True

False

They must be lowercase.

They must be uppercase.

They must be in quotations.

They must be in parentheses.

index==main status!==200

index=main NOT status=200

index==main NOT status==200

index-main status!=200

index=* “failed password”

“failed password” index=*

(index=* OR index=security) “failed password”

index=security “failed password”

limit, count

limit, showpercent

limits, countfield

showperc, countfield

Once a search job begins, it cannot be stopped

A search job can only be paused when less than 50% of events are returned

A search job can only be stopped when less than 50% of events are returned

Once a search job begins, it can be stopped or paused at any point in time

host

index

source

sourcetype

True

False

index

action

_time

host

Open new search.

Exclude the item from search.

None of the above.

Add the item to search

index=a index=b

(index=a OR index=b)

index=(a & b)

index = a, b

A field that appears in any event

A field that appears in every event

A field that appears in the top 10 events

A field that appears in at least 20% of the events

Splunk only extracts the most interesting data from the last 24 hours.

Splunk only extracts fields users have manually specified in their data.

Splunk automatically extracts any fields that generate interesting visualizations.

Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

True

False

No

Yes

By scheduling a report.

By creating a link to the job.

By changing the job settings.

By changing the time range picker to more than 7 days.

Date & Time Range

Advanced

Date Range

Presets

Relative

To group the results by one or more fields.

To compute numerical statistics on each field.

To specify how the values in a list are delimited.

To partition the input data based on the split-by fields.

ASCII Character order.

Reverse chronological order.

Alphanumeric order.

Chronological order.

Search head, GPU, streamer

Search head, indexer, forwarder

Search head, SQL database, forwarder

Search head, SSD, heavy weight agent

New events based on the current time range picker

The same events based on the current time range picker

The same events from when the original search was executed

New events in addition to the same events from the original search

When Splunk encounters a syntax error in a search

When a trigger action meets the predefined conditions

When an event in a search matches up with a data model

When results of a search meet a specifically defined condition

No

Yes

False

True

index=security sourcetype=access_* status=200 stats | count by price

index=security sourcetype=access_* status=200 | stats count by price

index=security sourcetype=access_* status=200 | stats count | by price

index=security sourcetype=access_* | status=200 | stats count by price

False

True

dedup

rename

sort -

fields +

False

True

Correlated

File-based

Total

Segmented

Review Splunk reports

Run ./splunk show

Click Data Summary in Splunk Web

Search index=* sourcetype=* host=*

sourcetype=access_* | maximum totals by bytes

sourcetype=access_* | avg (bytes)

sourcetype=access_* | stats max(bytes)

sourcetype=access_* | max(bytes)

True

False

Yes

No

Table

Report

Pie chart

User

Alerting

Power

Admin

Forwarders

Indexer

Heavy Forwarders

Search head

search heads

indexers

forwarders

Dashboards

Searches

Webhooks

Reports

All events that either have a host of www3 or a status of 503.

All events with a host of www3 that also have a status of 503

We need more information: we cannot tell without knowing the time range

We need more information a search cannot be run without specifying an index

In chronological order.

Randomly by default.

In reverse chronological order.

Alphabetically according to field name.

stdev

dev

count deviation

by standarddev

After saving the report, click Schedule.

After saving the report, click Event Type.

After saving the report, click Scheduling.

After saving the report, click Dashboard Panel.

True

False

index

action

clientip

sourcetype

Search & Reporting is the only app that can be set as the default application.

Full names can only be changed by accounts with a Power User or Admin role.

Time zones are automatically updated based on the setting of the computer accessing Splunk.

Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar.

Red

Blue

Orange

Highlighted

True

False

No

Yes

Only HTTP Event Collector (HEC) and TCP/UDP

None of the above

Only TCP/UDP

Only Scripts

Filed & Directories, HTTP Event Collector (HEC), TCP/UDP and Scripts

Sourcetype=access_combined

Sourcetype=Access_Combined

sourcetype=Access_Combined

SOURCETYPE=access_combined

action+purchase

action=purchase

action | purchase

action equal purchase

2, 1, 3

1, 2, 3

2, 3, 1

3, 2, 1

False

True

True

False

Indexer

Parsing

Heavy Forwarder

Input

the_questionnaire _pedia

the_questionnaire pedia

the_questionnaire_pedia

the_questionnaire Pedia

Splunk automatically discovers only numeric fields

Splunk automatically discovers only alphanumeric fields

Splunk automatically discovers only manually configured fields

Splunk automatically discovers only fields directly related to the search results

Only data where the error field is present and does not contain a value will be displayed.

Only data with a value in the field error will be displayed.

Only data that does not contain the error field will be displayed.

Only data where the value of the field error does not equal an asterisk (*) will be displayed.

Can be accessed by Apps > Search & Reporting.

Provides default interface for searching and analyzing logs.

Enables the user to create knowledge object, reports, alerts and dashboards.

It only gives us search functionality.

Indexing

Searching

Parsing

Settings

Input

No

Yes

lookup

csvlookup

inputlookup

outputlookup

Dashboards

Metadata only

Non-interesting fields

Field descriptions

Look back 3 days ago and prior

Look back 72 hours up to one day ago

Look back 72 hours, up to the end of today

Look back from 3 days ago up to the beginning of today

Only A, B

Router and Switch Logs

Firewall and Web Server Logs

Only C

Database logs

All firewall, web server, database, router and switch logs

All data accessible to the User role will appear in the report.

All data accessible to the owner of the report will appear in the report.

All data accessible to all users will appear in the report until the next time the report is run.

The owner of the report can configure permissions so that the report uses either the User role or the owner’s profile at run time.

Writes search results to a file named products.csv

Returns the contents of a file named products.csv

True

False

limit

useperc

addtotals

fieldcount

Time

Fast mode

Sourcetype

Selected Fields