookie
NCSA combined format http web server logs (can be generated by apache or other web servers), with cookie field added at end
Example:
"66.249.66.102.1124471045570513" 59.92.110.121 - - [19/Aug/2005:10:04:07 -0700] "GET /themes/splunk_com/images/logo_splunk.png HTTP/1.1" 200 994 "http://www.splunk.org/index.php/docs" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050524 Fedora/1.0.4-4 Firefox/1.0.4" "61.3.110.148.1124404439914689"
1070
access_common
NCSA common format http web server logs (can be generated by apache or other web servers)
Examples:
10.1.1.140 - - [16/May/2005:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HTTP/1.1" 404 304
1071
apache_error
Standard Apache web server error log
Example:
[Sun Aug 7 12:17:35 2005] [error] [client 10.1.1.015] File does not exist: /home/reba/public_html/images/bullet_image.gif
1072
access_combined
NCSA combined format http web server logs (can be generated by apache or other web servers)
1073
access_combined_wcookie
NCSA combined format http web server logs (can be generated by apache or other web servers) with cookie field added at end
1074
access_common
NCSA common format http web server logs (can be generated by apache or other web servers)
1075
asterisk_cdr
Standard Asterisk IP PBX call detail record
1076
asterisk_event
Standard Asterisk event log (management events)
1077
asterisk_messages
Standard Asterisk messages log (errors and warnings)
1078
asterisk_queue
Standard Asterisk queue log
1079
cisco_syslog
Standard Cisco syslog produced by all Cisco network devices including PIX firewalls routers ACS etc. usually via remote syslog to a central log host
1080
db2_diag
Standard IBM DB2 database administrative and error log
1081
exim_main
Exim MTA mainlog
1082
exim_reject
Exim reject log
1083
linux_messages_syslog
Standard linux syslog (/var/log/messages on most platforms)
1084
linux_secure
Linux securelog
1085
log4j
Log4j standard output produced by any J2EE server using log4j
1086
mysqld_error
Standard mysql error log
1087
mysqld
Standard MySQL query log; also matches the MySQL binary log following conversion to text
1088
postfix_syslog
Standard Postfix MTA log reported via the Unix/Linux syslog facility
1089
sendmail_syslog
Standard Sendmail MTA log reported via the Unix/Linux syslog facility
1090
sugarcrm_log4php
Standard Sugarcrm activity log reported using the log4php utility
1091
weblogic_stdout
Weblogic server log in the standard native BEA format
1092
websphere_activity
Websphere activity log also often referred to as the service log
1093
websphere_core
Corefile export from Websphere
1094
websphere_trlog_syserr
Standard Websphere system error log in the IBM native trlog format
1095
websphere_trlog_sysout
Standard Websphere system out log in the IBM native trlog format; similar to the log4j server log for Resin and Jboss sample format as the system error log but containing lower severity and informational events
1096
windows_snare_syslog
Standard windows event log reported through a 3rd party Intersect Alliance Snare agent to remote syslog on a Unix or Linuxserver
1097
Differentiators
```
Real Time Architecture
Universal Machine Data Platform
Schema on the Fly
Agile Reporting and Analytics
Scales from Desktop to Enterprise
Fast Time to Value
Passionate and Vibrant Community
```
1098
Splunk Offerings (core products)
Splunk Enterprise
Splunk Cloud
Splunk Light
1099
Real Time Architecture
Real-time collection, search, monitoring and analysis across massive streams of machine data in a single solution
1100
Universal Machine Data Platform
Open, extensible platform delivering integrated, end-to-end data collection, management and analysis
1101
Schema on the Fly
Search-time schema delivers flexibility to interact with the data and change perspective on the fly at search time
1102
Agile Reporting and Analytics
Interactive search and reporting, enabling rapid, interactive analysis and visualization of data.
1103
Market Segments
IT Operations
Application Delivery
Security and Compliance
1104
Splunk Premium Products
Splunk Enterprise Security
Splunk IT Service Intelligence
Splunk User Behavior Analytics (UBA)
Premium Apps
1105
Splunk Enterprise Security
Analytics driven SIEM: user to monitor, detect, analyze, investigate and repond to threats and attacks
Complimentary product. Customers must have an equivalent license of Core Splunk (same GB Volume)
1106
Splunk IT Service Intelligence
Data Driven service insight for root cause isolation and improved service operations
Complimentary Product. Customers must have an equivalent license of Core Splunk (same GB Volume)
1107
Splunk User Behavior Analytics (UBA)
Detect cyber-attacks and insider threats using data science, machine learning, behavior baseline, peer group analytics, and advanced correlation
Licensing: Number of authorized users(the number of users or system accounts in Microsoft AD, lightweight directory access protocol (LDAP) or an similar service that is used to authenticate users inside the network.
needs to be sold with content subscription packs
1108
Splunk Services
Community
Standard
Enterprise and Global Support
PS and CSM
1109
Splunk Sale Stages
```
Business Qualification
Technical Interlock
Champion Tested
Proof Completed
Mutually Agreed Closed Plan
```
1110
Splunk Value Stack
```
Corporate Objectives
Business Strategy
Initiatives
Risks and Critical Capabilities
C Level Commercial Insights
```
1111
4 Key Assets in Every Sales Play
Prospecting Guide
Meeting Guide
Differentiation Pitch
Champion Guide
1112
Splunks Core Selling Tools
Value Stack
Whiteboard
Differentiators
best used together
1113
Splunk Market
Vertical and Segments
1114
Splunk Light
Delivers a light version of Splunk for Small IT environment
5 users
Cheaper
20GB of daily data indexing
1115
What is Machine Data
Machine data is one of the fastest, growing, most complex and most valuable segments of big data
1116
Splunk Cloud
All the power of Splunk Enterprise, delivered as a service. Runs in an Amazon Web Service
AWS GovCloud-Splunk Cloud solution hosted in secure enviornment for public sector
1.33X more expensive but its in the cloud and support is included
1117
Passionate and Vibrant Community
Splunk online communities include splunk base, splunk answers, and spunk dev
Active communities including Facebook and Linkedin; regional customer events, user group meetings and annual user conference.
1118
Scales from Desktop to Enterprise
Flexible data engine that scales to index terabytes of data per day and permits thousands of users to concurrently search petabytes of data
