Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Splunk > Splunk_1 > Flashcards

Splunk_1 Flashcards

1
Q

What is Machine Data ?

A

Digital information created by the activity of computers, mobile phones, embedded systems and other networked devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What Splunk Do ?

A

Searching, monitoring, and examining machine-generated Big Data through a web-style interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the main components of Splunk?

A

Forwarder
Indexer
Search Head

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are forwarder ?

A

An agent you deploy on IT systems, which collects logs and sends them to the indexer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Splunk ?

A

A distributed system that aggregates, parses and analyses log data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the two types of forwarder ?

A
  • Universal Forwarder

- Heavy Forwarder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Universal forwarder for ?

A

It forwards the raw data without any prior treatment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Heavy Forwarder for ?

A

Parsing and indexing at the source, on the host machine and sends only the parsed events to the indexer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is indexer for ?

A

Transforms data into events (unless it was received pre-processed from a heavy forwarder), stores it to disk and adds it to an index, enabling searchability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is SearchHead for ?

A

Search and query Splunk data, and interfaces with indexers to gain access to the specific data they request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the three processing tiers for a splunk deployment ?

A
  • Data input
  • Indexing
  • Search management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the correspondence between the three typical processing tiers and the four data pipeline segments ?

A
  • The data input tier handles the input segment.
  • The indexing tier handles the parsing and indexing segments.
  • The search management tier handles the search segment.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 5 main function of Splunk Enterprise ?

A
  • Index Data
  • Search & investigate
  • Add knowledge
  • Monitor & alert
  • Report & analyse
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the different product categories of Splunk ?

A

Splunk Enterprise − It is used by companies which have large IT infrastructure and IT driven business.

Splunk Cloud − It is the cloud hosted platform with same features as the enterprise version. It can be availed from Splunk itself or through the AWS cloud platform.

Splunk Light − It allows search, report and alert on all the log data in real time from one place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is splunk role ?

A

Determine what a user is able to see, do or interact with.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the 3 main roles in Splunk Enterprise ?

A
  • Administrator role
  • Power role
  • User role
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Who can add data to Splunk ?

A

The administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 3 option to ingest data to Splunk ?

A
  • Upload file from the computer (local files)
  • Monitor files and ports on the splunk platform instance
  • Forward data form a splunk forwarder
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is an event ?

A

A set of values associated with a

timestamp. It is a single entry of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is SourceType ?

A

A default field that identifies the data structure of an event. A source type determines how formats the data during the indexing process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the Host Value ?

A

The name of the machine from which the event originates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is index ?

A

The directory where the data will be stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is knowledge object ?

A

A user-defined entity that enriches the existing data. You can use knowledge objects to get specific information about your data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the five components of splunk language ?

A
  • Search terms
  • Commands
  • Functions
  • Arguments
  • Clauses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Are Field values case sensitive ?
No
26
Are Field Name case sensitive ?
Yes
27
What is the most efficient way to filter events ?
Using Time
28
Can Splunk allow searches in real time ?
Yes
29
The colors in SPL
Orange for boolean Blue for commands Green for command arguments Purple for functions
30
Which command removes results with duplicate field values?
Dedup
31
Can Charts be based on numbers, time, or location ?
Yes
32
Can the User role create report ?
Yes
33
What Splunk uses to categorize the type of data being indexed ?
Sourcetype
34
Are events always returned in chronological order ?
No
35
What separate indexes allows ?
Multiple retention policies Faster Searches. Ability to limit access.
36
What is a lookup ?
Add custom fields to event from external sources like csv.file
37
Which command returns a table containing only specified fields in result set ?
Table command
38
Which command renames a field in results ?
Rename command
39
Which command includes or excludes specified fields. ?
Fields command
40
Which command sorts results by specified field ?
Sort command
41
Which command adds field values from an external source (e.g., csv files) ?
Lookup command
42
What is the transition that takes place as the buckets age in Splunk?
They roll from hot to warm to cold
43
What does each bucket have?
Its own raw data, metadata, and index files
44
What are Booleans in the Splunk Search Language ?
NOT OR AND
45
How warm Buckets in Splunk indexes are named by ?
The timestamps of first and last event in the bucket
46
What are the searches mode ?
Verbose Fast Smart
47
Which of the search modes automatically returns all extracted fields in the fields sidebar?
Verbose
48
Which type of visualization allows you to show a third dimension of data?
Bubble Chart
49
Which option is NOT available with the chart and timechart commands?
Usefill
50
What the timechart command buckets data in time intervals depending on ?
The selected time range
51
Which clause allows you to define which field is represented on the X axis of a chart ?
Over
52
Can the iplocation and geostats commands be used together ?
Yes
53
Which options are valid with the chart command?
Useother | Usenull
54
What the Gauge command allow you ?
To set colored ranges for a single-value visualization.
55
Which command will compute the sum of numeric fields within events and place the result in a new field ?
Addtotals
56
What arguments the trendline command requires ?
Trend type, Time period Field
57
Does the search job inspector shows how long a given search took to run ?
Yes
58
Which are stats function ?
avg count sum
59
What search returns can be viewed as a chart ?
Statistics
60
Which axis should always be numeric ?
the Y axis
61
What is the gauge command for ?
Allows you to set colored ranges for a single-value visualization.
62
Which argument (in order) the eval command 'if' function requires ?
boolean expression, result if true, result if false
63
If you want to format values without changing their characteristics, which would you use?
The fieldformat command
64
What is the maxpause definition ?
Finds groups of events where the span of time between included events does not exceed a specific value
65
CAn you create a transaction based on multiple fields.
Yes
66
Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?
maxspan
67
What is the Splunk CIM ?
Common Information Model provides a methodology to normalize data
68
When should you used the CIM Schema ?
When creating Field Extractions, Aliases, Event Types, and Tags.
69
Which datasets can be added to a root dataset to narrow down the search ?
A child datasets
70
What are doing required fields in a data models ?
They constrains the dataset to only return events that include that field
71
Do the fields used in the data models already have to be extracted before creating the datasets?
No
72
Which workflow Action type sends field values to external resources ?
POST
73
What we need to use field value data from an event in a Workflow Action ?
Wrap the field in dollar signs.
74
Which Workflow Action type directs users to a specified URI ?
GET
75
Can Workflow action only be applied to a single field ?
No
76
What can do a workflow action ?
Direct users to a specified URI. Execute a secondary search. Send field values to external sources.
77
Can we add tags to Event Types ?
Yes
78
How categorize events based on search terms ?
By using event types
79
Can you pipe the results of a macro to other commands ?
Yes
80
What is the proper syntax for using a macro named "us_sales"
`us_sales`
81
What allows the search expansion tool ?
To see what a macro will expand to before you run a search.
82
Is the search macros must always include an argument ?
No
83
What are tags ?
The descriptive name for key value pairs
84
Do the event types show up in the fields list ?
Yes
85
What allows to categorize events based on search terms ?
Events Types
86
Why use field aliases ?
To normalise data
87
In the Field Extractor Utility, which button will display events that do not contain extracted field ?
Non-Matches
88
What method to extract can be used with the field extractor utility ?
Regex & Delimiter
89
Which users can create private Knowledge Objects?
Power User Admin
90
What the transaction command allows ?
To correlate events across multiple sources.
91
What is maxpause for ?
Finds groups of events where the span of time between included events does not exceed a specific value
92
Why use stats ?
To see results of a calculation, or group events on a field value
93
why use transaction ?
To see events correlated together, or grouped by start and end values.
94
By default, what does the fillnull command replace null values ​​with?
0
95
Which command is used to create choropleth maps?
geom
96
What return the iplocation command ?
It returns location information for events that include external IP addresses
97
Which roles can create Private Knowledge Objects?
User, Power, Admin
98
When using a .csv file for lookups, the first row in the file represents this.
Field names
99
Which is the correct order to use when creating a lookup?
Define a lookup table Define a lookup Create and automatic lookup
100
What are Field Aliases caracteristics ?
Can be referenced by lookup tables. Are applicable to a specified app context. Make correlation easier.
101
Can calculate fields use lookup tables ?
No
102
What is SVA ?
Splunk Validated Architectures (SVAs) are proven reference architectures for stable, efficient and repeatable Splunk deployments.
103
What are Authentication Methods available in Splunk?
- Native Splunk Accounts - LDAP - SAML - Scripted Authentication

Splunk (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions