Splunk Funamentals 2 Flashcards
How do we create a chart?
Hint:
Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/798/818/q_image_thumb.jpg?1621832968)
- By using:*
- | chart (x) over (x) by (x)*
- Key information:*
- The chart command has three main functions that you can use to create a chart
- The first variable is reserved usually for count or dc(count)
- The eccond variable is usually reserved for the main data you want to chart over
- The third variable is reserved for a value or data set you want to split the chart by hence the previous word.*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/798/818/a_image_thumb.jpg?1621832975)
How do we remove the:
Other
**Field from this chart?
Hint: Image**
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/800/966/q_image_thumb.jpg?1621831657)
By using:
interesting info:
By adding f it is using the value “false” in order to remove the field
using “true” will add it in if it is not already there in the chart.
useother=f
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/800/966/a_image_thumb.jpg?1621831896)
How do we split a chart?
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/801/250/q_image_thumb.jpg?1621833124)
Hint: Image
By adding:
Key info:
Answer is in bold/italic/underline for person reviewing
Additional info:
By is a variable addon for the chart command.
chart (x) over (x) by (x)
- *How do we limit a chart?**
- Hint: Image*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/801/951/q_image_thumb.jpg?1621833408)
By adding:
Key info:
Answer is in bold/italics/underline for person reviewing
Additional info:
By is a variable addon for the chart command.
“x” is the value used for the limit funtion to define its range.
chart (x) over (x) by (x) limit=x
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/801/951/a_image_thumb.jpg?1621833569)
How do we create a timechart?
Hint: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/802/098/q_image_thumb.jpg?1622778708)
**By using:
Key info:
Answer is in bold/italic/underline for person reviewing
Example: Image
timechart**
count (x) over (x)
![](https://s3.amazonaws.com/brainscape-prod/system/cm/346/802/098/a_image_thumb.jpg?1622779277)
How do we create an eval?
Hint: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/779/493/q_image_thumb.jpg?1622779342)
By using:
How do we use the search command?
Hint: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/780/547/q_image_thumb.jpg?1622786183)
By Using:
| search field (x)
Answer*: Image*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/780/547/a_image_thumb.jpg?1622786229)
What syntax is best for searches?:
Hint: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/781/885/q_image_thumb.jpg?1622785268)
Answer:
**2
and
4
Image Reference:**
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/781/885/a_image_thumb.jpg?1622785347)
How do we use a where command?
Hint: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/782/392/q_image_thumb.jpg?1622786464)
**By using:
Additional Info:
Field: Any field that is within the SPL that is before this command
Function: “, =, != , etc”
x: is any numeric value.
Answer: Image
where (field) (fuction) (x)**
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/782/392/a_image_thumb.jpg?1622786470)
How do we use the fill null command:
Hint: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/782/514/q_image_thumb.jpg?1622786923)
By adding:
- | fillnull value=(x) field field**
- *Additional info:**
- value=: is the function of the command that sets the value of the fill null
field: is any field that is forwarded from the SPL before this command*
Answer: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/782/514/a_image_thumb.jpg?1622786936)
How do we use the transaction command:
Description: Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/782/752/q_image_thumb.jpg?1622787797)
Hint Image
By using:
| transaction field maxspan=(x)s maxpause=(x)s
*Additional Info:
maxspan=(x)s:is used to define the span between the results, i.e the first and last events should not be longer than 30 secconds apart
maxpause=(x)s: is used to define the pause between results, i.e. each event should not be longer than 5 secconds apart
Answer: Image*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/782/752/a_image_thumb.jpg?1622787834)
***What is a field alias:
Description:**
Image
Hint:*
Image
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/783/522/q_image_thumb.png?1631228375)
Answer:
- *Description:**
- A field alias is an alternate name that you can assign a field.*
- *Additional Info.**
- A field can have multiple aliases, but a alias can only be tied to one field. so you cant have two fields tied to one alias.*
- *Answer:**
- Image*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/347/783/522/a_image_thumb.png?1631228569)
What is a calculated field:
Description:
Image.
Hint:
Image.
![](https://s3.amazonaws.com/brainscape-prod/system/cm/355/704/737/q_image_thumb.png?1631243136)
Answer:
- Description:*
- Calculated fields are fields added to events at search time that perform calculations with the values of two or more fields already present in those events.*
Additional Info:
An example would be converting data from raw information to usefull information,
example - sc_megabytes = sc_bytes/(1024*1024)
here we are converting the raw bytes number to mb.
Answer:
Image.
![](https://s3.amazonaws.com/brainscape-prod/system/cm/355/704/737/a_image_thumb.png?1631243146)
What is a Tag?
- Description hint:*
- Image*
- Hint:*
- Image - read the first sentence out loud in the hint image before showing the rest.*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/355/719/500/q_image_thumb.png?1631599927)
Answer:
- Description:*
- Tags are used to assign names to specific field and value combinations.*
- Aditional Info:*
- These fields can be event type, host, source, or source type, etc. You can also use a tag to group a set of field values together, so that you can search for them with one command.
Example info (from image)*
- Answer:*
- Image. Example is also handy to know*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/355/719/500/a_image_thumb.png?1631599414)
What is a Event Type?
- Description hint:*
- Image*
- Hint:*
- Image - enphasis on the word corelation in the image*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/356/106/184/q_image_thumb.png?1631764656)
Answer:
- Description:*
- Splunk event type refers to a collection of data which helps in categorizing events based on common characteristics.*
- Aditional Info:*
- It is a user-defined field which scans through huge amount of data and returns the search results in the form of dashboards. You can also create alerts based on the search results.*
Example info (from image)
- Answer:*
- Image. Example is also handy to know*
![](https://s3.amazonaws.com/brainscape-prod/system/cm/356/106/184/a_image_thumb.png?1631767000)