Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Certified User > Splunk Core Certified User > Flashcards

Splunk Core Certified User Flashcards

1
Q

what are considered hosts by splunk ?

A

computers, sensors, virtual machines, web servers, network devices, databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

hosts usually generate a variety of data including

A

fault
configuration
accounting
performance
security
system logs
application logs
metrics
tickets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

where can splunk index data from ?

A
  • can index from any source
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are the processing components of splunk ?

A

indexers
forwarders
search heads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what are the management components of splunk ?

A
  • Deployment servers
  • indexer cluster manager
  • search head cluster deployment
  • license manager
  • monitoring console
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what can a search head do once connected ?

A
  • search
  • analyze
  • visualize
  • reports
  • alerts
  • dashboard
  • knowledge
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what are some details about splunk forwarders ?

A

forwarders are generally installed on host machines to collect source data and send to splunk

forwarders are the primary way to send data to splunk for indexing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what are the two types of splunk forwarders ?

A

-Universal forwarder

Heavy forwarders
- configured from full splunk enterprise installation
- can parse and filter before forwarding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is a splunk component that resides on machines originating data ?

A

forwarder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what is the difference between universal and heavy forwarders

A

heavy forwarders can parse data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

how does splunk data flow initially ?

A

data from hosts —> Indexer —-> indexes on disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is an indexer in splunk ?

A

An indexer or search peer is a Splunk enterprise instance that processes and writes data into repositories as events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is processing in regards to splunk?

A
  • transform data into events
  • assign metadata
  • identify or create timestamps
  • data repositories are known as indexes
  • repositories containing files with index data are called buckets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is thawed data in splunk ?

A

thawed data in splunk is when you are bringing data out of the archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is an Indexer cluster ?

A
  • an indexer cluster is when you group indexers together to provide data replication
  • cluster manager - coordinates replication activities and manages the cluster
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is a splunk component that transforms raw data into events?

A

indexer and heavy forwarders are the splunk components that transform raw data into events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what are some of the details regarding search heads

A
  • allows users to write search queries SPL to search the indexed data
  • distributes search requests to the indexers and merges the result back to the user

Can create fields and other knowledge objects such as
- reports
- alerts
- visualizations
- dashboards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what are some details regarding the search head cluster ?

A
  • groups of search heads with identical configuration
  • search requests from users are balanced across the SH groups
  • Managed by a cluster captain
  • cluster deployer, distributes apps and other configuration to cluster members
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what are some details of the configuration deployment server?

A
  • distributes content, configuration, apps to other groups of splunk instances
  • distributed content is known as deployment apps
  • used mostly to distribute apps to splunk forwarders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is the forwarder manager for Splunk ?

A

provides a way to configure deployment servers and monitor updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is the license manager in Splunk ?

A

Hosts licenses and assigns license volume to other splunk components in a distributed deployment

License meter runs during indexing

License types
- Volume based
- Infrastructure based
- Access to splunk features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is the monitoring console in Splunk ?

A

Used to view topology and performance information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what are the three main out of the box roles in Splunk ?

A

User
Power
Admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what are some of the default app examples ?

A

home app
search app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is the default port for Splunk web ?

A

port 8000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what are some splunk default app examples ?

A

home app
search and reporting app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what are splunk apps ?

A

splunk apps are custom solutions that allow you to extend the functionality of the splunk platform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what can splunk apps do for us ?

A

What can Splunk Apps do for us ?

Separate workspaces for different use cases to co exist on a single instance.
- Alerts
- Reports
- Dashboards

Custom configurations to ingest data

Collections of
- Data inputs
- UI Elements
- Knowledge Objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

how do we access splunk apps ?

A

you can access Splunk apps on Splunk-base

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is SPL ?

A

SPL is Splunk processing language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

what can be changed using the account settings and preferences ?

A

preferences - time zone
Full name
Email
Password
change the theme

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

what is the splunk search and reporting app ?

A

default app that provides an interface to search, analyze and visualize data in splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

what is the search bar used for in splunk ?

A

the search bar is where you specify search criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what is the app navigation bar in Splunk?

A

shows views in the current applicationand the different apps avaliable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

what is the time range picker in splunk ?

A

allows us to specify the time period to search

Default value is 24 hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

what are the three different types of search modes in splunk ?

A

Fast (better performance less info)

Smart (less performance but more info then fast mode)

Verbose (slowest performance but the most information)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

what is search history in splunk ?

A

See a history of your searches

You can select to re-run a search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

what are the different ways you can view counts of events in Splunk ?

A

Hosts

Sources

Source types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

what is a quick way to understand data in your deployment?

A

the data summary type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

what are the fields presented under the data summary tab ?

A

host
source
source type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

what are the three out of the box users in splunk ?

A

user
power
admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

what is the user role in splunk ?

A

Limited access to Settings

Create private knowledge objects

Assign to basic users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

what is the power role in splunk ?

A

Limited access to settings

Create and publish share knowledge objects

Assign to power users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

what is the admin role in splunk ?

A

Access to all settings

Has the most capabilities

Assign to splunk admins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

which roles have minimum and maximum permissions

A

minimum permissions is the user role

Maximum permissions is the admin role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Which Splunk component transforms raw data into events and distributes the result to an index?

A

Indexer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Which component of splunk is primarily responsible for saving data ?

A

Indexer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

The three basic components of splunk are ?

A

Forwarder, indexer, Search head

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is Splunk ?

A

Splunk is a software platform to search, analyze and visualize the machine generated data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which component of Splunk let us write SPL query to find the required data?

A

Search head

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What Splunk Components can perform log filtering/parsing ?

A

Heavy forwarders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is true about user account settings and preferences?

A

Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

A collection of items contains things such as data inputs, UI elements and knowledge objects is known as what ?

A

An app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

explain what Splunk apps are ?

A

It is a collection of different Splunk config files like data inputs, UI and Knowledge objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is the default app for Splunk Enterprise ?

A

Search and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

How many main roles do you have in Splunk ?

A

3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is the default web port used by Splunk?

A

8000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

what are some of the ways we get data in Splunk ?

A

Get data from Files and Directories

Get data from network sources

Get data from Windows sources

Get data from other sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

what are some of the ways we can get data from files and directories in splunk ?

A

Monitor files and directories

Upload static files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

what are some of the ways we can get data from network sources ?

A

Data that comes over a network port

Both TCP and UDP protocols supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

what are some of the ways we can get data from windows sources in splunk ?

A

Windows Event logs

Windows registry

Windows Management Instrumentation

Active Directory

Performance monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

what are some of the other sources we can get data from in Splunk ?

A

APIs

Databases

Metrics

FIFO queues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

what are some of the ways we can ingest data into Splunk ?

A

Use existing Apps and Add-ons

Use forwarders to get data

use HTTP event collector HEC

for custom data use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

what are some of the ways we can ingest data into Splunk using existing apps and Add ons

A
  • Splunk add-on for windows
  • Splunk add-ons for AWS
  • Splunk DB connect
  • Splunk stream
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

what is the way we can use forwarders to get data ?

A

Install forwarders on the sources generating data

Use heavy forwarder when more processing is required before ingestion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

what are ways we can use the splunk HEC to ingest data into splunk?

A

Use HEC to get data from the HTTP or HTTPS protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

what is the splunk index time process ?

A

data is handled at the splunk data source and forwarded using the universal forwarder or heavy forwarder

then the data sources are open and read

configurations are applied to entire streams

data is sent out for indexing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

what are the three phases of the splunk index time process ?

A

The first phase of the Splunk index time process is the input phase

The second phase of this process is the parsing phase

The third phase of this is the indexing phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

explain the parsing phase of the splunk index time process ?

A

Handled at
- Indexer
- Heavy forwarder

Data broken into events

Extract default metadata fields
- Host
- Source
- Sourcetype
- Index

Identify or create timestamps

Identify line termination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

explain the indexing phase of the splunk index time process ?

A

Handled at
- Indexer

  • Run License meter
  • Build index data structures
  • Write data to disk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

what are the different ways of configuring data inputs in splunk ?

A

Splunk web

CLI

Configuration files edit inputs.conf

Apps and add-ons from Splunkbase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

what are the three ways we can add data inputs using splunk web ?

A

uploads

monitor

forward

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

explain the upload function in splunk web

A

Upload local files from your computer

Only gets indexed once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

what is the monitor function in splunk web

A

Monitor files and directories, network ports

Data located on splunk enterprise instance

Useful for testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

explain the forward function in Splunk web

A

Frequently used in production environments

Get data from remote machines over receiving port

Remote machines have the forwarder installed to forward data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

what is the default splunk installation directory in windows ?

A

C:\Program Files\Splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

what is the default splunk installation directory for linux ?

A

/opt/splunk/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

what is the default MAC os splunk installation directory ?

A

/Applications/Splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Data source being open and read applies to?

A

The input phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Select the correct option that applies to index time processing

A

Input, parsing, indexing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

The splunk index time process can be broken down into how many phases

A

3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Where does licensing meter happen ?

A

Indexer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Which statement is true about heavy forwarders ?

A

Parsing, masking, forwarding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

We use keywords and phrases to retrieve matched events from the index:

A

When searching for keywords splunk is searching the keyword against raw events in the _raw filed

The _raw field contains the entire events

To search matching phrases, use double-quotes example “user ubuntu”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

what do we use wildcards for in Splunk ?

A

Use wildcards to match characters in string values for events in your index

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

what is best practice for using wildcards ?

A

As best practice, use wildcards at the end of the term.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

in which situations do we want to avoid using wildcards ?

A

Avoid using at the beginning of a string example *fail

If you put a wildcard at the front it will scan every event

Can cause performance issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

should we use wildcards in the middle of a string ?

A

Don’t use in the middle of a string

Might cause inconsistent results especially in string containing punctuation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

where should wildcards be used when searching in Splunk ?

A

To have better searches we should always place our wildcards at the end

The * character can be used as a wildcard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

what do we use Boolean operators for ?

A

Use boolean operators AND, OR, NOT to combine search terms

Boolean operators must be in uppercase

The AND operator is implied between terms

Example search for failed password is the same as failed AND password

Example user NOT administrator – search events that contain the word user and does not contain the word administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

what is the point of boolean operators ?

A

they are used to combine search terms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

what do we have to remember when using boolean operators ?

A

boolean operators are always in upper case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

what does the search assistant help us with in Splunk ?

A

The search assistant helps with writing searches by providing selections to complete strings

It helps matching searches based on recent search history

Shows list of commands after first pipe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

what are the three modes in search assistant ?

A
  • compact (default)
  • full
  • none (used to disable search assistant)
95
Q

what is the difference between full mode and compact mode with the search assistant ?

A

Full mode shows more information than compact mode

Additionally, it displays count of how many times a term appears in indexed data

96
Q

what are some things to remember when identifying content of search results ?

A
  • Each event contains a timestamp extracted at index time
  • The newest events are going to be displayed at the top and the oldest are going to be displayed at the bottom
  • Splunk also extracts metadata fields at index time . The metadata fields are the following
  • Host
  • Source
  • Sourcetpye
  • Index

Selected fields host,source,sourcetype are shown at the bottom of each event

Terms that match the search are highlighted in search results

97
Q

what are the three display options with the event viewer

A
  • list
  • raw
    -table
98
Q

what is the order of search results in splunk

A

reverse chronological order

99
Q

what are the metadata fields in the search results ?

A
  • host
  • source
  • sourcetype
  • index
100
Q

what do time unit abbreviations include ?

A

S = seconds

M = minutes

H = hours

D = days

W = weeks

Mon = months

Y= years

101
Q

what does the events timeline include ?

A

The events timeline shows distribution of events over time for a selected time range.

102
Q

Exam: what does using click and drag on the timeline do for us?

A

We are able to select specific times and timelines without having to re-execute the search

103
Q

what are the three different timeout controls ?

A

We are able to Format the timeline

Zoom out zoom in to edit the selection

We are able to deselect a section

104
Q

what are some of the search actions we can perform in Splunk ?

A

Every search you run is a job and generates a job id

Under the job menu you can do the following
- Change job settings
- Send a job to the background
- Can associate an email with this so it emails you when the job is done

  • You can inspect a job
    • You can use this to find out why a job is taking a long time
    • Delete a job
  • Pause/resume a job

-Stop job
- Will generate partial results

  • Share job
    • Provides a link to bookmark or copy /share job
    • Can give read permissions to the people you have shared with

Export a job
- Export search results as Raw Events (text file)
- CSV
- XML
- JSON

  • Print a job
105
Q

How do we access saved jobs in splunk ?

A

We have to go to the activity menu to access saved jobs

106
Q

What is the default time to retain a search job

A

10 minutes

107
Q

How do we keep search results longer then 7 days ?

A

To save the job longer then 7 days you have to save the job as a report

108
Q

When writing searches in Splunk, which of the following is true about Booleans?

A

They must be in uppercase

109
Q

How are events displayed after a search is executed?

A

In reverse chronological order

110
Q

Which time range picker option configuration would return real-time events for the past 30 seconds?

A

Real time – Earliest: 30-seconds ago, latest: Now

111
Q

Which Boolean operator is always implied between two search terms, unless otherwise specified?

A

AND

112
Q

What user interface component allows for time selection ?

A

Time Range Picker

113
Q

Which of the following searches will return results where fail, 400, and error exist in every event?

A

Error AND (fail AND 400)

114
Q

In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

A

Events from every index searched by default to which the user has access will be returned

115
Q

Which of the following is an option after clicking an item in search results ?

A

Adding the item to the search

116
Q

What does the following specified time range do?

earliest=-72h@h latest=@d

A

Look back from 3 days ago, up to the beginning of today

117
Q

What is the primary function of the timeline located under the search bar ?

A

To show peaks and or valleys in the timeline, which can indicate spikes in activity or downtime.

118
Q

According to splunk best practices which placement of the wildcard results in the most efficient search ?

A

Fail*

119
Q

Which of the following can be used as a wildcard in splunk

A

*

120
Q

What is search assistant in Splunk ?

A

Shows options to complete the search string

121
Q

You can use the following options to specify start and end time for the query range:

A

Earliest=, latest=

122
Q

Which of the following file types is an option for exporting splunk search results ?

A

Not pdf, not xls, not RTF, but JSON yes

123
Q

By default how long does splunk retain a search job ?

A

10 minutes

124
Q

what are indexers in splunk ?

A

In Splunk, indexers are the components responsible for ingesting, parsing, and storing data into indexes.

Indexers are a critical part of the Splunk architecture, as they handle the initial processing and storage of data before it can be searched and analyzed by search heads or other Splunk components.

125
Q

what are the main tasks with indexers in splunk ?

A

Data ingestion: They ingest data from various sources like log files, network data, APIs, etc.

Data parsing: They parse the incoming data to extract relevant information and structure it into events.

Data indexing: They index the parsed events by storing them in the appropriate indexes based on configured rules or settings.

Data distribution: In a distributed Splunk environment, indexers can forward data to other indexers for load balancing or data replication purposes.

126
Q

what is the main job of the splunk universal forwarder ?

A

The Splunk universal forwarder sends data to the splunk indexer

127
Q

what do the splunk search heads provide ?

A

The search heads provide an interface for the splunk users and allow searches to be made on the data

128
Q

what is a Splunk Indexer ?

A

Receives data from clients

Converts raw data into searchable events

Executes searches

129
Q

what is a splunk search head ?

A

Web interface for the user

Manages the searches

Dispatches searches to the indexers

Maintains access control

130
Q

what is a Splunk Universal forwarder ?

A

Collects data from the machine it is installed on

Keeps track of data ingestion

Very lightweight and production ready

131
Q

what is a splunk index cluster ?

A

Multiple copies of data replicated across the cluster members

Helps protect against hardware failure on one or more indexers

Cluster mater manages the cluster-level operations

132
Q

what is inside of an indexer ?

A

Splunk stores data in indexes

Indexes contain buckets

Data buckets contain raw data and index files

Data retention policies are configured at index level

133
Q

what are data buckets in Splunk ?

A

Data buckets are categorized as hot, warm, cold and frozen

As data ages the data buckets roll from hot to warm to cold to frozen

Data buckets expire when all events in it become older than the configured duration

134
Q

what are hot buckets in splunk ?

A

Contains the newest bucket

Open for both read and write

Splunk administrator can configure when data rolls to warm bucket

135
Q

what are warm buckets in splunk ?

A

Open for read only (no writes)

Hot and warm buckets are usually kept in faster storage

When data ages, they roll from warm to cold

136
Q

what are cold buckets in splunk ?

A

Open for read only (no writes)

Cold buckets can be kept in cheaper and hence slower storage

137
Q

what are frozen buckets in Splunk ?

A

Not searchable

138
Q

what does splunk implement for security?

A

Splunk implements role based access control

Three primary roles: user, power, admin

Only power users can share knowledge objects

139
Q

what are knowledge objects ?

A

Knowledge objects are tools you create and utilize for analyzing your data

140
Q

what are some examples of knowledge objects ?

A

Filed extractions

Lookups

Data models

Tags

141
Q

what are fields in splunk ?

A

Fields are searchable name/value pairs in your event data

Searches using fields are more efficient than searches using keywords or quoted phrases

Fields can be extracted from data at index time and at search time

142
Q

what is field discovery in splunk ?

A

Automatically discover fields based on sourcetype and name/value pairs in your data

143
Q

how would you describe field discovery in Splunk ?

A

In Splunk, Field Discovery is a feature that automatically identifies and extracts fields (key-value pairs) from events or log messages as they are ingested into Splunk. This process helps structure the data and makes it easier to search, analyze, and report on the information contained within the events.

144
Q

what are the metadata fields in splunk ?

A

Host

Source

Sourcetype

Index

145
Q

what is the fields sidebar in splunk ?

A

Fields sidebar displays fields discovered in your events

146
Q

what are selected fields under the fields sidebar ?

A

By default these are

Host

Source

Sourcetype

Can be configured to add/remove fields

147
Q

what are interesting fields under the field sidebar ?

A

Fields that appear in at least 20% of your events

Can always make an interesting field a selected field and vice versa

148
Q

what is the all fields option under the field sidebar for ?

A

Use this to see all fields in events

Will also include fields that appear in less than 20% of your events

149
Q

how do we make any fields a selected field in Splunk ?

A

Click on all fields

Click the checkboxes next to them to make them selected fields

150
Q

what are some of the different reports when you click on a field under the interesting fields tab ?

A

Top values / stats and visualizations of top 20 values

Top values by time – timechart for top values

Rare values – stats and visualizations of bottom 20 values

Events with this field – all events containing the field

151
Q

how do we add fields to the field sidebar ?

A

Have to click on all fields and select the check box next to the field you want to be added

152
Q

What are the field characteristics you need to know for the exam ?

A
  • Numeric Fields

A – Alphanumeric field

Count of unique events

153
Q

What are the default selected fields

A

Host

Source

Sourcetype

154
Q

What are the reports that show up in the field window ?

A

Top values / stats and visualizations of top 20 values

Top values by time – timechart for top values

Rare values – stats and visualizations of bottom 20 values

Events with this field – all events containing the field

155
Q

what is the synatx for using fields in searches ?

A

<field_name>=<field_value>
</field_value></field_name>

156
Q

what is the most efficient way to search, using keywords, quoted strings, or field searches

A

Field searches

157
Q

what are some things to keep in mind when using fields in searches ?

A

Use quotation marks for field names with spaces

Field names are case sensitive

Field values are not case sensitive

You can use wildcards with fields

You can use Boolean operators AND, OR, NOT with fields

158
Q

are filed names case sensitive when searching ?

A

Field names are case sensitive field values are not

159
Q

can you use boolean operators with field searches ?

A

You can also use the boolean operators AND, OR, NOT with field searches

160
Q

what do boolean operators help us with when using searches ?

A

Narrow down searches specifically to what you want

Improves performance

161
Q

which boolean operator is usually implied ?

A

AND

162
Q

what is true about boolean operators ?

A

they always have to be uppercase

163
Q

what are some of the comparison operators

A

!= | not equal

> | Greater than

< | Less than

> = | greater than or equal to

<= | less than or equal to

164
Q

!=

A

not equal

165
Q

>

A

Greater than

166
Q

<

A

less than

167
Q

> =

A

greater than or equal to

168
Q

<=

A

less than or equal to

169
Q

what is the difference between the != and NOT operators ?

A

“NOT action=remove”
- All events where the action field exists, and value is different from remove
- All events where the action field does not exist

“action!=remove”
- All events where the action field exists and the value is different from remove
- The NOT and != operator will produce the same results when a field exists in all your events

170
Q

what are some features of the fast mode search in Splunk ?

A

Best performance, speed over completeness

Field discovery is disabled

171
Q

what are some features of the smart mode in Splunk ?

A

Balances speed and completeness

Field discovery is enabled

172
Q

what are some features of verbose mode in Splunk ?

A

More data, least performance, completeness over speed

Field discovery is enabled

Shows event when using transforming commands

173
Q

what are the three different search modes in Splunk ?

A

Fast mode

Smart mode

Verbose mode

174
Q

what are some common search best practices ?

A

Specify indexes at the beginning of a search string

Use OR instead of wildcards when possible

It is better to use inclusion than exclusion

Inclusion action=addtocart

Exclusion NOT action=addtocart

Include as many search terms as possible to narrow down your results

Specify time to narrow down the results of your search.

175
Q

Which search string only returns events from host WWW3?

A

Host=WWW3

176
Q

Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

A

(index=netfw failure) OR (index=netops(warn OR critical))

177
Q

Which of the following is a Splunk search best practice?

A

Filter as early as possible

178
Q

by default which of the following fields would be listed in the fields sidebar under interesting fields?

A

Index

179
Q

Which of the following statements about case sensitivity is true?

A

Field names ARE case sensitive, field values are NOT

180
Q

A field exists in search results, but isn’t being displayed in the fields sidebar.

How can it be added to the fields sidebar?

A

Click All fields and select the field to add it to selected fields

181
Q

In the fields sidebar, which character denotes alphanumeric field values?

A

@

182
Q

What syntax is used to link key/value pairs in search strings?

A

action=purchase

183
Q

Which of the following is the most efficient filter for running searches in Splunk?

A

Time

184
Q

How does Splunk determine which fields to extract from data?

A

Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data

185
Q

What syntax is used to link key/value pairs in search strings?

A

Relational operators such as =,<, or >

186
Q

Which search would return events from the access_combined sourcetype?

A

sourcetype=Access_Combined

187
Q

Which of the following index searches would provide the most efficient search performance?

A

(index=web OR index=sales)

188
Q

In the fields sidebar, what indicates that a field is numeric?

A

A # symbol to the left of the field name.

189
Q

At index time, in which field does Splunk store the timestamp value?

A

_time

190
Q

Which events will be returned by the following search string? host=www3 status=503

A

All events with a host of www3, that also have a status of 503

191
Q

what are some specific commands we can apply to Splunk searches ?

A

Commands
- Specifies what to do with results retrieved
- Calculate Statistics, generate chart, evaluate new fields

192
Q

what are functions in regards to splunk search ?

A

Functions define how to perform a task required by the command

Function arguments provide the variables needed for the function to do the work

193
Q

what are arguments in regards to Splunk search ?

A

Variables needed for the command to work

194
Q

what character can sperate commands ?

A

|

195
Q

what are some common command examples in splunk ?

A

-eval

-top

-rename

196
Q

what color are functions in search splunk and what are some function examples ?

A

Functions are always in purple, function examples:
- If
- Count

197
Q

what color are boolean operators in splunk search and what are some examples ?

A

Boolean operators and clauses are in orange, examples
- AND
- OR
- NOT

198
Q

what color are command line arguments in splunk and what are some examples ?

A

Command arguments are in green
- Limit
- Span

199
Q

what does the fields command do in Splunk ?

A

Use the fields command to filter a list of fields returned in the search results

Note that internal fields _raw and _time are returned by default

To include fields
- Use the “fields” or “fields+” command

To exclude fields
- Use fields -

200
Q

what are some details about the table command ?

A

The table command creates a statistics table of the specified fields

Each row of the created table represents an event, and the columns represent field names

Columns are displayed in the order given in the command when using the table command

201
Q

what are some details regarding the rename command ?

A

Use the rename command to change the name of a field

Useful when you want to provide meaningful names

Use double-quotes when renaming field names with names that include spaces or special characters

202
Q

what is an example of the rename command ?

A

Rename command example:

Rename method as “HTTP Method”, status as “HTTP Status”, clientip as ClientIP_Address

203
Q

what are some details about the sort command ?

A

the sort command allows us to sort search results by specified fields

To sort in ascending order use the following command:
- Sort +<fieldname>
- Sort <filedname></filedname></fieldname>

To sort in descending order

Use sort - <fieldname></fieldname>

Use the limit argument to limit the number of results

204
Q

what does the dedup command do in splunk ?

A

the dedup command removes duplicates from your results

205
Q

When running searches, command modifiers in the search string are displayed in what color?

A

Orange

206
Q

When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

A

comma character ,

207
Q

How do you add or remove fields from search results?

A

Use Field + to add and field – to remove

208
Q

When placed early in a search, which command is most effective at reducing search execution time?

A

Fields +

209
Q

Search Language Syntax in Splunk can be broken down into the following components:

A

Search Term, Pipe, Command, Functions, Arguments, Clause

210
Q

Which command will rename action to customer action?

A

rename action as Customer Action

211
Q

When is the pipe character | used in search strings?

A

Before command, For example: | stats sum(bytes) by host

212
Q

Which search will return only events containing the word error and display the results as a table that includes the fields named action, src, and dest?

A

Error | table action,src,dest

213
Q

Which search string only returns events from hostWWW3?

A. host=*
B. host=WWW3
C. host=WWW*
D. Host=WWW3
A

B

214
Q

by default how long does splunk retain a search job ?

A. 10 Minutes
B. 15 Minutes
C. 1 Day
D. 7 Days
A

A. 10 Minutes

215
Q

What must be done before an automatic lookup can be created? (Choose all that apply.)

A. The lookup command must be used.

B. The lookup definition must be created.

C. The lookup file must be uploaded to Splunk.

D. The lookup file must be verified using the inputlookup command.

A

B the lookup definition must be created

216
Q

Which of the following Splunk components typically resides on the machines where data originates?

A. Indexer
B. Forwarder
C. Search head
D. Deployment server
A

B. Forwarder

217
Q

When writing searches in Splunk, which of the following is true about Booleans?

A. They must be lowercase.

B. They must be uppercase.

C. They must be in quotations.

D. They must be in parentheses.

A

B. They must be uppercase.

218
Q

Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

A. (index=netfw failure) AND index=netops warn OR critical

B. (index=netfw failure) OR (index=netops (warn OR critical))

C. (index=netfw failure) AND (index=netops (warn OR critical))

D. (index=netfw failure) OR index=netops OR (warn OR critical)

A

B. (index=netfw failure) OR (index=netops (warn OR critical))

219
Q

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price

A. index=security sourcetype=access_* status=200 stats | count by price

B. index=security sourcetype=access_* status=200 | stats count by price

C. index=security sourcetype=access_* status=200 | stats count | by price

D. index=security sourcetype=access_* | status=200 | stats count by price

A

B. index=security sourcetype=access_* status=200 | stats count by price

220
Q

Which of the following constraints can be used with the top command?

A. limit
B. useperc
C. addtotals
D. fieldcount
A

A limit

221
Q

what are examples of keyword modifiers in splunk and what color are they ?

A
  • Boolean operators (AND, OR, NOT) to combine or exclude terms
  • Wildcard characters (*, ?) to match partial words or unknown characters
  • Field qualifiers (fieldname:value) to search within specific fields

Keyword modifiers are orange

222
Q

When running searches, command modifiers in the search string are displayed in what color?

A. Red
B. Blue
C. Orange
D. Highlighted
A

B. Blue

223
Q

what is the recommended naming conventions for dashboards ?

A

Group_Object_Description

224
Q

What is a primary function of a scheduled report?

A. Auto-detect changes in performance.

B. Auto-generated PDF reports of overall data trends.

C. Regularly scheduled archiving to keep disk space use low.

D. Triggering an alert in your Splunk instance when certain conditions are met.

A

D. Triggering an alert in your Splunk instance when certain conditions are met.

225
Q

Which command is used to review the contents of a specified static lookup file?

A. lookup
B. csvlookup
C. inputlookup
D. outputlookup
A

C. inputlookup

226
Q

When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

A. |
B. $
C. !
D. ,
A

D. ,

227
Q

Which time range picker configuration would return real-time events for the past 30 seconds?

A. Preset - Relative: 30-seconds ago

B. Relative - Earliest: 30-seconds ago, Latest: Now

C. Real-time - Earliest: 30-seconds ago, Latest: Now

D. Advanced - Earliest: 30-seconds ago, Latest: Now

A

C. Real-time - Earliest: 30-seconds ago, Latest: Now

228
Q

What is the correct syntax to count the number of events containing a vendor_action field?

A. count stats vendor_action

B. count stats (vendor_action)

C. stats count (vendor_action)

D. stats vendor_action (count)

A

C. stats count (vendor_action)

229
Q

By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

A. host
B. index 
C. source
D. sourcetype
A

B index

230
Q

Which of the following statements about case sensitivity is true?

A. Both field names and field values ARE case sensitive.

B. Field names ARE case sensitive; field values are NOT.

C. Field values ARE case sensitive; field names ARE NOT.

D. Both field names and field values ARE NOT case sensitive.

A

B. Field names ARE case sensitive; field values are NOT.

231
Q

What does the rare command do?

A. Returns the least common field values of a given field in the results.

B. Returns the most common field values of a given field in the results.

C. Returns the top 10 field values of a given field in the results.

D. Returns the lowest 10 field values of a given field in the results.

A

A. Returns the least common field values of a given field in the results.

232
Q

When an alert action is configured to run a script, Splunk must be able to locate the script.
Which is one of the directories Splunk will look in to find the script?

A. $SPLUNK_HOME/bin/scripts

B. $SPLUNK_HOME/etc/scripts

C. $SPLUNK_HOME/bin/etc/scripts

D. $SPLUNK_HOME/etc/scripts/bin

A

A. $SPLUNK_HOME/bin/scripts

233
Q

Which Boolean operator is always implied between two search terms, unless otherwise specified?

A. OR
B. NOT
C. AND
D. XOR
A

C. AND

234
Q

Which statement is true about Splunk alerts?

A. Alerts are based on searches that are either run on a scheduled interval or in real-time.

B. Alerts are based on searches and when triggered will only send an email notification.

C. Alerts are based on searches and require cron to run on scheduled interval.

D. Alerts are based on searches that are run exclusively as real-time.

A

A. Alerts are based on searches that are either run on a scheduled interval or in real-time.

Splunk Certified User (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions