Splunk Fundamentals 2 Flashcards
1
Q
Knowledge Objects
A
Tools to discover and analyse various aspects of the data
2
Q
Some functions of knowledge objects
A
- Data interpretation: fields and field extraction
- Data classification: event types
- Data enrichment: lookups and workflow action
- Normalization: tags and field aliases
- Datasets: data models
3
Q
Characteristics of Knowledge Objects
A
- Shareable
- Reusable (i.e. macros and reports can be shared by ppl, apps)
- Searchable (persistent => can be used in search)
4
Q
Naming Convention for Knowledge Objects
A
Group_ObjectType_Description
5
Q
Common Information Model (CIM)
A
- methodology for normalizing data
- easily correlate data from different sources and source types
- leverage to create various objects discussed in this course - field extractions, field aliases, event types, tags
6
Q
Fields stored prior to search time
A
- meta fields: host, source, sourcetype
2. internal fields: _raw, _time
7
Q
Field Auto-Extraction
A
- Splunk automatically discovers many fields based on source type and key/value pairs found in the data
- At search time, field discovery discovers fields directly related to the search’s results
- Splunk may discover other fields not directly related to search
8
Q
Use field extractor (FX) to extract fields that are:
A
- static
- often used in searches:
- Graphical UI
- Extract fields from events using reges or delimiter
- Extracted fields persist as knowledge objects
- Can be shared and re-used in multiple searches
9
Q
Field Extraction Methods
A
- Regex
2. Delimiter
10
Q
Field Aliases and Original Fields
A
- original field is not affected by creating an alias
2. both fields appear in the All Fields and Interesting Fields lists (if appear in more than 20% of events)
11
Q
Search Case Sensitivity: Sensitive
A
- boolean operators
- field names
- field values from lookup (default, configurable)
- regular expressions
- eval and where commands
- Tags
12
Q
Search Case Sensitivity: Insensible
A
- command names (Stats, stats)
- command clauses (AS vs as)
- search terms
- statistical functions
- field values (unless from lookup)
13
Q
Splunk Search Buckets
A
- index’s hot bucket = only writable bucket
- each bucket has own raw data, metadata, index files
- admins can add more
- search is done through time and indexes
- buckets transform from hot (now -8h) to warm (-9h to -48h) and cold state
14
Q
General search practices
A
- time is the most efficient filter
- most powerful keywords are host, source and source type
- use fields commands to extract (discover) only fields you need
- only trailing wildcards make efficient use of index
- wildcards are tested after all other terms
- inclusion is better than exclusion
- filter as early as possible (i.e. remove duplicates)
- use appropriate search mode
15
Q
Transforming commands
A
- it is required to ‘transform’ search results into visualisations
- massages raw data into a data table
- examples of transforming commands:
- top
- rare
- chart
- timechart
- stats
- geostats
