Module 8: SPL Fundamentals Flashcards

1
Q

Splunk Search Language: Commands

A

Tells splunk what to do with search results. (Charts, stats, formatting)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Splunk Search Language: Functions

A

Explains how to execute command (sum, average, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Arguments

A

Variables to apply to functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Clauses

A

How to group or define results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

(pipe)

A

Tells splunk to pass results to next search component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Boolean color code

A

Orange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Commands color code

A

Blue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Argument color code

A

Green

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Functions color code

A

Purple

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Search commands execute in which direction

A

Left to right. Narrow as they go

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Fields command

A

Includes/Excludes specific fields from search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Table command

A

Returns a table with fields in the argument list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Rename command

A

Assigns friendly name to field in tabular view.

Affects search if used early

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Dedup command

A

Removes duplicate events with common values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

sort + vs sort - in numeric searches

A

Sort + sorts in ascending order (1-100)

Sort - sorts in descending (100-1)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

limit command

A

Limits displayed results