SPLUNK

5 Main components of Splunk Enterprise correct answer: Index Data, Search & investigate, Add knowledge, Monitor & Alert, Report & Analyze. - Module 1 Three main roles in splunk? (3) correct answer: Admin, Power, User - Module 1 What role can Install apps, create knowledge objects for all users, and can control what apps a user will see by default correct answer: Admin What role can creates and share knowledge objects for users of app, and create real-time searches correct...

Creating Searches and Saving Results: Selected fields are displayed ______each event in the search results. a) below b) interesting fields c) other fields d) above correct answer: a) below Creating Searches and Saving Results: Search terms are not case sensitive. a) True b) False correct answer: a) True Creating Searches and Saving Results: These two searches will NOT return the same results. SEARCH 1:login failure SEARCH 2: "login failure". a) True b) False correct answer: ...

Machine data is generated by correct answer: All types of system in an organization Structure of machine data correct answer: Unstructured Machine data makes up ___% of data accumulated by organizations correct answer: 90 Main way data is supplied for indexing correct answer: Forwarders Search requests are processed by the correct answer: Indexers 3 main components of splunk correct answer: Collect and index data Add knowledge Search and investigate Single instance depl...

Splunk correct answer: Aggregate, analyze, and get answers from your machine data Splunk can index ____ data from ANY source. correct answer: ANY Sources correct answer: Computers Network devices Virtual machines Internet devices Communication devices Sensors Databases Logs Configurations Messages Call detail records Clickstream Alerts Metrics Scripts Changes Tickets How is Splunk deployed? correct answer: Splunk Enterprise, Splunk Cloud, Splunk Light Splunk Enter...

"Table" command correct answer: returns table containing only specified fields in the result set "rename" command correct answer: renames a field in results "fields" command correct answer: includes or excludes specified fields "dedup" command correct answer: removes duplicates from results "sort" command correct answer: sorts results by specified field "lookup" command correct answer: adds field values from external source T/F: Boolean are case sensitive? cor...

M1: What is machine data ? correct answer: Data generated by machines, computer processing, application and sensor data etc... M1: Where machine data comes from ? correct answer: Computers, network devices, sensors, phones, cars etc... M1: Is machine data always structured ? correct answer: No M1: How much percent machine data is accumulated by organizations ? correct answer: 90% M1: How Splunk process the unstructured machine data ? correct answer: By adding it to a intelligent...

Machine data makes up for more than ___% of the data accumulated by organizations. correct answer: 90 Machine data is always structured. correct answer: False Machine data is only generated by web servers. correct answer: False Which of these is not a main component of Splunk? Select your answer. Search and investigate Add knowledge Collect and index data Compress and archive correct answer: Compress and archive What are the three main processing components of Splunk? co...

5 Main components of Splunk ES correct answer: Index Data, Search & investigate, Add knowledge, Monitor & Alert, Report & Analyze. What does index data do? (3) correct answer: 1. Collects data 2. Label data with source type 3. Stored in splunk index Three main roles in splunk? (3) correct answer: Admin, Power, User An admin does what? correct answer: Install apps, create knowledge objects for all users (what apps a user will see by default) A power user does what? correct answ...

T/F: Machine data is always structured. correct answer: False. Machine data can be structured or unstructured. Machine data makes up for more than ___% of the data accumulated by organizations. correct answer: 90 T/F: Machine data is only generated by web servers. correct answer: False Search requests are processed by the ___________. correct answer: Indexers Search strings are sent from the _________. correct answer: Search Head In most Splunk deployments, ________ serv...

What is the only writeable bucket type? correct answer: The hot bucket By what filter are indexes divided into buckets? correct answer: By time What are the 4 types of searches in Splunk (by performance) correct answer: Dense, Sparse, Super Sparse, Rare In searches, what is the scanCount? correct answer: The number of events scanned for that particular search What are the requirement of the underlying search in order to get multi-series table? correct answer: The underlying sear...