Splunk Power User

Front 1

"case(X,"Y",…)"

Back 1

Takes pairs of arguments X and Y, where X arguments are Boolean expressions. When evaluated to TRUE, the arguments return the corresponding Y argument.

You can stack these in series to have multiple x and y comparisons in one - ex. (x, y, x, z, ....)

Front 2

… | lookup usertogroup user output group

Back 2

For each event, use the lookup table usertogroup to locate the matching “user” value from the event. Output the group field value to the event

Front 3

3 Key Splunk Functional Components

Back 3

Search Head (SH) - Indexer - Data Inputs

Front 4

3 main methods to create viusalizations

Back 4

1. Select field from fileds sidebar 2. Use Pivot interface 3. use SPL in search bar with Statistica and Visualizations tabs

Front 5

4 Primary Indexes

Back 5

Main - _audit - _internal - _thefishbucket

Front 6

A knowledge object that enables you to search for events that contain particular field values

Back 6

Tag

Front 7

Addcoltotals

Back 7

| addcoltotals adds row/column totals - Example |addtotals labelfield=product_name col=true

Front 8

Add-on

Back 8

data feed - modular inputs - scripts or other mechanism for data colleciton - does not include UI

Front 9

Alias

Back 9

Alternate name you assign to FIELD. You can use field aliasing to normalize field names

Front 10

App

Back 10

Sets of Dashboards - views - searches used to support a particular buiness need or to solve a particular use case or type of problem

Front 11

Benefits of Index Clustering

Back 11

Data Availability - Data Fidelity - Data Recovery

Front 12

Best way to improve search performance

Back 12

Limit Time

Front 13

Bloom Filter

Back 13

Splunk Enterprise uses bloom filters to decrease the time it requires to retrieve events from the index

Front 14

Boolean Operators are case sensitive

Back 14

TRUE

Front 15

Calculated Fields

Back 15

Calculated field operations are in the middle of the search-time operation sequence so they cannot reference lookups, event types or tags.

Front 16

Can be a text document, a configuration file, an entire stack trace, and so on.

Back 16

Event

Front 17

Can represent a multi-step business-related activity, such as all events related to a single customer session on a retail website.

Back 17

Transaction

Front 18

Can you apply aliases to field lookups?

Back 18

Yes

Front 19

Clauses used with Top Command

Back 19

limit - countfield - percentfield - showcount -showperc - useother - otherStr

Front 20

Coalesce function

Back 20

If you do not want the calculated field to override existing fields when the eval statement returns null

Front 21

Command adds fields based on looking at the value in an event, referencing a lookup table, and adding the fields in matching rows in the lookup table to your event.

Back 21

lookup

Front 22

Command calculates aggregate statistics over a dataset, similar to SQL aggregation.

Back 22

stats

Front 23

Command calculates the value of a new field based on other fields, whether numerically, by concatenation, or through Boolean logic

Back 23

eval command

Front 24

Command can be used to create new fields by using regular expressions to extracting patterned data in other fields.

Back 24

rex

Front 25

Command creates tabular data output suitable for charting

Back 25

chart command

Front 26

Comparison Operators

Back 26

=

=!

<

>

Front 27

Config to receive content from Deployment Server

Back 27

deploymentclient.conf

Front 28

Configuration Files

Back 28

System Settings - Authentication - Index Mapping - Deployment & Cluster Configs - Knowledge Object and save searches

Front 29

Configure inputs - forwarders - file monitoring

Back 29

inputs.conf

Front 30

Configure regex-based host & source overrides

Back 30

transforms.conf

Front 31

Create Report 2 ways

Back 31

Search and Pivot

Front 32

Data Classification

Back 32

Alerts - events types - transactions

Front 33

Data Enrichment

Back 33

Lookups - Reports - Transforms - Views - Workflows - Data Normalization - Data Models

Front 34

Data Enrichment

Back 34

Lookups and workflow actions

Front 35

Data Inputs

Back 35

Files and Directories - Network Events - Windows Sources - Scripted Inputs - Modular Inputs

Front 36

Data Interpretation

Back 36

fields - fields extractions - macros - search commands

Front 37

Data Interpretation

Back 37

Fields and Field Extraction

Front 38

Data Layer

Back 38

C/C++ Server - accesses and processes and indexes streaming data and handles searches

Front 39

Data Models

Back 39

Make use of lookups - transactions - search time field extractions

Front 40

Data Models

Back 40

Encode domain knowledge needed for specialized searches

Front 41

Data Models

Back 41

Representation of datasets wich drive the pivot tool

Front 42

Data Models

Back 42

A data model is a hierarchically structured search-time mapping of semantic knowledge about one or more datasets. Data models drive the Pivot tool. They enable users of Pivot to create compelling reports and dashboards without designing the searches that generate them.

Front 43

Data Models

Back 43

Representative of 1 or more Datasets

Front 44

Dataset

Back 44

a collection of data that you define and maintain for a specific business purpose. It is represented as a table, with fields for columns and field values for cells.

Front 45

Dataset constraints

Back 45

filter out events that aren't relevant to the dataset.

Front 46

Default Search Mode

Back 46

Smart

Front 47

Default Selected Search Fields

Back 47

Host - Source - SourceType

Front 48

Determines how a forwarder sends data to receiving Splunk instance

Back 48

outputs.conf

Front 49

Distributed Search

Back 49

Horizontal scaling by distributing the indexing and searching load across multiple indexers - makes possible searching large volumes

Front 50

Django Bindings

Back 50

Provides DJango tags to create Splunk Views and Search Managers

Front 51

endswith

Back 51

Form transaction that ends with specific terms or field values or events

Front 52

erex

Back 52

Builds regex for you

Front 53

Eval

Back 53

The eval command calculates an expression and puts the resulting value into a destination field. If this destination field matches a field name that already exists, it overwrites the existing field value with the results of the eval expression. The eval command evaluates mathematical, string, and boolean expressions.

Front 54

Eval Command

Back 54

Arithmetic - Concatenation - Boolean Example stats sume(sc_bytes) as Bytes by usage |eval bandwidth=Bytes/1024/1024 This creates a new field named "bandwidth"

Front 55

Eval Command IF Function

Back 55

Takes 3 arguments - if(x y z)

x = Boolean

y = is the if value and must be in quotes if not a number

z = else value

Front 56

Event

Back 56

Single Record within the data

Front 57

Event types

Back 57

Data Classificaiton

Front 58

Event types can have tags

Back 58

TRUE

Front 59

Events Types

Back 59

Group together sets of events discovered through searches

Front 60

Example Search Clause

Back 60

as

Front 61

Example Search Command

Back 61

stats

Front 62

Example Search Function

Back 62

Sum()

Front 63

Example Search Term

Back 63

sourcetype=acc* status=503

Front 64

Exlcude Fields in Search by

Back 64

using "fields" followed by field names or "-fieldname"

By listing field names, you are excluding all other fields.

By using -fieldname you are excluding only those "-" listed fields.

Front 65

Extracted Fields

Back 65

Good for rarely used fields

Front 66

Facilitate event categorization using the full power of the search command, meaning you can use Boolean expressions, wildcards, field values, phrases, and so on.

Back 66

event types

Front 67

Field Extraction

Back 67

Allow you to include/exclude specific fields

Front 68

Fields are case sensitive

Back 68

TRUE

Front 69

Fields Format Command

Back 69

Formats values without changing the underlying value characteristics - same function as eval

Front 70

fillnul Command

Back 70

replace null values with zero or specified value - for example "|fillnull values="nothing to see here" would replace null value with "nothing to see here"

Front 71

Filtering command returns the first count results. permits a search to stop retrieving events from disk when it finds the desired number of results.

Back 71

head

Front 72

Groups events that meet various constraints into transactions—collections of events, possibly from multiple sources.

Back 72

Transaction

Front 73

head/tail

Back 73

Returns the first/last N results

Front 74

Heat map

Back 74

Highlights outstanding values

Front 75

High and low values

Back 75

Highlights max and min of non zero values

Front 76

Host

Back 76

Hostname or IP address from where the data originates

Front 77

How are Interesting Values identified?

Back 77

Value is in at least 20% of the searched events

Front 78

How do you interface with Splunk?

Back 78

REST API

Front 79

How do you monitor Windows Performance?

Back 79

Forwarder or WMI

Front 80

How many reports are available for character feilds?

Back 80

3 - 1. Top Values 2. Top Values by Time 3. Rare Values

Front 81

How to get data into Splunk

Back 81

1. Splunk Settings 2. Apps 3. CLI 4. Editing Config Files

Front 82

HTML and JavaScript

Back 82

Convert Simple XML to HTML and JavaScript that accesses the SplunkJS Stack - Provides full layout control

Front 83

inputlookup in search

Back 83

|inputlookup http_status.csv

Front 84

Is an argument to a command that runs its own search, returning those results to the parent command as the argument value.

Back 84

subsearch

Front 85

Keyword arguments to the search command are case-sensitive

Back 85

FALSE

Front 86

Let you quickly visualize a data pattern without creating a separate line chart.

Back 86

sparkline

Front 87

Makes your data more understandable and less ambiguous

Back 87

Tags

Front 88

Manipulate field values at search time using

Back 88

Eval Commands

Front 89

maxpause

Back 89

max total time between events

Front 90

maxspan

Back 90

max total time between earlist and latest events

Front 91

MultiKV

Back 91

Used to extract fields from table formated events

Front 92

Normalization

Back 92

Assign tags to field values . Alias - assign to exisiting field name

Front 93

Phase 1

Back 93

Collect and Index

Front 94

Phase 2

Back 94

Search and Investigate

Front 95

Phase 3

Back 95

Add Knowledge

Front 96

Phase 4

Back 96

Monitor and Alert

Front 97

Phase 5

Back 97

Report and Analyze

Front 98

Pivot Table requires a data model first

Back 98

True - You need a data model first or Instant Pivot will create one for you.

Front 99

Power User Role

Back 99

Create KOs and Share Data

Front 100

Provides a way to scale your deployment by separating the search management and presentation layer from the indexing and search retrieval layer

Back 100

Distributed Search

Front 101

Rare Search Term

Back 101

Same as Top

Front 102

Refers to the table, chart, or other visualization you create

Back 102

Pivot

Front 103

Regex

Back 103

Python or Perl Style Expression

Front 104

Rename Command

Back 104

Rename Arguement Field Name. Example -Rename IP as HostName

Front 105

Report

Back 105

Views - Provide access to and displays data using search boxes fields and charts

Front 106

Report Definition

Back 106

At minimum, a report definition includes the search string and the time range associated with the search (expressed in terms of relative time modifiers).

Front 107

REST API

Back 107

Used to Configure and Manage Splunk Instance - Create and Run Searches - Create Applications

Front 108

REST API

Back 108

Address endpoint such as Apps - Users - Searches - Jobs - Indexes - Inputs - more

Front 109

Returns a table of results where each row represents a single unique combination of the values of the group-by fields"

Back 109

stats

Front 110

rex

Back 110

Regex - Regular Expression built by user

Front 111

Runs its own search and returns the results to the parent command as the argument value

Back 111

Subsearch

Front 112

Search Best Practice

Back 112

Be as specific as possible

Front 113

Search Best Practice

Back 113

Exclusion is better than inclusion

Front 114

Search Best Practice

Back 114

Filter Early

Front 115

Search Best Practices

Back 115

Filter out results as soon as possible before calculations. Use field-value pairs, before the first pipe. Filter out unnecessary fields as soon as possible in the search. Postpone commands that process over the entire result set (non streaming commands) as late as possible in your search. Some of these commands are: dedup, sort, and stats.Use post processing searches in dashboards. Use summary indexing, and report and data model acceleration features.

Front 116

Search Boolean Operators

Back 116

NOT - OR - AND

Front 117

Search Events Listing is in what order?

Back 117

Reverse Chronological (newest first)

Front 118

Search Events Result time is based o what?

Back 118

User Time Zone

Front 119

Search Mode - Fast

Back 119

Speeds up searches by limiting the types of data returned by the search.

Front 120

Search Mode - Smart

Back 120

The default setting, toggles search behavior based on whether your search contains transforming commands. For transforming searches, it behaves like Fast mode. For searches without transforming commands, it behaves like Verbose mode.

Front 121

Search Mode - Verbose

Back 121

Returns as much event information as possible, at the expense of slower search performance.

Front 122

Search Modes

Back 122

1. Fast 2. Smart 3. Verbose

Front 123

Search Terms are Case Sensitive

Back 123

FALSE

Front 124

Server Layer

Back 124

Python & DJango - Use Splunk SDK for Python to directly write code

Front 125

Shows details about your search, such as the execution costs of your search, debug messages, and search job properties.

Back 125

Job Inspector

Front 126

Simple XML

Back 126

Default Dashboards - Chart Customization - Dynaminc Drilldowns - Access to custom CSS and JavaScript files - Custom behaviors & visualizations using SplunkJS stack libraries

Front 127

SImple XML Extensions

Back 127

Customize the layout of dashboards - new visualizations - dashbaord behaviors

Front 128

Source

Back 128

Name of file - stream or data input

Front 129

Sourcetype

Back 129

Type of data

Front 130

Sourcetype is not required

Back 130

FALSE - sourcetype must be defined

Front 131

SPL Filtering Results

Back 131

search, where, dedup, head, tail

Front 132

SPL Filtering, Modifying, and Adding Fields

Back 132

fields, replace, eval, rex, lookup

Front 133

SPL Grouping Results

Back 133

Transaction

Front 134

SPL Reporting Results

Back 134

top/rare,estats, chart, timechart

Front 135

SPL Search Components

Back 135

Search Terms+Commands+Functions+Arguments+Clauses

Front 136

SPL Sorting Results

Back 136

sort

Front 137

Splunk Index

Back 137

raw data + Index Files

Front 138

Splunk Web Architecture

Back 138

Client Layer - Server Layer - Data Layer

Front 139

startswith

Back 139

Form transaction that start with specific terms or field values or events

Front 140

Static Functions are case sensitive

Back 140

FALSE

Front 141

Stats Command

Back 141

Count - DistinctCount - Sum - avg - list - Values

Front 142

Stats Count Command

Back 142

| stats count(action) as ActionEvents for example - stats count as "Total Sales by vendors" by product_name

Front 143

Stats List

Back 143

|stats list(Asset) as "Company Assets" by Employee - Returns a row for each employee and a list of their assets

Front 144

Stats Sparkline

Back 144

|stats sparkline(count, 24h) as "Page Hits" by uri

Front 145

Stats Sum

Back 145

|stats sum(price) as "Gross Sales" by product_name

Front 146

Steps to create lookup

Back 146

Add lookup file then add lookup definition - Add Automatic Lookup to make searching easier

Front 147

Stores saved searches

Back 147

savedsearches.conf

Front 148

Summary indexing

Back 148

A method of search acceleration. The results from a summary-indexing optimized search are stored in a special format that cannot be modified before the final transformation is performed.

Front 149

Table Command

Back 149

Builds table made up from fields used in argument list

Front 150

Tag

Back 150

Enable you to assign names to specific field and value combinations

Front 151

The subsearch is run first

Back 151

TRUE

Front 152

This command removes subsequent results that match specified criteria

Back 152

dedup

Front 153

TImestamp

Back 153

date/time of the event

Front 154

TImestamp recognition - event segmentation - host & source mathcing

Back 154

props.conf

Front 155

Top Command

Back 155

Returns count or percent

Front 156

tostring function

Back 156

Converts numerical values to string. For example - |eval totoal_list_price = "$" + tostring(to_list_price)

Front 157

transaction

Back 157

Groups search results into transactions

Front 158

Transaction Command

Back 158

Allows you to correlate related events on a field or list of fields that span time

Front 159

Transaction vs Stats

Back 159

Transactions correlates events or when events need to be grouped on start and end values (think "time") while Stats used when you want to see the results of a calculation and group events on field value

Front 160

Transactions

Back 160

are collections of conceptually-related events that span time

Front 161

Transforming Commands

Back 161

Create Statics and Visualizations

(think "transforming data into something visual")

Front 162

Two interfaces to manage data

Back 162

1. Home App 2. Splunk Settings

Front 163

Two primary ways that Splunk helps with categorizing data

Back 163

tagging and event types

Front 164

Two ways to gather Windows Inputs

Back 164

WMI or Forwarder

Front 165

Use CIM to ensure

Back 165

Common Information Model - Multiple Apps can co-exist on a single Splunk Deployment. Object Permissions can be set to global for use of mutliple apps. Easier and more effecient correlation of data from different sources and source types

Front 166

Used to send content to indexeers to sync SH

Back 166

Deployment Server

Front 167

Uses POST - GET - DELETE over HTTPS

Back 167

REST API

Front 168

Verify lookup using what

Back 168

inputlookup - "| inputlookup yourlookupname"

Front 169

What 2 fields do Transaction Commands creates

Back 169

duration and event count

Front 170

What are 3 permissions

Back 170

Private - Shared in App - Global

Front 171

What are table headers?

Back 171

Field Names

Front 172

What are table results

Back 172

Values

Front 173

What does each row in a table represent?

Back 173

An event

Front 174

What does the "#" represent next to the field?

Back 174

Number Value

Front 175

What does the "a" represent next to the field?

Back 175

String Value

Front 176

What is a lookup

Back 176

Static CSV or Python Script

Front 177

What is always extracted unless removed?

Back 177

_raw and _time

Front 178

What search mode is "TOP" command executed in?

Back 178

SMART Search Mode

Front 179

What search panel shows which files (or other sources) your data came from?

Back 179

Sources

Front 180

When are aliases applied

Back 180

After field extraction but before lookups

(makes sense, you cannot assign an alias unless it has been extracted and why do you want to alias? to normalize your data to use later... ie lookups)

Front 181

When are Fields extracted from the raw text for the event?

Back 181

Search Time

Front 182

When using the "TOP" command, where are results displayed?

Back 182

Stats Tab

Front 183

When you have a choice between Stats and Transactions, you should use which one?

Back 183

Stats because stats is faster and more effecient

Front 184

Who can create Data Models?

Back 184

Admin and Power User Roles

Front 185

Workflow Action

Back 185

Interaction between fields and other apps or web

Front 186

Workflow Action

Back 186

Enable interactions between fields in your data and other applications or web resources

Front 187

You can create your own sourcetype

Back 187

TRUE - Automatic - Manual - or From a list

Front 188

You cannot base an event type on a search that

Back 188

Includes a pipe operator after a simple search. Includes a subsearch. Is defined by a simple search that uses the savedsearch command to reference a report name.

Front 189

Fields and field extractions

Back 189

Data interpretation

(You are making sense of the data index by identifying your data)

Front 190

Event types

Back 190

Data Classification

(You are making sense of events by giving them a name)

Front 191

Lookups and workflow actions

Back 191

Data Enrichment

(You are adding value to existing data)

Front 192

Tags and aliases

Back 192

Normalization

(You are standardizing your data for use)

Front 193

CIM object permissiona can be used in multiple apps TRUE/FALSE

Back 193

TRUE

Front 194

Naming Conventions

Back 194

FORMAT of the name: Group - Search Type - Platform - Category - Time Interval - Description

Front 195

Lookup fields retrieved from the lookup file are the ____ fields.

Back 195

Output

Front 196

The lookup field from the event is the ____ field.

Back 196

Input

Front 197

What command is used to load lookup results?

Back 197

inputlookup

Front 198

What lookup command do you use when you do not want to overwrite existing fields?

Back 198

OUTPUTNEW

Front 199

The output lookup fields persist for all searches TRUE/FALSE

Back 199

FALSE - They persist for the current search only

Front 200

You can edit automatic lookups TRUE/FALSE

Back 200

FALSE - You can only Edit Permissions, Clone, Delete or Move

Front 201

When creating a field alias, what is the first "field aliases" value?

Back 201

The value of the existing field

Front 202

A new alias replaces the original field in the "interesting fields" side bar TRUE/FALSE

Back 202

False - Both appear

Front 203

You can edit Field Aliases TRUE/FALSE

Back 203

FALSE - You can only Edit Permissions, Clone, Delete or Move

Front 204

How do you use a Calculated Field?

Back 204

Using the eval command

Front 205

You can use calculated fields on output fields from lookup tables TRUE/FALSE

Back 205

FALSE - They can only be used on extracted fields

Front 206

You cannot edit Calculated Fields TRUE/FALSE

Back 206

TRUE - You can only Edit Permissions, Clone, Delete or Move

Front 207

What is used to manage extracted fields?

Back 207

Field Extraction Manager

Front 208

Two field extractor (FX) methods

Back 208

Regex and Delimeter

Front 209

3 Options to extract fields

Back 209

1 Settings 2 Fields Sidebar 3 Event Actions

Front 210

You cannot edit Tags TRUE/FALSE

Back 210

FALSE - You can edit tags and even change the tag name

Front 211

Data Models consists of what 3 types of objects?

Back 211

Events, searches, transactions. This can be seen on the left panel when creating data models.

Front 212

What are the Data Model Events Constraints?

Back 212

Constraints are the search broken down into a hierarchy. You are building a hierarchy where each constraint inherits the parent search string.

Front 213

What are the 3 Data Model Events

Back 213

1. Event objects that contain constraints and attributes 2. Constraints are the search broken down into a hierarchy 3 Attributes are the fields and properties associated with the events

Front 214

Data Model Event Object Attributes are inherited from parent objects TRUE/FALSE

Back 214

TRUE

Front 215

What are Data Model Event Object Attributes?

Back 215

The fields you want to include in the object

Front 216

What are Data Model Search Objects?

Back 216

Searches that include transforming commands to define the dataset they represent

Front 217

Can Data Model Search Objects have attributes?

Back 217

Yes

Front 218

What are the Data Model Transaction Objects?

Back 218

Enable the creation of objects that represent transactions and use fields that have already been added to the model using search or event objects

Front 219

What must you have when creating data models before you can start adding transaction objects?

Back 219

At least one event or search

(hard to have transactions without events)

Front 220

How can you use Data Model Attributes in a Pivot?

Back 220

Splits for rows and columns or to filter events

(what are attributes? fields)

Front 221

What Data Models cannot be accelerated?

Back 221

Private Data Models

Front 222

What Data Models cannot be edited

Back 222

Accelerated Data Models

Front 223

What are the 2 kinds of Splunk Searches?

Back 223

RAW Event Searches and Transforming Searches

Front 224

What are Transforming Searches

Back 224

Transforming searches are searches that perform some type of statisticalcalculation against a set of results

Front 225

When you use the timechart command, what do the X and Y axis represent?

Back 225

X always = time

Y = other values

Front 226

Withthe chart command, what keyword do you use to determine what field takes the x-axis?

Back 226

over keyword

Example: sourcetype=access_* | chart avg(clientip) over date_wday.

date_wday is the x-axis

Front 227

What search command can you use to split your results?

Back 227

Use the "by" command. When you see the "by" command, think split by.

Example: sourcetype=access_* | chart count over ssl_type by host.

Where ssl_type is the x axis of a stacked bar chart split by host.