Splunk Funamentals 2 Flashcards
How do we create a chart?
Hint:
Image
- By using:*
- | chart (x) over (x) by (x)*
- Key information:*
- The chart command has three main functions that you can use to create a chart
- The first variable is reserved usually for count or dc(count)
- The eccond variable is usually reserved for the main data you want to chart over
- The third variable is reserved for a value or data set you want to split the chart by hence the previous word.*
How do we remove the:
Other
**Field from this chart?
Hint: Image**
By using:
interesting info:
By adding f it is using the value “false” in order to remove the field
using “true” will add it in if it is not already there in the chart.
useother=f
How do we split a chart?
Hint: Image
By adding:
Key info:
Answer is in bold/italic/underline for person reviewing
Additional info:
By is a variable addon for the chart command.
chart (x) over (x) by (x)
- *How do we limit a chart?**
- Hint: Image*
By adding:
Key info:
Answer is in bold/italics/underline for person reviewing
Additional info:
By is a variable addon for the chart command.
“x” is the value used for the limit funtion to define its range.
chart (x) over (x) by (x) limit=x
How do we create a timechart?
Hint: Image
**By using:
Key info:
Answer is in bold/italic/underline for person reviewing
Example: Image
timechart**
count (x) over (x)
How do we create an eval?
Hint: Image
By using:
How do we use the search command?
Hint: Image
By Using:
| search field (x)
Answer*: Image*
What syntax is best for searches?:
Hint: Image
Answer:
**2
and
4
Image Reference:**
How do we use a where command?
Hint: Image
**By using:
Additional Info:
Field: Any field that is within the SPL that is before this command
Function: “, =, != , etc”
x: is any numeric value.
Answer: Image
where (field) (fuction) (x)**
How do we use the fill null command:
Hint: Image
By adding:
- | fillnull value=(x) field field**
- *Additional info:**
- value=: is the function of the command that sets the value of the fill null
field: is any field that is forwarded from the SPL before this command*
Answer: Image
How do we use the transaction command:
Description: Image
Hint Image
By using:
| transaction field maxspan=(x)s maxpause=(x)s
*Additional Info:
maxspan=(x)s:is used to define the span between the results, i.e the first and last events should not be longer than 30 secconds apart
maxpause=(x)s: is used to define the pause between results, i.e. each event should not be longer than 5 secconds apart
Answer: Image*
***What is a field alias:
Description:**
Image
Hint:*
Image
Answer:
- *Description:**
- A field alias is an alternate name that you can assign a field.*
- *Additional Info.**
- A field can have multiple aliases, but a alias can only be tied to one field. so you cant have two fields tied to one alias.*
- *Answer:**
- Image*
What is a calculated field:
Description:
Image.
Hint:
Image.
Answer:
- Description:*
- Calculated fields are fields added to events at search time that perform calculations with the values of two or more fields already present in those events.*
Additional Info:
An example would be converting data from raw information to usefull information,
example - sc_megabytes = sc_bytes/(1024*1024)
here we are converting the raw bytes number to mb.
Answer:
Image.
What is a Tag?
- Description hint:*
- Image*
- Hint:*
- Image - read the first sentence out loud in the hint image before showing the rest.*
Answer:
- Description:*
- Tags are used to assign names to specific field and value combinations.*
- Aditional Info:*
- These fields can be event type, host, source, or source type, etc. You can also use a tag to group a set of field values together, so that you can search for them with one command.
Example info (from image)*
- Answer:*
- Image. Example is also handy to know*
What is a Event Type?
- Description hint:*
- Image*
- Hint:*
- Image - enphasis on the word corelation in the image*
Answer:
- Description:*
- Splunk event type refers to a collection of data which helps in categorizing events based on common characteristics.*
- Aditional Info:*
- It is a user-defined field which scans through huge amount of data and returns the search results in the form of dashboards. You can also create alerts based on the search results.*
Example info (from image)
- Answer:*
- Image. Example is also handy to know*