Module 1: Beyond Search Fundamentals Flashcards
What is this an example of?
Search for a single word (e.g., error) or group of words (e.g., error password)
This is an example of Keywords
Page 14 Mod 1
NOT, OR, AND are what in the Splunk language?
Booleans
Page 14 Mod1
Must NOT, OR, AND booleans be uppercase?
Yes, these Booleans are always uppercase
Page 14 Mod 1
Are phrases like “web error” different from “web AND error”?
Yes, these examples are different
OR is implied not AND
Page 14 Mod 1
What are the rules for using Wildcards in Splunk’s search language?
Starting searches with a wildcard and adding Wildcards in the middle of the search string are inefficient ways to use Wildcards
Tailing wildcards are a best practice
Page 14 Mod 1
What are the comparisons used in Splunk’s search language?
=, !=, ,>=
=, != are used in alphanumeric searches
Page 14 Mod 1
This command returns a table containing only specified fields in result set.
table command
Page 15 Mod 1
This command renames a field in results.
rename command
Page 15 Mod 1
This command includes or excludes specified fields.
fields command
Page 15 Mod 1
This command removes duplicates from results
dedup command
Page 15 Mod 1
This command sorts results by specified field.
sort command
Page 15 Mod 1
This command adds field values from an external source (e.g., csv files)
lookup command
Page 15 Mod 1
What are some of the key/values that are case sensitive in Splunk?
Boolean operators (uppercase) Field names Field values from lookup (default, but configurable) Regular expressions eval and where commands Tags
Page 16 Mod 1
What are some of the key/values that are case insensitive in Splunk?
Command names Command clauses Search terms Statistical functions Field values
Page 17 Mod 1
As events come in, where does Splunk place them?
Into an index’s hot bucket (only writable bucket)
Page 18 Mod 1
What is the transition that takes place as the buckets age in Splunk?
They roll from hot to warm to cold
Page 18 Mod 1
What does each bucket have?
Its own raw data, metadata, and index files
Page 18 Mod 1
What does the metadata keep track of?
Source, sourcetype and host
Page 18 Mod 1
When you search, Splunk uses what to choose which buckets to search?
Time Range
Page 19 Mod 1
Splunk uses the bucket indexes to find what?
Qualifying events
Page 19 Mod 1
After time what are the most powerful keywords?
Host, source, and sourcetype
Page 20 Mod 1
What makes searches more efficient?
Including as many search terms as possible
Page 20 Mod 1
What are some of the things a transforming command can do in Splunk?
- Massage raw data into a data table
- ‘Transforms’ specified cell values for each event into numerical values that you can use for statistical purposes
- Is required to ‘transform’ search results into visualizations
Commands Include
- top
- rare
- chart
- timechart
- stats
- geostats
Page 23 Mod 1
What are the transforming commands in Splunk?
- top
- rare
- stats
- chart
- timechart
- geostats
Page 23 Mod 1
