Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Everything Splunk > Splunk Fundamentals 1 > Flashcards

Splunk Fundamentals 1 Flashcards

1
Q

Machine data makes up for more than __% of data accumulated by organizations

A

90%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Index Data

A

Collects events and normalizes it with discrete time stamps into different sourcetypes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Describe functions of indexers, search heads, and forwarders

A

The Indexer processes machine data from the Forwarders, and the search heads distributes searches to the indexers and extracts field value pairs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.

A

Forwarders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the three main processing components of Splunk?

A

Indexers, Forwarders, Search Heads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Search strings are sent from the _________.

A

Search Head

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of these is not a main component of Splunk?

  • Add knowledge
  • Compress and archive
  • Search and investigate
  • Collect and index data
A

Compress and archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This role will only see their own knowledge objects and those that have been shared with them.

A

User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 3 roles in Splunk, from most to least powerful?

A

Admin, Power, User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which apps ship with Splunk Enterprise?

A

Home App, Search & Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

You can launch and manage apps from the home app.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

_________ define what users can do in Splunk.

A

Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The monitor input option will allow you to continuously monitor files.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.

A

Source Types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Splunk uses ________ to categorize the type of data being indexed.

A

Source Types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In most production environments, _______ will be used as the source of data input.

A

Forwarders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Files indexed using the the upload input option get indexed _____.

A

Once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are commands that create statistics and visualizations called?

A

Transforming Commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What booleans are used to tie events together in search?

A

AND OR NOT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the order of operations for boolean evaluation?

A
  1. Parenthesis() 1. NOT 2. OR 3. AND
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How do you search exact phrases?

A

place terms in quotes “”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How do you escape quotes from being interpreted in a search?

A

Use a backslash character, eg info=”user "chrisv4" not in db”

This searches for the exact phrase user “chrisv4 not in db

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A search job will remain active for ___ minutes after it is run.

A

10 Minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Shared search jobs remain active for _______ by default.

A

7 Days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How is the asterisk used in splunk search?

A

As a wildcard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the time stamp seen in events based on?

A

Your user account time zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Field names are ______ while values are not

A

Case sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the difference between != field operator and NOT

A

!= returns events where the contents of the field is not equal to the specified value

eg status !=200 shows all the events where the status field is not 200

NOT returns all events where there is no field status=200

NOT is more inclusing than !=, and will return events that don’t include the specified field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does the field operator IN do?

A

Alternative to chaining together operators inside parenthesis, Searches field for results inside parenthesis eg

index = web status IN(“500, “503”, “505”)

is the same as

index = web (status=500 AND status =503 AND status=505)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Field Values are Case sensitive. T/F?

A

False, only field names are case sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which is not a comparison operator in Splunk?

<=
?=
>
!=
=
A

?= is not a comparison operator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Can wildcards be used in field searches?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the 5 main components of Splunk ES

A

Index Data, Search & investigate, Add knowledge, Monitor & Alert, Report & Analyze.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What attributes describe this field?

a dest 4

A

It contains 4 values, and it contains string values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the most efficient way to filter events in a search?

A

Time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Search best practices

A
  • Index host sourcetype
  • Inclusion better than exclusion
  • Apply filtering commands as early as possible in search to limit events
  • Only search index containing events you need
  • Can also limit access with indexes, possible to search multiple indexes at the same time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What 4 default fields are extracted at index time, and are the most powerful to search to limit events (disregarding time)?

A

index, source, host, sourcetype

These fields do not need to be extracted during search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which is better in a search, inclusion or exclusion?

A

Inclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is -30mon?

A

time modifier for 30 months in search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

How do you specify a time range in search?

A

By using earliest= latest=

eg: earliest=-2h latest=-1h

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What privileges does an admin user have?

A

Install apps, create knowledge objects for all users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What privileges does a power user have?

A

Real time searches, create and share knowledge objects for users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What app(s) does splunk come with by default?

A

Search and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What does the search and reporting app do?

A

Create knowledge objects, reports, and dashboards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is a knowledge object in splunk?

A

Everything outside the basic data – A user creation that enriches existing data, such as a saved search, event types, tags, field extractions, lookups, reports, alerts, data models, transactions, workflow actions, and fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

The seven main components in splunk searching and reporting?

A
  1. Splunk bar
  2. App bar
  3. Search bar
  4. Time range picker
  5. How to search panel
  6. What to search panel
  7. Search History
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

The time range picker is set to ___ by default

A

All time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are the three main search modes?

A

Fast, smart, verbose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

_______ mode has discovery off for event searches. No event or field data for stats searches.

A

Fast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

______ mode has all events and field data; switches to this mode after visualization

A

Verbose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

______ mode (default-based on search string data) has field discovery ON for event searches. No event or field data for stats searches.

A

Smart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What does the “Job V” action button do

A

Edits job settings, sends jobs to the background, inspects and deletes job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Saved searches are set to ___ by default

A

private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Exact phrases use

A

quotes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What boolean is implied if none is used?

A

AND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

_______ fields have values in at least 20% of the events

A

Interesting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Clicking on a field shows a list of _______, ________, and ________.

A

Values, count, percentage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

These fields can launch a quick report by clicking on them (4)

A

top values, top values by time, rare values, events with this field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What five components are the splunk search language made of?

A 
Search terms
commands
functions
arguments
clauses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is the Fields command?

A

Allows you to include or exclude specific fields from results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Would the ip column be removed in the results of this search? Why or why not?

sourcetype=a* | rename ip as “User” | fields - ip

A

No, because the name was changed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Finish the rename command to change the name of the status field to HTTP Status.

A

status as “HTTP Status”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is missing from this search?

sourcetype=a* | rename ip as “User IP” | table User IP

A

Quotation marks around User IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What command would you use to remove the status field from the returned events?

sourcetype=a* status=404 | ________ status

A

fields -

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Which symbols are only used with numerical values?

A

> > = < <= –>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Top command returns top ____ results with a count and percentage

A

10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

________ is an action that a saved search triggers based on the results of the search

A

Alert

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

________ designs reports into a simple interface without having to craft a search string

A

Pivot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

The default time value for pivot is ______

A

All time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

_______ object is the main source of data

A

Root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

_______ object acts like an AND boolean

A

Child

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

An instant pivot allows instant access to data without having a data model (T/F)

A

True

73
Q

alerts use a _______ search to check for events.

A

saved

74
Q

Use ________ alerts to check for events on a regular basis

A

Scheduled

75
Q

_______ alerts monitor for events continuously

A

Real-Time

76
Q

What is the difference between traditional Index Clusters and Non-Replicating Index Clusters?

A

Non-replicating does not provide HA but offers simplified management

77
Q

In addition to the three main splunk components, (Indexer, Forwarder, Search Head), what are the three other splunk components?

A

Deployment Server, Cluster Master, License Master

78
Q

Where are forwarders normally installed?

A

At the data source or server

79
Q

What is a search head cluster and what are its minimum requirements?

A

An aggregation of at least three search heads that allows users to share resources and searches

80
Q

What are the three phases of the splunk indexing process?

A

Input, parsing, indexing

81
Q

What five components does each event have?

A

Timestamp, Index, Sourcetype, Host, Source

82
Q

What are the abbreviations for time search?

A

@ - rounds down to the nearest specified unit

s - seconds
m - minutes
h - hours
d - days
w - week
mon - months
y - year

eg -30m@h searches back to the beginning of the closest hour and searches 30 minutes of data

83
Q

What are best practices for using wildcards?

A

Avoid using them at the beginning or middle of a string, only at the end.

When possible use OR instead of wildcards

84
Q

How do you use the sort command?

A

can add limit=# to limit results

sort fieldname1, +ascendingfieldname2, -descendingfieldname3

85
Q

How do you create a table in search?

A

table fieldnamecolumnone, fieldnamecolumntwo, column additionalfieldnames

86
Q

How do you use the rename command?

A

Note: further pipes need to reference the new field name

rename FieldName “New Name For Field”

87
Q

What does the fields command do?

A

Improves efficiency by specifying which fields to extract

eg | fields fieldname1, fieldname2, FieldName3

Can also remove fields to make table or results easier to read

eg | fields -NotNeededField

88
Q

How does the dedup command work?

A

Removes duplicate field value results

eg | dedup fieldname1, fieldname2 | table fieldname1, fieldname2

89
Q

What is a sourcetype in Splunk?

A

A default field used to identify the data structure of an incoming event so Splunk can format the data properly during indexing

90
Q

What do transforming commands do?

A

Visualize data, etc

91
Q

Top Command

A

automatically returns count and percent columns in a table and returns top 10 results

Can also use by clause

top fieldname

92
Q

What is the rare command?

A

Opposite of top command, uses same clauses

93
Q

What is the stats command, and what are the functions??

A

Allows you to calculate statistics on data returned in search

Functions:
count
distinct count (dc)
sum
avg
min
max
list
94
Q

Describe the count function

A

Part of the stats command, counts the number of events that match search criteria or field

95
Q

Describe the dc function

A

Part of the stats command, returns count of unique (distinct) values for a given field. Distinct Count

96
Q

Describe the sum function

A

part of the stats command, sums up all events of a given search

stats sum(fieldName) as “New Field Name” by AnotherField

97
Q

Describe the average function

A

part of the stats command, averages value of events for a given search

98
Q

How many results are shown by default with a top or rare command?

A

10

99
Q

Which stats command would you use to find the average value of a field?

A

AVG

100
Q

To display the most common values of a specific field, which command would you use?

A

Top

101
Q

Which clause would you use to rename the count field?

sourcetype=vendor* | stats count ___ “Units Sold”

A

As

102
Q

How do you limit the top command?

A

use limit=# clause

103
Q

How do you remove the percent column from a top search?

A

showperc=f

104
Q

Describe the list function

A

part of the stats command, lists all the values returned for a given field

105
Q

What’s the best way to share search results?

A

Generate a report

106
Q

What is a dashboard?

A

A collection of reports combined into a single pane

107
Q

How do you create a dashboard or a report?

A

Click the save as button top right

108
Q

How do you save or edit dashboards?

A

Save as dashboard, click existing tab. Can edit searches in the dashboard as well

109
Q

If a search returns _____, you can view the results as a chart

A

Statistical Values

110
Q

______ are reports gathered together under a single pane of glass

A

Dashboards

111
Q

T/F – Charts can be based on numbers, time, or location

A

True

112
Q

In a dashboard, a time range picker will only work on panels that include a(n) __________ search.

A

inline

113
Q

Which role(s) can create reports?

A

All - user, power, admin

114
Q

Why would you create panels from reports?

A

It’s efficient because any changes made to the reports update the dashboards, and a single report can be shared between dashboards

115
Q

What is pivot?

A

Ability for users to design reports from data models created by admins and power roles. Essentially GUIed splunk language

116
Q

What are child data sets in Pivots?

A

Child data sets are an AND boolean in splunk language

117
Q

What are Datasets in data models?

A

Allows users to create reports with pre-defined datasets without knowing splunk query action

118
Q

T/F Pivots cannot be saved as reports panels

A

False - pivots can be saved as report panels

119
Q

The instant pivot button is displayed in the statistics and visualization tabs when a ______ search is run

A

non-transforming

120
Q

Adding child data model objects is like the _____ Boolean in the Splunk search language

A

And

121
Q

T/F Pivots can be saved as dashboard panels

A

True

122
Q

Which role(s) can create data models?

A

Admin and Power

123
Q

What is a lookup?

A

A dataset imported into splunk which appears in the sidebar as fields to add additional context to events, such as a .csv file with status code information or geospatial data

124
Q

What is a lookup table?

A

a .csv or similar uploaded lookup table file available in a particular app context, eg search

125
Q

How is lookup used in search?

A

lookup specifyinputtedTableLookupSource SourceFieldName OUTPUT fieldname1 fieldname2

126
Q

How do automatic lookups function?

A

You create knowledge object in settings where you tell splunk how fields are mapped and defined

127
Q

When using a .csv file for lookups, the first row in the file represents this.

A

Field Names

128
Q

External data used by a lookup can come from sources like:

A

scripts, CSV files, Geospatial Data

129
Q

To keep from overwriting existing fields with your Lookup you can use the ____ clause

A

OUTPUTNEW

130
Q

Finish this search command so that it displays data from the http_status.csv lookup file

A

inputlookup http_status.csv

131
Q

T/F A lookup is categorized as a dataset

A

True

132
Q

What all can alert actions do?

A 
Send an email
Run a script
Run webhook
Log event
Output results to lookup
Output results to telemetry endpoint
133
Q

T/F Real Time alerts will run the search continuously in the background

A

True

134
Q

An alert is an action triggered by a ____

A

Saved Search

135
Q

These are knowledge objects that provide the data structure for pivot

A

Data Models

136
Q

Describe the inputlookup command

A

ingests inputlookup from a .csv or other source

137
Q

T/F A lookup is categorized as a dataset

A

True

138
Q

To keep from overwriting existing fields with your Lookup you can use the ____________ clause.

A

OUTPUTNEW

139
Q

Before a report can be embedded, it must be _____

A

Scheduled

140
Q

Search terms include:

A

Keywords, booleans, phrases, fields, wildcards, and comparisons

141
Q

______ tell Splunk what we want to do with results (ex. stats)

(components of search language)

A

Commands

142
Q

______ are how we deal with results (ex. list)

components of search language

A

Functions

143
Q

______ are variables to apply to function (ex. Product name)

components of search language

A

Arguments

144
Q

_______ are how we want results defined.

components of search language

A

Clauses

145
Q

Field_____happens after field______only affecting displayed results.

A

Exclusion, Extraction

146
Q

This command combines fields from external sources to searched events, based on event field

A

Lookup

147
Q

This command shows the number of events matching search criteria

A

Stats count

148
Q

This command is the sum of numerical value

A

Stats sum

149
Q

This command preforms stats aggregation against time

A

timechart

150
Q

___ splits data by an additional field

A

by

151
Q

Uses Splunk search language, distributes search requests to indexers. Contains reports, dashboards, and visualizations

A

Search Heads

152
Q

Forwarder

A

Consumes and sends data to the indexer

153
Q

Can set read permissions, lifetime, and link to a job

A

Job settings

Each search is a job

154
Q

Searchable key/value pairs in your event data. They are case sensitive

A

Fields

155
Q

A location where Splunk stores and searches for event data

A

Indexer

156
Q

Search component that defines how you want to chart, compute, or evaluate results - get sum, get an average, transform the values, etc

A

Functions

157
Q

Search component that define what you are looking for - keywords, phrases Booleans, etc. These are case insensitive.

A

Search terms

158
Q

Are variables that you can apply to functions – can calculate average value for a specific field, convert milliseconds to seconds, etc

A

Argument

159
Q

Determines how you want to group or name the fields in the results, can give the field another name or group values by or over

A

Clauses

160
Q

The command that controls the number of returned results

A

Limit

161
Q

Three main methods to create tables and visualizations in Splunk are:

A

1) Select a field from the fields sidebar
2) Use the Pivot interface
3) Use a transforming command in the search ba

162
Q

Used when static or unchanging data is required for searches but isn’t available in the index

A

Lookups

163
Q

The command that loads results from a specified static lookup

A

inputlookup

164
Q

Which of the following are default roles in Splunk?

System
Admin
Power
User

A

Admin, Power and User

165
Q

Splunk is comprised of three main processing components, which ones?

License Master, Indexer & Forwarder
Indexer, Search head & Forwarder
Indexer, Cluster Master & Search head
Deployment Server, Indexer & Cluster Master

A

Indexer, Search head & Forwarder

166
Q

What is the minimum amount of search head(s) required to establish a search head cluster?

4
1
2
3

A

3, in case one fails there’s still a Captain and at least one member

167
Q

What is a deployer used for?

Management and distribution of apps to a cluster
Management and distribution of apps to a search head cluster
Management and distribution of apps to a indexer cluster
Management and distribution of apps to a forwarder cluster

A

Management and distribution of apps to a search head cluster

168
Q

Which of the following Splunk components can be installed from the Splunk Enterprise package?

Search head
Heavy Forwarder
Universal Forwarder
Indexer

A

Universal Forwarder

169
Q

What are the default metadata values that Splunk applies?

Punct
Source
Sourcetype
Host

A

Source, Sourcetype, Host

170
Q

Splunk allows users to search with different search modes, which ones?

Quick
Fast
Smart
Verbose

A

Fast, Smart, Verbose

171
Q

What are some search best practices?

Specify one or more index values in the end of your search string
Include as many search terms as possible
Exclusion is generally better than inclusion
Make your search terms as specific as possible

A

Make your search terms as specific as possible

Include as many search terms as possible

172
Q

avg,sum,tostring are examples of what?

Clauses
Commands
Arguments
Functions

A

Functions

173
Q

When using sort command, you can specify the number of results to return from the sorted results with limit argument. But what is the effect if you write | sort 0 .field.?

0 is an invalid argument counter
0 means that all results are returned
0 means that no results are returned
The correct argument is limit=0

A

0 means that all results are returned

174
Q

Which command is used to load the results from a specific static lookup file?

import
inputlookup
lookup
outputlookup

A

inputlookup

175
Q

Knowledge objects can be shared with different permissions(s), which one(s)?

Hidden
Owner(Private)
App
All apps(Global)

A

Owner(Private), App, All apps(Global)

176
Q

What is the default timerange for Pivots?

Past 7 Days
All Time
Past 1 Hour
Past 24 Hours

A

Past 7 Days

177
Q

Splunk fields are searchable key/value pairs in your data. In the picture shown below, which is the key and which is the value? (Select 1 option for key and 1 for value, minimum 2 options)

value: www1
key: host
key: www1
value: host

A

key: host, value: www1

178
Q

Splunk fields are searchable key/value pairs in your data. In the picture shown below, which is the key and which is the value? (Select 1 option for key and 1 for value, minimum 2 options)

value: www1
key: host
key: www1
value: host

A

key: host, value: www1

Everything Splunk (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions