Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk > Splunk Fundamentals 1 > Flashcards

Splunk Fundamentals 1 Flashcards

1
Q

Splunk allows you to _____, analyze, and get _____ from your machine data.

A

aggregate, answers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 main components of Splunk?

A

search head, indexer, forwarder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 2 different types of Splunk deployment?

A

Splunk Enterprise and Splunk Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Splunk components are installed and administered on premises with this type of Splunk deployment.

A

Splunk Enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Splunk Enterprise is used as a scalable service and requires minimal infrastructure with this type of deployment.

A

Splunk Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A ____ ___ is designed to address a wide variety of use cases and to extend the power of Splunk.

A

Splunk app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What do you use to download Splunk apps?

A

Splunkbase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or False. There are 1,000 + ready-made apps available on Splunkbase.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Out of the box, what are the 3 main roles used in Splunk?

A

admin, power, user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the default app that comes with Splunk?

A

Search & Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The ______ app provides a default interface for searching and analyzing data.

A

Search & Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A _____ is unique identifier identifying where Splunk events originated (whether it’s from a laptop, phone, etc). In other words, this is the actual device that’s generating the data.

a. source
b. host
c. sourcetype

A

b. host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The name of a file (ie. Word file named “Splunk Class”), stream, or other input (where data is specifically coming from – i.e. “picture” folder on a phone) is the ______.

a. source
b. host
c. sourcetype

A

a. source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In the Search & Reporting app, the Data Summary contains three summary tabs. Select all that apply.

a. host
b. source
c. index
d. sourcetype

A

a. host
b. source
d. sourcetype

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or false: Search term values are case sensitive.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NOT, OR and AND are called ____ in Splunk.

A

booleans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The Boolean ____ is implied between terms.

A

AND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

_____ are locations where Splunk stores and searches for event data

A

Indexes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Splunk admins _____ data into separate indexes in order to establish different retention policies on different types of data, improve search performance, and limit access by role.

A

segregate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Improving search ____ is one reason why Splunk admins segregate data into separate indexes.

A

performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Limiting ____ by role is one reason why Splunk admins segregate data into separate indexes.

A

access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Establishing ___ policies (how long data is kept) on different types of data is one reason why Splunk admins segregate data into separate indexes.

A

retention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

An ____ is a Splunk component that processes machine data. Information within ____ are stored in _____, enabling fast search and analysis. (visual example: file folder with separate files within the file folder)

A

indexer, indexers, indexes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What Boolean can you use to search against multiple indexes?

A

OR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

____ ____ shows a list of commands that can be entered into the search string

A

Search Assistant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

When search results display in Splunk do they display in reverse chronological order (newest first), or chronological order (oldest first) by default?

A

reverse chronological order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

True or False. Matching search terms are not highlighted in Splunk.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Each event in Splunk contains the following metadata: timestamp, _____, index, ____ and host.

A

source, sourcetype

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The results that come up in a search of Splunk are called _____.

A

events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The 3 layout options for displaying search results (or 3 ways to view results) are ____, ____ and ____.

A

list, table, raw

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The ___ symbol “snaps” to the time unit that you specify in Splunk, and rounds down to the nearest specified unit. For example, if the current time was 09:37:12 on March 31st, and you want to look back to 30 minutes ago, you would type -30m___h.

A

@

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

After search results come up in Splunk, to select across a narrower time range on the timeline, what would you need to do?

A

click/drag across a series of bars

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Every search in Splunk is called a ____. By default, how long is each ____ available for?

A

job, 10 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

The job bar in a search allows you to ___ a job (toggle to resume a search), or ____ (finalizes the search in progress).

A

pause, stop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What in Splunk shows the distribution of events in the time range?

A

timeline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The ____ tool allows you to examine the following:

Overall stats of the search (e.g., records processed/returned, processing time)

How the search was processed

Where Splunk spent its time

A

Search Job Inspector tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

There are 3 types of search modes that you can use in Splunk. Which search mode emphasizes speed over completeness?

A

fast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

There are 3 types of search modes that you can use in Splunk. Which search mode balances speed and completeness, and is the default search mode?

A

smart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

There are 3 types of search modes that you can use in Splunk. The ____ search mode emphasizes completeness over speed. It also allows access to underlying events when using transforming commands (in addition to totals and stats)

A

verbose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

There are ___ types of read permissions. The default mode which is ____, only allows the creator access. If a read permission is set to ____, all app users can access search results.

A

private, everyone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

___ is the most efficient factor to use as a filter in Splunk. ____is the second most efficient item to use as a Splunk filter.

A

time, index

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

After time and index, what are the 3 next filters that are the most efficient?

A

host, source, sourcetype

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Is inclusion or exclusion generally better when it comes to search practices? Meaning including or excluding information?

A

inclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

You should avoid using ____ at the beginning or middle of a string. ____ at the beginning of a string scan all events within timeframe, while ____ in the middle of string may return inconsistent results.

What should be used instead?

A

wildcards (all 3 blanks)

Use instead: OR, IN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

True or false: Search term values are case sensitive.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Current time when the search starts is 08:31:15. -30m@h looks back to:

a. 8:00:00
b. 8:01:15
c. 9:00:00

A

b. 8:01:15

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

When you specify the following time range:

earliest=-2d@d
latest=@d

a. Looks back from two days ago, up to the beginning of today
b. Looks back exactly 48 hours ago
c. Looks back two days ago up to now

A

a. Looks back from two days ago, up to the beginning of today

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Select one of the following that uses Splunk search best practices as it relates to wildcards.

a. fail
b. fal
c. fail*

A

c. fail*

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Between search terms, ____ is implied unless otherwise specified

A

AND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Host, index, source, sourcetype, splunk_server, and timestamp are ___ fields that are already stored with the events in indexes.

A

default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

____ fields that are listed within an index include _raw, and _time.

A

internal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

The fields sidebar includes two types of fields. What are they?

A

selected, interesting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What type of fields occur in at least 20% of resulting events in Splunk?

A

interesting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

By default, the selected fields are what 3 metadata fields?

A

host, source, sourcetype

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What does the following mean?

status=404

A

error message for a webpage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What does the following mean?

area_code=404

A

for a specific area code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

If a value contains a space, it must be enclosed in ____ ____.

i.e. VendorCountry= “United States”

A

double quotes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Field ____ are case sensitive, while field ____ are not.

Take a look at the following example? Would it return results?

HOST=ww3

A

names, values

no

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Search for multiple values for a given field
by using the _____ operator.

i.e.
VendorCountry=”United States” ____ VendorCountry=”Canada”)

Alternatively, you can use the ___ operator

i.e. 
VendorCountry \_\_\_ ("United States", "Canada")
A

OR, IN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Both ! and NOT ____ events from your search, but can produced different results.

A

exclude

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

NOT status=200 returns events where status field exists and value in field doesn’t equal 200. However it ALSO returns events where status field ___ exist.

A

doesn’t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

status!=200 returns events where status field ___ and value in field ____ equal 200.

A

exists, doesn’t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

By default, which are the three selected fields?

a. host
b. source
c. sourcetype
d. action

A

a. host
b. source
c. sourcetype

64
Q

True or false: Field names are case sensitive.

A

True

65
Q

True or false: Field values are case sensitive.

A

False, field values are NOT case sensitive

66
Q

Clicking ______ actually opens a report for editing, while clicking the report _____ simply runs the report.

A

Open in Search

Title

67
Q

By default, all reports are _____ (meaning only the report’s creator/owner can access or edit it), and the report is run using the privileges of the report’s creator/owner.

A

private

68
Q

The three main ways to either create a ___ or ____ include selecting a field from the fields sidebar and choosing a quick report to run, using the Pivot interface, OR using the Splunk search language transforming commands in the Search bar.

A

table, visualization

69
Q

The statistics tab allows you to view your results in Splunk as a ____.

A

table

70
Q

_____ assigns colors based on the range of values.

A

Heat map

71
Q

_____ and ____ ____ highlights max and min of non-zero values

A

high and low values

72
Q

What consists of one or more panels displaying data visually in a useful way – such as events, tables, or charts?

A

a dashboard

73
Q

In Splunk Enterprise, reports are _______ searches.

a. grouped
b. saved
c. archived

A

b. saved

74
Q

When editing a report, you can do the following to the report. Select all that apply.

a. clone
b. edit schedule
c. delete
d. like

A

a. clone
b. edit schedule
c. delete

75
Q

There are three main methods to create tables and visualizations in Splunk. Select all that apply.

a. Use the fields sidebar
b. Use the Pivot interface
c. Use transforming commands
d. Click Splunk banner icon

A

a. Use the fields sidebar
b. Use the Pivot interface
c. Use transforming commands

76
Q

True or false: The Dashboard ID is automatically populated with a unique value.

A

True

77
Q

True or false: You must be a Splunk Admin user to choose the home dashboard (default dashboard).

A

True

78
Q

____ ____ ____ is used in your search language that tell Splunk what you want it to search for.

A

search language syntax

79
Q

There are 5 basic ____ ___ that someone using Splunk may use when doing a search in Splunk.

A

syntax components

80
Q

This language syntax components deals with what a Splunker is looking for. Examples include keywords, phrases and Booleans

A

search terms

81
Q

This syntax component is blue and tells Splunk what you want to do with your results.

Examples include: creating a chart, computing statistics, evaluating and formatting, etc.

A

commands

82
Q

This syntax component is pink and tells Splunk how you want to chart, compute, or evaluate results.

Examples include: getting a sum, getting an average, transforming values, etc.

A

functions

83
Q

What color is the “commands” syntax component? What about the “functions” syntax component? How about Boolean operators and Command modifiers? How about command arguments?

A

blue
pink
orange
black

84
Q

What color are the following syntax components in search language?

clauses, arguments and search terms

A

black

85
Q

This syntax component deals with variables that you want to apply to a function.

Examples include: getting a sum of or sum up all the values in the price field.

A

arguments

86
Q

____ (which are a syntax component in Splunk) deal with how you want to group or rename fields in your results.

A

clauses

87
Q

What command changes the name of a field? (i.e. If you wanted to change “productId” to “ProductID”)

A

rename

88
Q

True or False. Once you rename a field, the new field name CANNOT be used in the rest of the search string.

A

False

Once you rename a field, the new field name must be used in the rest of the search string

89
Q

Collections of files containing data inputs, UI elements, and/or knowledge objects are called _____.

A

apps

90
Q

How many Splunk products are there for IT Operations?

A

8

91
Q

Splunk for ____ generates real-time and predictive insights from industrial operational data.

A

Splunk for IoT

92
Q

What does “IoT” in Splunk for IoT stand for?

A

internet of things

93
Q

The ___ is the specific data type or data format where data comes from (ie. Word doc, PDF, Excel file, etc.)

A

sourcetype

94
Q

What are quotation marks used for in Splunk search strings?

A

phrases

95
Q

_________ in Splunk search strings are used to force precedence (meaning whatever is in ______ will be executed first. (Note: Same answer for both)

A

parentheses

96
Q

____ process machine data. They then store the results in ____ as events, thereby enabling fast search and analysis.

A

indexers, indexes

97
Q

You can search against multiple indexes by using the ___ operator.

A

OR

98
Q

Search Assistant is enabled by default in the user preferences of the ___ Editor.

A

SPL

99
Q

What control in the SPL Editor determines whether or not numbers show next to each line within the search syntax?

A

Line numbers control

100
Q

The SPL Editor “Search ____ format” option allows for automatic formatting of search syntax (which improves readability).

A

auto

101
Q

These type of fields occur in at least 20% of resulting events. ____ fields on the other hand are a set of fields that display for each event.

A

interesting fields

selected fields

102
Q

There are two types of default fields that are already stored with the event in the index. ____ fields have underscores and automatically come up when you start a search string. Examples include: “_raw,” and “_time.” ____ fields are things like host, index, source, sourcetype, splunk_server, timestamp.

A

internal

default

103
Q

The ____ command returns a table formed by only fields in the argument list. Column ____ consist of field names.

A

table

headers

104
Q

True or False. Once you rename a field, the new field name does not have to be used in the rest of the search string.

A

False

The new field name DOES have to remain the rest of the search string.

105
Q

What character (on your keyboard) can be used to rename multiple fields that match a pattern? For example, if you want to change the word “date” to “DATE” in date_minute and date_second in your table, you can input the following search string:

What character goes in each blank?

rename date_ as DATE_

A

a wildcard

106
Q

The ___ command allows to include or exclude fields in your search or report. The command includes either a + or – sign. Entering a + sign is not required because it’s the default. Entering the – sign after a field makes tables or display output easier to read. However there are no performance benefits since the excluded fields are processed after all fields are already extracted.

A

fields

107
Q

The ____ command is used to remove duplicates from your results.

A

dedup

108
Q

This command arranges events in ascending or descending order.

A

sort command

109
Q

If you wanted Splunk to only give you a maximum of 20 events, you would use the ____ command.

A

limit

110
Q

If you put a + or – sign right next to only one field name in a search string with many field names, it will only sort that one field name. What will happen if you add a space in between sort and multiple field names in a search string?

Example:
| sort – name, thread
(space added here between “sort” and “name”)

in comparison to:

sort –name, thread
(NO space added before the field name “name”)

A

It will sort ALL of the field names

111
Q

____ is used as an alternate method to access data without using search language, but requires use of data models and/or lookups.

A

Pivot

112
Q

____ creates visualizations based on datasets, time ranges and additional filters that you select.

A

Pivot

113
Q

The table command returns:

a. A table formed by only the fields in the argument list
b. A data table with statistical results
c. A bulleted list of key events

A

a. A table formed by only the fields in the argument list

114
Q

When renaming fields with spaces or special characters, use the rename command and include the new field name in _________.

a. single quotes
b. double quotes
c. parentheses

A

b. double quotes

115
Q

Use the dedup command to _________.

a. rename fields using alias
b. remove duplicate results
c. sort your results in descending order

A

b. remove duplicate results

116
Q

By default, the sort command lists results in __________ order.

a. ascending
b. descending

A

a. ascending

117
Q

What do Pivots require to create visualizations in
Splunk? Select all that apply.

a. data models
b. lookups
c. web filters
d. spreadsheets

A

a. data models

b. lookups

118
Q

The ___ command finds the most common values of a given field in results. What format does the output for the same command display in? Events, table, or visualizations?

A

top

table

119
Q

When you use the top command, how many results display in the table by default?

A

10

120
Q

You can control the number of results that are displayed in the top command table by using the ____ command.

A

limit

121
Q

If you type limit=5 after using the top command, it will display ___ results.

A

5

122
Q

When using the top command, typing “limit=0” will return a(n) ____ number of results.

A

unlimited

123
Q

True or False

A percent column (“showperc=t” command) is displayed by default in a table when using the top command. If you want to remove the percent column, “showperc=t” needs to be added to the search string.

A

True

124
Q

The top command “___” clause groups results.

A

by

125
Q

By default, the name of the “count” column (or count field) is “count.”

countfield=string (or countfield= the name you create) does what?

A

renames the field for display purposes

126
Q

The ____ command returns the least common field values of a given field in the results. How are the results sorted by default? In descending order, or ascending order?

A

rare

ascending order

127
Q

The ____ command enables you to calculate statistics on data that matches your search criteria. The common functions for the command are count, dc, sum, avg, max, min, list and values.

A

stats

128
Q

Which of the following stats commands only return an average of numeric values?

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

a. avg

129
Q

Which of the following stats commands returns the number of matching events based on the current search criteria?

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

d. count

130
Q

Which of the following stats commands refers to the minimum numeric value?

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

f. min

131
Q

Which of the following stats commands return a sum of numeric values only?

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

e. sum

132
Q

Which of the following stats commands list all values of a given field?

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

h. list

133
Q

The ___ stats command provides a count of how many unique values there are for a given field in the result set.

a. avg
b. max
c. dc, distinct_count
d. count
e. sum
f. min
g. value
h. list

A

c. dc, distinct_count

134
Q

Which of the following stats commands refers to the maximum numeric value?

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

b. max

135
Q

The ___ stats command lists unique values of a given field.

a. avg
b. max
c. dc
d. count
e. sum
f. min
g. value
h. list

A

g. value

136
Q

What clause would you use to rename the “count” field in your results?

A

as

137
Q

When using the top command, add the BY clause to _______.

a. return results grouped by the field you specify in the BY clause

b. specify how many results to return
c. return a percentage of events

A

a. return results grouped by the field you specify in the BY clause

138
Q

To display the least common values of a field, use the _________ command.

a. top
b. rare
c. stats

A

b. rare

139
Q

When you use the stats command with a BY clause, what is returned?

a. a statistical output for each value of the named field
b. one row
c. computes numerical statistics on each field if and only if all of the values of that of that field are numerical

A

a. a statistical output for each value of the named field

140
Q

index=sales sourcetype=vendor_sales
| stats count(price) as “Units Sold”, sum(price) as “Total Sales” BY product_name

In this search using the stats command, the BY clause is applied to:

a. count ( ) function
b. sum ( ) function
c. both count ( ) and sum ( ) functions

A

c. both count ( ) and sum ( ) functions

141
Q

Which UI (UI = user interface) formatting options can be applied to a data table on the Statistics tab? Select all that apply.

a. Add row numbers, highlight high/low values, and show totals and percentages
b. Color-code data in each column
c. Add number formatting, such as, currency symbols and thousands separators
d. Rename a field for display purposes

A

a. Add row numbers, highlight high/low values, and show totals and percentages
b. Color-code data in each column
c. Add number formatting, such as, currency symbols and thousands separators

142
Q

The four types of Splunk _____ out-of-the-box are file-based, external, KV store and Geospatial.

A

lookups

143
Q

____ provide enrichment to your event data by appending fields from another data source, also called lookup output fields.

A

Lookups

144
Q

____ ____ sometimes pull static (or relatively unchanging) data from standalone files at search time and add it to the search results.

A

file-based lookups

145
Q

True or False. Lookup field values are NOT case sensitive by default.

A

False

Lookups are case sensitive by default

146
Q

Which command is used to search the contents of a lookup table?

A

inputlookup command

147
Q

True or False. If a lookup is not configured to run automatically, use the lookup command in your search to use the lookup fields.

A

True

148
Q

_____ lookups populate your events with fields pulled from CSV files.

a. KV Store
b. File-based
c. Geospatial
d. External

A

b. File-based

149
Q

____ lookups use Python scripts or binary executables to append.

a. KV Store
b. File-based
c. Geospatial
d. External

A

d. External

150
Q

____ lookups are KMZ or KML.

a. KV Store
b. File-based
c. Geospatial
d. External

A

c. Geospatial

151
Q

____ lookups are the KV Store collection.

a. KV Store
b. File-based
c. Geospatial
d. External

A

a. KV Store

152
Q

File-based lookups populate your events with fields pulled from _________ files.

a. KMZ (Keyhole Markup language Zipped)
b. Python script
c. CSV (comma-separated values)
d. KV Store collection

A

c. CSV (comma-separated values)

153
Q

File-based lookups pull data from standalone files at ___________ and add it to search results.

a. index time
b. search time
c. _time

A

b. search time

154
Q
  1. In Splunk, there are up to 3 steps involved to create a lookup. Select all that apply.
    a. List existing lookup tables or upload a new file

b. Edit existing lookup definitions or define a
new file-based or external lookup

c. Edit existing automatic lookups or configure a new lookup to run automatically
d. Download from Lookup Library

A

a. List existing lookup tables or upload a new file
b. Edit existing lookup definitions or define a new file-based or external lookup
c. Edit existing automatic lookups or configure a new lookup to run automatically

155
Q

_____ reports are useful for:

–Monthly, weekly, daily executive/managerial roll up reports

–Dashboard performance

– Automatically sending reports via email

– Enriching event data, such as, generating a statistical output of historical events to a CSV file

A

scheduled

Splunk (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions