Working with Time Flashcards

1
Q

Which of the following are default time fields? Select all that apply.
* date_day
* date_mday
* date_year
* date_hour

A
  • date_mday
  • date_year
  • date_hour
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

date_time always reflects your local time zone and not the time/date from raw events.
TRUE or FALSE

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

_______ and _______ are the time modifiers that override the time range picker in a historical report
* first
* last
* latest
* earliest

A

earliest and latest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Using earliest=-30d@d latest=@d is how to return results from 30 days ago up until the time the search was executed.
FALSE
TRUE

A

False

@d, cutoff would be the beginning of the day of the search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What will the strftime function return when using the %H argument? Select all that apply.
* convert the hour into your local time based on your time zone setting of your Splunk web sessions
* hour of the event generated at index time
* time of raw event in UTC

A

convert the hour into your local time based on your time zone setting of your Splunk web sessions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

@timeUnit will always round up and go forward through time.
FALSE
TRUE

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Choose the search that will sort events into one minute groups. Select all that apply.
* | bin _time span=1mins
* | bin span=1minutes _time
* | bin _time span=1m

A
  • | bin _time span=1mins
  • | bin span=1minutes _time
  • | bin _time span=1m
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When using the following search arguments, what will be returned? | timechart count span=1h
* chart only events over a 1 hour period
* chart events in 1 hour chunks
* events in the last 24 hours
determine time range of events to scale

A

chart events in 1 hour chunks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly