Splunk Search Commands and Interesting Fields

Counting events with a vendor_action field requires the syntax: stats count (vendor_action)

The "interesting Fields" section in the Search & Reporting app lists host, source, and sourcetype by default.

The index field is not listed by default but can be manually added.

For a dashboard panel based on a report, the search string cannot be modified, but the visualization can be changed and configured.

When writing a search string, including all formatting commands before any search terms is a best practice.

Only searches that generate statistics or visualizations can be saved as a report.

The All Fields option in the sidebar can include non-interesting fields.

Key/value pairs in search strings are linked using the "=" syntax, like action=purchase

An Interesting Field is one that appears in at least 20% of the events when viewing search results.

Relational operators (=, <, >) link key/value pairs in search strings.

When Splunk search generates calculated data in the Statistics tab, the results can be exported in Raw Events, CSV, XML, and JSON formats.

Functions of the stats command include sum, avg, values.

In deployments with multiple indexes, events from every index searched by default to which the user has access will be returned when a search is run without a specified index.

To match events containing "error" and "fail" in the security index, use: index=security Error Fail

After clicking an item in the search results, saving the item to a report is an available option.

dedup is effective at reducing search execution time when placed early in a search.

The list of alerts can be filtered by App, Time Window, Type, and Severity.

Line charts are optimal for multiple series with 3 or more columns when displaying search results.

A collection of items containing data inputs, UI elements, and knowledge objects is referred to as an app.

The source field is stored with the events in the index.

Saving a search as a report and using it in multiple dashboards is the recommended way to create multiple dashboards displaying data from the same search.

To use a lookup table in Splunk, the lookup file must be uploaded, and a lookup definition must be created.

A suggested best practice for naming reports is to use a consistent naming convention, easily separated by characteristics such as group and object.

The Forwarder component typically resides on machines where data originates.

The specified time range earliest=-72h@h latest=@d looks back from 3 days ago up to the beginning of today.

Full names can only be changed by accounts with a Power User or Admin role.

limit, showpercent are common constraints of the top command.

The purpose of using a by clause with the stats command is to group the results by one or more fields.

The search string host=www3 status=503 returns events with host=www3 that also have a status=503.

(index=netfw failure) OR (index=netops (warn OR critical)) would return events with failure in index netfw or warn or critical in index netops.

The correct placement of the pipe in the search string is: index=security sourcetype=access_* status=200 | stats count by price

The stats command calculates statistics from data that matches the search criteria.

The timeline located under the search bar shows peaks and/or valleys, indicating spikes in activity or downtime.

Splunk alerts are based on searches that run on a scheduled interval or in real-time.

Changing Job Lifetime from 10 minutes to 7 days can be configured using the Edit Job Settings menu.

| inputlookup products.csv validates a lookup file.

The dc(field) stats command function provides a count of how many unique values exist for a specified field.

The time range picker user interface component allows for time selection.

When an alert action is configured to run a script, Splunk will look look in $SPLUNK_HOME/bin/scripts.

When editing a dashboard, dragging a dashboard panel to a different location on the dashboard is a possible option.

index=web OR index=sales provides a more efficient search performance.

Splunk stores the timestamp value in the _time field at index time.

The top command returns the top 10 results, displays the output in table format, and returns the count and percent columns per row.

The scope of data in a scheduled report is determined by the owner's ability to configure permissions, so it uses either the User role or the owner's profile at run time.

The main requirement for creating visualizations using the Splunk UI is that your search must transform event data into statistical data tables first.

The owner of the report can edit permissions from the Edit dropdown so another user can gain access to a saved report.

The primary use for the rare command is to find the least common values of a field in a dataset.

When a field is added to the Selected Fields list in the fields sidebar, the selected field and its corresponding values will appear underneath the events in the search results.

By default, sourcetype is a Selected Field.

According to Splunk best practices, placing the wildcard as fail* results in the most efficient search.

The top command automatically returns percent and count columns when executing searches.

Lookup files add more fields to results returned by a search.

Modifiers in the search string are displayed in blue when running searches.

Fields are added or removed from search results using fields +to add and fields -to remove.

The steps to schedule a report: After saving the report, click Schedule.

By default, Splunk retains a search job for 10 Minutes.

The implied Boolean operator between search terms, unless otherwise specified, is AND.

One primary function of a scheduled report is triggering an alert in a Splunk instance when certain conditions are met.

When sorting on multiple fields with the sort command, a comma (,) can delimit the field names in the search.

index=security "failed password" is the most efficient search string.

The stdev function of the stats command returns the sample standard deviation of a field.

sourcetype=access_* | stats max(bytes) shows the maximum bytes.

This search will return 20 results. SEARCH: error | top host limit = 20, this statement is True.

Sourcetype=access_* |stats sum(categoryID) by host will show the number of categoryId used by each host.

The BY clause is used to group the output of a stats command.

The Median(X) function of the stats command allows you to return the middle-most value of field X.

When a search returns statistical values, you can view the results as a list.

Clicking a SEGMENT on a chart, adds the highlighted value to the search criteria.

Use the lookup command to use lookup fields in a search and see the lookup fields in the field sidebar.

Lookups can be private for a user.

In automatic lookup definitions, the output fields are those that are not in the event data.

The correct order of steps of creating a new lookup are: 2. Create the lookup table, 3. Define the lookup, 1. Configure the lookup to run automatically.

The command shown here does which of the following: Command: |outputlookup products.csv, writes search results to a file named products.csv.

Lookup that is not true, lookups have maximum of 10mg size limit.

Lookups allow you to overwrite event raw.

The lookup file must have input filed for an automatic lookup to be done.

By default, all users have DELETE permission to ALL knowledge objects, false.

These users can create global knowledge objects (Select that apply. administrator, power users.

All users by default have WRITE permission to ALL knowledge objects, false

Object ATTRIBUTES do not define base search for object in creating Data Models.

Attributes are associated with data set in creating Data Models.

Indexers are responsible for reducing search results in splunk components.

Indexers - parsing and storing data on disc in splunk components.

categorizing indexed data with sourcetype.

It is false for a single instance of Splunk to manage the input, parsing and indexing of machine data..

By default search results are not returned alphabetical order.

stats command returns by Table

?= is not an comparison operator

host=WWW*, which search string only returns events from hostWWW3

the lookup definition must be created, what must be done before an automatic lookup can be created

(Select all that apply)

Booleans has to be upper case

Constraints can be used with the top command is limit

Group_Object_Description the Splunk recommended naming convention for dashboards.

By scheduling a report. how can search results be kept longer than 7 days?

filter as early as possible. a Splunk search best practice

backwards. Display after search

Filter: Click and drag

lookup command is used must be done before an automatic lookup can be created?

Contents review command used = inputLookup

30 sec - realtime -Earlist configuration will return real time events.

making the dashboard more efficient from reports benefit

Which statement about case sensitivity is true?; Field names are case sensitive; field values are not

(Rare ) Returns the least common occurrences

AND operation implied between two terms?

values function of stats command does what? Answers all values of given event

click all fields

#= char is alphanumeric

AND/OR logic correct is: error AND (fail OR 400)

timeline most efficient

determine fields = auto keys are discovered

file = json

count as is corect answer

combined sourcetype uses mixed case

statistics drill down has the events

Numeric.is # =.

minimum results that are common is primary for rare

Transforms data indexer

splunk dot com = documentation true

core is indexer

heavy forwarder correct one

scalable

all components

can be installed

HE can be log

security

what log does splunk take: All

portal is false

reverse chronological

wild card is *

what result with the correct test = the q pedia

mighttrue. true

data is both true

is case matters = true

contains underscroll information =true

3

user behaviour

fields are true

searches are true

false are not

Default webport use in Splunk. Answer:B. 8000

which the app or reporting app? Answer: A,B,C

HF or indexer =yes answer is C

data provides =both D answer

forward means =true

Means can you on-board data Splunk. Answer: B C,E,G

data sources - phase input? Answer: D.

Index E input. Select the correct in next time processing Answer:A,C,E.

determines auto data=correct

heavy and you have to parse, true.

time process how = 3 in process.

Option select GUI. TCP script. And files.

Index the one. upload yes or no/answer=A

Index .

search A yes or no

begin what? No not false: B

Zooms in search. B

job = job is the every search

Feature yes = B

enable=true.

Time = real time

options are start . correct e=f f

default can or not:

Data and time.

segregated = y.

Setting yes.

true data is.

click timeline =

is A correct.

correct.

correct

result: yes

are true.

specified y.

8