Splunk Fundamentals 1 questions and answers 2023 verified

Splunk Fundamentals 1 questions and answers 2023 verified 5 Main components of Splunk Enterprise Index Data, Search & investigate, Add knowledge, Monitor & Alert, Report & Analyze. - Module 1 Three main roles in splunk? (3) Admin, Power, User - Module 1 What role can Install apps, create knowledge objects for all users, and can control what apps a user will see by default Admin What role can creates and share knowledge objects for users of app, and create real-time searches Power User What role can only see it's own knowledge objects and those shared to them User What are Apps in Splunk? They are Designed to address a wide variety of use cases, and extend the power of Splunk They are a Collection of files containing data inputs, UI elements, and/or knowledge objects They Allow multiple work-spaces for different use cases/user roles to co-exist on a single Splunk Instance There are 1000+ ready-made apps in Splunkbase - Module 1 What does the search and reporting app do in splunk? a. A default interface for searching and analyzing data b. Creates knowledge objects, reports, and dashboards - Module 1 What are the seven main components in the splunk search and reporting App? Splunk bar, App bar, Search bar, Time range picker, How to search panel, What to search panel, and Search History, - Module 1 What does the time range picker do? a. The single most important parameter you can specify b. Retrieve events over a specific time period c. Allow search by preset times, relative times. Real time (earliest, latest), date range Limiting search by ___________ is key to faster results and is a best practice Time - Module 7 The time range picker is set to _________ by default. All-time Search jobs are available for ____ minutes by default. 10 ________ commands create statistics and visualizations. Transforming ________ tab is default tab for searches Event The three main search modes? Fast, Verbose, and Smart - Module 6 The _______ search mode Emphasizes speed over completeness, and has discovery turned off for event searches. No event or field data for stats searches. Fast - Module 6