Splunk Fundamentals 2 Flashcards
What does a Sparse search type mean?
- Returns a small number of results from each index bucket matching the search
- A small percentage of the data matches the search
- A large percentage of the data matches the search
- The indexer checks all buckets to find results, bot bloom filters eliminate those buckets that don’t include search results
A small percentage of the data matches the search
NOT,OR,AND are examples of what?
- Comparisons
- Booleans
- Keywords
- Phrases
Booleans
What is the fields command used for?
- Includes or excludes specified fields
- Renames a field in results
- Returns table containing only specified fields in result set
- Removes duplicates from results
Includes or excludes specified fields
What happens when you select Multi-series: Yes with timechart command?
- “Yes” causes each field value to share the x-axis
- “Yes” causes the y-axis to split for each field value
- “Yes” causes each field value to share the y-axis
- “Yes” causes the x-axis to split for each field value
“Yes” causes the y-axis to split for each field value
Which of the following are case sensitive in Splunk?
- Tags
- Field names
- Boolean operations
- Field values
Tags, Field names, Boolean operations
What is wrong with the following search? Index=_internal sourcetype=splunkd or sourcetype=audittrail | timechart count BY component
- Boolean operator should be uppercase
- “I” in Index should be lowercase
- Command clause should be lowercase
- There is no “timechart” command
Boolean operator should be uppercase, “I” in Index should be lowercase, Command clause should be lowercase
Which of the following are transforming search commands?
- top
- stats
- timechart
- fields
top, stats, timechart
Which of the following are search types in Splunk?
- Super Sparse
- Sparse
- Dense
- Rare
Sparse, Dense, Rare
Splunk contains several chart types, which of the following are chart types?
- Table
- Area
- Line
- Pie
Area, Line, Pie
How many results does chart and timechart command automatically filter to include?
- 5 highest values
- 10 lowest values
- 10 highest values
- 5 lowest values
10 highest values
When using the timechart command, which field is the x-axis?
- value
- sourcetype
- _time
- product
_time
The iplocation command can be used to add location information to events. Which information fields are added by the command?
- Country
- Latitude
- Longitude
- Continent
Country, Latitude, Longitude
What is the trendline command used for?
- Allows you to overlay a computed moving “count” on a chart.
- Allows you to overlay a computed moving “sum” on a chart.
- Allows you to overlay a computed moving “avg” on a chart.
- Allows you to overlay a computed moving “dc” on a chart.
Allows you to overlay a computed moving “avg” on a chart.
What values must be included for geostats command?
- latitude
- logitude
- _time
- count
latitude, logitude
Which command(s) can be used to filter results?
- filter
- where
- search
- showonly
where
