Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Splunk Advanced Power User > Fundamentals 3 > Flashcards

Fundamentals 3 Flashcards

1
Q

What command enables you to calculate stats on data that matches your search criteria?

A

stats command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does the | fieldsummary command do?

A

Calculates summary stats for all/subset of fields and displays in table form:
| fieldsummary [maxvals=num] [field-list]
- maxval: max distinct vals to return for the values stat of each field
- field-list: fields to calc stats for

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does the is_exact boolean indicate in the |fieldsummary results?

A

is_exact represents whether the distinct_count is exact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the |appendpipe command do?

A
  • Takes existing results and pushes them into sub pipeline

- Appends sub pipeline results as new lines to the outer search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do you name the appendpipe subtotals field after appending?

A

Use |eval column_name= “subtotals name”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How do you create a grandtotal field when using the |appendpipe command?

A

Use another |appendpipe command to search for and total only the subtotals fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do you use count and list functions to remove duplicates for info in tabular form?

A
  • Use |stats count as normal
  • Use |stats list(columnBfield), list(columnCfield) … by columnAfield
  • Column A is no longer duplicated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does the |eventstats command do?

A

Generates summary stats of all existing fields in search results and saves as new fields
- Works on entire results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does |streamstats do

A

Generates stats on fields and compiles to previous data

  • Works on entire results but calculates stats for each result row at the time command encounters it
  • index order matters
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are two arguments that can be used with |streamstats

A
  • current= t or f :include or not include current event in summary calc
  • window=# : calc over past # of events
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the |eval command do

A

Manipulate and calculate expression and creates a new field or overwrites existing one
|eval fieldname1=expression1, fieldname2=expression2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the |eval command conversion functions

A

tostring
tonumber
printf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the options for and syntax of the tostring function

A

tostring(field, “option”)

Options being: commas(also rounding to 2 decimals), duration(hh:mm:ss), hex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the options for and syntax of the tonumber function

A

tonumber(numstr,base)

Where numstr can be a field name or a number and base is optional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the options for and syntax of the printf function

A

printf(“format”,arguments)

Where format is conversion specifiers(%d,%f%s…) and arguments are optional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the eval now() function return

A

Time a search was started

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does the eval time() function return

A

Time event was processed by the eval command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the eval strftime function do

A

Converts timestamp to string format using strftime(X,Y) to convert epoch time to a readable format. Where x is UNIX time in seconds to be converted to a string
EX: Y= “%B-%d-%Y” yields format example February-19-2018

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does the eval strptime function do

A

Converts time in string format and parses it into a timestamp using strptime(x,y) where x is a time in string format and y is a timestamp format defined by variables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does the eval relative_time function return

A

Returns timestamp relative to a supplied time as if asking for data a day prior to a certain event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What do the lower() and upper() functions of the eval command return

A

Conversion of string to lower or upper case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does the eval substr(X,Y,Z) command return

A

Returns substring of X, according to the starting index Y and the length of Z

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does the eval replace(X,Y,Z) command do

A

Where X,Y,Z are all strings and Y is a regex, return a string where Z replaces each occurrence of Y in X
Note: eval commands do not alter the indexed data or write new data to index

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Do non-numeric values need to be in quotations when using the if() function?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does the eval cidrmatch(X,Y) function return

A

Returns t/f based on whether provided IP address Y matches subnet specified in X

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does the eval match(subject,regex) function return

A

Returns t/f depending on whether subject matches defined regex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does the eval coalesce(X1,X2…) function do

A

Retrieves the first value from the first field defined in the current event - used to normalize field names from results sets where two or more field names represent the same data field
Ex: combining fields with different names, but representing same data field, into one normalized field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does the eval isnull() function return

A

Returns t/f if field is null

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does the eval typeof() function return

A

Returns a string that represents the data type of the argument (number, string, boolean etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Are strings or numbers considered greater than when dealing with min() and max() functions?

A

Strings are greater

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What do the eval ceiling() and floor() functions return

A

Rounded up or down to the nearest whole integer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the eval cryptographic functions used for?

A

Used to compute and return secure, encrypted hash values of a string: md5, sha1, sha256, sha512

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does the | makeresults command return

A

By itself, generates one result with only _time field
Must be first command in search
Can be used with one or more eval commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the default case sensitivity for Lookups

A

Default is case insensitive but this can be changed in advanced options when creating a lookup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What kind of lookup should be used for large tables or ones that are updated often?

A

KV(Key Value) Store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Where do KV Stores and CSV files live?

A

KV Store collections are on the SH.

CSV files are replicated to indexer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which type of lookup provides REST API access, multiuser access locking, and per-record insert and updates?

A

KV Store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Why would you use a CSV lookup over KV store?

A

Small csv table performs well, need case insensitive lookups, or integrating with other apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Where is a KV Store collection defined?

A

Admin defines in configuration stanza in the collections.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Can you add results to a KV Store collection from SPL

A

Yes, use the outputlookup command to write results from a search to the collection provided data is shared and field names do not have . or $

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are scripted(external) lookups?

A

Lookup facilitated through use of a script used to populate events with field values from an external source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What language must the scripted lookup be written in?

A

Python script or binary executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the arguments passed to the script when creating a new external lookup?

A

Arguments are the field headers from the input/output CSV files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are geospatial lookups used for?

A

To create chloropleth map visualizations by matching coordinates from events to geographic feature collections in a KMZ or KML file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What command is used to access a geospatial lookup?

A

|geom featurecollectionname

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What does the DB Connect (DBX) app do?

A

Allows you to use lookups to reference fields in an external SQL db; import data, export machine data to external db, or use SQL to build dashboard mixing splunk and db data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How are database lookups completed?

A

Through the DBX app via Data Lab and New lookup options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What command is used to access DBX lookups?

A

|dbxlookup lookup=”lookup name”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

When using |dbxlookup do you need to reference input fields in your search?

A

Yes, to get results you must explicitly refer to input fields in search via |fields command or running search in Verbose mode

50
Q

Can alerts contain lookups?

A

Yes - run a search that contains a lookup command and save as alert

51
Q

How can alert results be output to a lookup?

A

‘Output results to lookup’ is one of the action options when creating an alert OR you can use: | outputlookup filename. OR tablename

52
Q

What do search metadata tokens provide?

A

Metadata about the alert and associated search:

$name$ $description$ $app$ $owner$ $trigger_date$ etc

53
Q

What do results tokens provide?

A

Field values from first row returned by the search associated with the alert - taking the form: $result.fieldname$

54
Q

What do server tokens provide?

A

Details about your splunk deployment:

$splunk.version$ $splunk.build$ etc

55
Q

What do job info tokens provide?

A

Data specific to a job search:

$job.eventSearch$ $job.messages$ $job.resultCount& etc

56
Q

What is a webhook alert action?

A

Action allows you to define custom callbacks on web resource via generation of JSON formatted info about alert and sending of HTTP POST request to specified URL

57
Q

What are ways of extracting fields?

A

Field Extractor using GUI (persistent and easy to use)
Manually coding a REGEX (precise and persistent)
Using erex SPL command (temporary and easy to use)
Using rex SPL command (temporary and precise)

58
Q

What is a regular expression (regex)?

A

Case sensitive sequence of characters, either regular with literal meaning or a metacharacter with special meaning, to define a pattern

59
Q

What regex type does splunk use?

A

Perl compatible

60
Q

What do \d \w \s match in regex

A

Any digit, word, or white space

61
Q

What to \D \W \S match in regex

A

Any NON digit word or whitespace

62
Q

What do ? * + match in regex

A

0 or 1 ; 0 or more ; 1 or more occurrences of the previous character

63
Q

What does . match in a regex

A

. is a wild card matching one character → so

.* would match anything

64
Q

How do you specify exactly n occurrences in regex

A

{n} after the character

65
Q

How do you turn a match into nongreedy matching as few characters as possible

A

Adding ? after the count

66
Q

How do perform a capture group in regex?

A

Parenthesis create a capture group which can be named using ? and references using $1, $2 …

67
Q

IF you want to group something, but not capture it, how do you write that in regex

A

(?:)

68
Q

How do you write an OR statement in regex

A

Pipe | character represents OR:

?: invalid|wrong

69
Q

What are the two search time extraction commands?

A

|erex just requires an example

|rex requires a regex

70
Q

What is the |erex syntax

A

|erex temp_fieldname examples=”ex1,ex2…”

71
Q

What is the |rex syntax

A

|rex field=fieldname “regex”
Where field is optional and used if you want to narrow down where the regex is going to search rather than all data with the default field of _raw

72
Q

How do you name a field while searching to match a regex with the |rex command?

A

( ? < field_name > regex )

73
Q

Which regex command should be used in saved reports?

A

|rex command

74
Q

What can be done to avoid backtracking and making multiple passes through the data when using regex

A

Limit use of quantifiers such as * and alternation constructs such as |

75
Q

What are regex best practices?

A

Avoid multiple .* matches; use + instead of *; use simple ungreedy expressions; use parentheses to multiple extractions

76
Q

What is self describing data?

A

Schema or structure is embedded in data and comprised of metadata (element names, data types…). Include JSON, XML and tabular files

77
Q

Can splunk automatically interpret self describing data?

A

Splunk recognized JSON so data will be accessible as fields. Additional steps are needed to interp XML

78
Q

If fields show up with a format of name{}.fieldname, what type of data has been ingested

A

JSON data

79
Q

What command interprets XML format to have access to data as splunk fields

A

spath command

80
Q

What is the syntax for the |spath command

A

|spath input=field_extract_from output=field_extract_to path=datapath_value_to_extract

Where all arguments are optional

81
Q

How is the |spath path argument defined?

A

Contains one or more location steps separated by periods and position of data in array is specified by digit in {}
Ex: entities.hashtags{3}.text

82
Q

Does numbering in path steps {} begin with 0 or 1

A

Begins with 0 for JSON and 1 for XML

83
Q

Can spath be used with |eval?

A

Yes, spath becomes the function spath(X,Y) where x is input and y is path

84
Q

How can you automatically extract data from XML at search time?

A

Set KV_MODE=XML in props.conf

85
Q

What does the |multikv command do?

A

Creates an event for each row of tabular data (headers at top row, values as the rest)

86
Q

When creating nested macros, the outer macro should be created before or after the inner

A

Create inner macro first

87
Q

What command allows you to check contents of search macros before executing?

A

Control/Command Shift E

88
Q

What are the three types of data summary creation methods

A

Report accel, summary indexing, data model accel

89
Q

What is the easiest and most efficient acceleration option and should be first choice?

A

Data Model Accel

90
Q

What is acceleration?

A

Using auto created accel summaries to improve search time completion

91
Q

What is report accelerations

A

Saving a qualifying report as accelerated then creates an acceleration summary that can be used to efficiently run future searches/reports on large volumes of data

92
Q

What search mode and user privileges are needed to accelerate a report?

A

Search in smart or fast mode with the scheduled_search privilege (power has by default)

93
Q

What happens to an acceleration summary if all reports that use it are deleted?

A

The summary is auto deleted

94
Q

What are the requirements for a report to accelerate?

A

Search must have a transforming command; commands before must be streaming, commands after non-streaming

95
Q

What is a streaming command?

A

Operate on each event as the event is returned by the search: eval, search, fields, rex, rename, replace etc

96
Q

What is a transforming command?

A

Commands massage raw data into a table transforming cell values for each event into numerical values: stats, chart, timechart, top, rare

97
Q

What is a non-streaming command?

A

Commands wait until all events are gathered from indexers before command gets executed: eval and rename become non streaming after a transforming command

98
Q

When do searches run faster without an acceleration summary?

A

<100K events in hot buckets or summary size projected to be too big

99
Q

What is the automatic backfill feature?

A

Report acceleration feature allowing automatic update/rebuild of summaries as needed during a data interruption

100
Q

When should you consider deleting an acceleration summary?

A

When the summarization load (effort to update summary) is high and the access count is low

101
Q

What is summary indexing?

A

An alternative to unqualified report acceleration where you schedule frequently running reports to extract only needed info into a summary index and run subsequent searches against that summary

102
Q

What type of transforming commands must be used in the report to create a summary index?

A

si commands: sichart, sitimechart, sistats, sitop, sirare

103
Q

Does a scheduled report automatically create a summary index?

A

No, you have to save a search as a scheduled report -> edit via edit summary indexing -> check enable summary indexing

104
Q

When do gaps occur in a summary index?

A

Populating reports run too long past next scheduled runtime
Forced real time scheduling
Splunk is down

105
Q

How do you backfill gaps in summary indexes?

A

Run the fill_summary_index.py script

106
Q

How do overlaps in summary indexes occur?

A

Setting report time range to be longer than frequency of report schedule

107
Q

What are data models?

A

Hierarchical structured datasets generating searches and driving pivots

108
Q

What does the |datamodel command do?

A

Returns description of all(or specified) data model and objects Ex: |datamodel [datamodel_name] [object_name] [search]
-Also used to search against data model

109
Q

Is |datamodel a generating command?

A

Yes, so it must be first command in pipe

110
Q

What is an acceleration summary built on the search head after user selects dataset and enters pivot editor?

A

Ad Hoc data model acceleration

111
Q

When are ad hoc acceleration summaries available to use?

A

Only while working in the pivot editor - not on reports or dashboards based on pivot

112
Q

What is a persistent data model acceleration?

A

Acceleration summary composed of multiple time-series index files optimized for speed to be used with pivot editor or tstats command

113
Q

Can ad hoc data model accelerations run for particular time ranges?

A

No they run over all time, only persistent acceleration can be scoped to time ranges

114
Q

What user privileges are needed to accelerate a data model?

A

Admin permissions or accelerate_datamodel privilege

115
Q

What type of events and datasets can be accelerated through Persistent acceleration?

A

Only root events can be accelerated - if multiple root events only the first is accelerated

116
Q

How often are the underlying data model acceleration tsidx files updated and removed?

A

Updated every 5 minutes and outdated items removed every 30min

117
Q

What does a tsidx file consist of?

A

A lexicon: alpha-numeric term list pointing to posting list

Posting list: array containing seek address, _time, etc mapping each term to events in the rawdata files containing term

118
Q

What files make up an index?

A

rawdata files and corresponding tsidx files

119
Q

How do you perform stats on indexed fields in the tsidx file?

A

By using the |tstats stat_function command

120
Q

Can you use |tstats with data models and summary indexes?

A

Yes use |tstats from datamodel = name OR summariesonly=t

121
Q

Does stats or tstats work best with massive amounts of data using indexed fields?

A

tstats

122
Q

How does tstats search an accelerated data model object?

A

Use FROM |datamodel to return model and its objects -> find field and its owner and use dot notation to input into | tstats sum(owner.field)

ag-Splunk Advanced Power User (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions