Module 4

Question 1

name/value pairs

Answer 1

Ex: index=main, source=eventgen, sourcetype=evntgen

Question 2

Field extractions (index time extractions)

Answer 2

Metadata field: host, source, sourcertype, index
internal field: _time, _raw
Custom fields

Question 3

Search time extractions

Answer 3

Delimiter based
RegEx Based

Question 4

Field Discovery

Answer 4

Splunk automatically discovers fields using key value pairs
When Fast search mode is active, this disables field discovery

Question 5

Default selected fields

Answer 5

host, source, sourcetype

Question 6

What are interesting fields

Answer 6

Fields that appear in atleast 20% of events

Question 7

Where do you go when a field that isnt in atleast 20% of data

Answer 7

All fields above the selected fields

Question 8

Syntax

Answer 8

field_name=field_value
Use “” for fields with spaces ex: “Jean Claude”
Splunk can use CIDR notation

Question 9

Are Field names case sensitive?

Answer 9

Yes
action=addtocart (Yes)
ACTION=addtocart (no)

Question 10

Are Field values case sensitive?

Answer 10

No
action=addtocart (Yes)
action=ADDTOCART (Yes)

Question 11

Comparison Operators

Answer 11

=. !=, >, <, >=, <=