Splunk Fundamentals 2 Flashcards
What does a Sparse search type mean?
- Returns a small number of results from each index bucket matching the search
- A small percentage of the data matches the search
- A large percentage of the data matches the search
- The indexer checks all buckets to find results, bot bloom filters eliminate those buckets that don’t include search results
A small percentage of the data matches the search
NOT,OR,AND are examples of what?
- Comparisons
- Booleans
- Keywords
- Phrases
Booleans
What is the fields command used for?
- Includes or excludes specified fields
- Renames a field in results
- Returns table containing only specified fields in result set
- Removes duplicates from results
Includes or excludes specified fields
What happens when you select Multi-series: Yes with timechart command?
- “Yes” causes each field value to share the x-axis
- “Yes” causes the y-axis to split for each field value
- “Yes” causes each field value to share the y-axis
- “Yes” causes the x-axis to split for each field value
“Yes” causes the y-axis to split for each field value
Which of the following are case sensitive in Splunk?
- Tags
- Field names
- Boolean operations
- Field values
Tags, Field names, Boolean operations
What is wrong with the following search? Index=_internal sourcetype=splunkd or sourcetype=audittrail | timechart count BY component
- Boolean operator should be uppercase
- “I” in Index should be lowercase
- Command clause should be lowercase
- There is no “timechart” command
Boolean operator should be uppercase, “I” in Index should be lowercase, Command clause should be lowercase
Which of the following are transforming search commands?
- top
- stats
- timechart
- fields
top, stats, timechart
Which of the following are search types in Splunk?
- Super Sparse
- Sparse
- Dense
- Rare
Sparse, Dense, Rare
Splunk contains several chart types, which of the following are chart types?
- Table
- Area
- Line
- Pie
Area, Line, Pie
How many results does chart and timechart command automatically filter to include?
- 5 highest values
- 10 lowest values
- 10 highest values
- 5 lowest values
10 highest values
When using the timechart command, which field is the x-axis?
- value
- sourcetype
- _time
- product
_time
The iplocation command can be used to add location information to events. Which information fields are added by the command?
- Country
- Latitude
- Longitude
- Continent
Country, Latitude, Longitude
What is the trendline command used for?
- Allows you to overlay a computed moving “count” on a chart.
- Allows you to overlay a computed moving “sum” on a chart.
- Allows you to overlay a computed moving “avg” on a chart.
- Allows you to overlay a computed moving “dc” on a chart.
Allows you to overlay a computed moving “avg” on a chart.
What values must be included for geostats command?
- latitude
- logitude
- _time
- count
latitude, logitude
Which command(s) can be used to filter results?
- filter
- where
- search
- showonly
where
The transaction command produces additional fields, which ones?
- summary
- eventcount
- duration
- transaction
eventcount, duration
By default, there’s a limit of 1000 events per transaction. Which .conf file should you edit to override this value?
- server.conf
- limits.conf
- props.conf
- transforms.conf
props.conf
Which of the following are examples of knowledge objects in Splunk?
- Lookups
- Eventtypes
- Field extractions
- Indexes
Lookups, Eventtypes, Field extractions
What methods can you use to extract fields with the field extractor(fx)?
- XML
- Delimiter
- Regex
- JSON
Delimiter, Regex
Where should you navigate to create a calculated field?
- Settings > Fields > Field extractions > New Calculated Field
- Settings > Fields > Field transformations > New Calculated Field
- Settings > Fields > Calculated Fields > New Calculated Field
- Settings > Fields > Field aliases > New Calculated Field
Settings > Fields > Calculated Fields > New Calculated Field
What’s the keyboard shortcuts to check the content of a macro from the search bar?
- Command+Shift+M / Control+Shift+M
- Command+Shift+F / Control+Shift+F
- Command+Shift+E / Control+Shift+E
- Command+Shift+A / Control+Shift+A
Command+Shift+E / Control+Shift+E
Which types of datasets can a data model consist of?
- Transactions
- Events
- Searches
- Metrics
Transactions, Events, Searches
What is the Common Information Model (CIM) Add-on used for?
- Create workflow actions
- Ingest data from CIM data sources
- Normalization of data
- Alert trigger actions
Normalization of data
