Splunk Core Exam Graded A+

Splunk Core Exam Graded A+ Search and Reporting App - Answer- Default interface. Enables you to create knowledge objects, reports, dashboards, and more. Sourcetype - Answer- classification of data Source - Answer- File or directory path from which the event originated. Host - Answer- host name, IP address, or domain from which the event originated. Patterns tab - Answer- allows you to see patterns in your data. Statistics - Answer- If your search has statistics they will be displayed. Transforming Commands - Answer- Commands that create statistics or visualizations. You can transform event data into data tables. Search job can remain active for .... - Answer- 10 minutes Shared search job remains active for _____ days and will be readable to everyone. - Answer- 7 Search Mode - Fast - Answer- Cuts down on the field information that is returned. Field discovery is turned off (disabled) for this mode. Search Mode - Verbose - Answer- Returns as much fields and event data as possible discovering all the fields it can. Search Mode - Smart - Answer- Toggles behavior based on the type of search you are running. Wildcard - Answer- Adding an asterisk to the end of the text returns any event that starts with that text. Booleans - Answer- 1. NOT 2. OR 3. AND When searching for results that contain quotes you can use a __________ character to escape them. - Answer- backslash Interesting Fields - Answer- Fields that have value in at least 20% of the events. String values are represented as ____ in the fields sidebar. - Answer- a Numeral values are represented as ____ in the fields sidebar. - Answer- # At the bottom of each event you can see the ... - Answer- selected fields Field names are _____ - Answer- Case Sensitive Field Values are _____ - Answer- Not case sensitive The best way to limit events is to use .... - Answer- time Default fields values of _____ , ______ , ______ , and ______ are the most powerful. - Answer- index, source, host, and sourcetype __________ is better than __________ - Answer- Inclusion is better than exclusion @ = _________ , so if -30m@h was run at 9:37, events from 9:00 will be returned - Answer- round down Splunk search language consists of ...... - Answer- search terms, commands, functions, arguments, and clauses. Boolean operators and command modifiers are displayed in ...... - Answer- orange Commands are displayed in .... - Answer- blue Command arguments are displayed in ..... - Answer- green Functions are displayed in ...... - Answer- purple Cntr + does what? - Answer- Moves each pipe to new line. Being able to limit the fields extracted makes your search more efficient. - Answer- Ex. |fields -status, clientip You use the ____ command to include or exclude fields from search results. This is useful to limit fields and can make your search faster. - Answer- Fields This command retains searched data in tabulated format. - Answer- Table command This command is used to rename fieds. - Answer- Rename command This command removes events with duplicate values. - Answer- Dedup command This command displays results in ascending or descending order. By default a given field is displayed in ascending order. - Answer- Sort Command Transforming Commands - Answer- Orders search results into a data table. Top, rare, stats, timechart, chart, contingency, highlight This command finds the most common values of a given field. By default it will show 10 results - Answer- Top command Ex. | top vendor limit=20 Can be used with command clauses: limit = int countfield = string percentfield = string showcount = True/False showperc = True/False otherstr = string This command shows the least common values of a field set. - Answer- Rare Command. Same options as top command. Can be used with command clauses: limit = int countfield = string percentfield = string showcount = True/False showperc = True/False otherstr = string This command is used to produce statistics of our search results. - Answer- Stats command Common stats command functions are. - Answer- count, distinct count, sum, average, min, max, list, values. As a _____ user we can allow read and write permissions. - Answer- Power ____________ charts can be based on numbers, time, and location. - Answer- Visualization ____________ is a collection of reports - Answer- Dashboard Time range picker only works on panels that include an _______ search - Answer- inline _______ allows users to design reports in a simple to use interface without ever having to craft the search string. - Answer- Pivot