Free Splunk Core Certified User Exam Flashcards

Forwarders collect data at the source and send it on, indexers parse that data and store it in indexes, and search heads run your searches and present the results. In a small single-instance deployment, one Splunk installation performs all three roles.

An app is a self-contained workspace bundling its own navigation, dashboards, and knowledge objects. Most searching happens in Search & Reporting, the default app. Switching apps changes which saved objects you can see, so a report saved in one app may not appear in another.

Last 24 hours. Time range is the single biggest lever on search speed, so narrow it before adding more filters. The preset list comes from times.conf and includes real-time windows, relative ranges, date ranges, and All time.

The time modifiers typed in the search bar win. A range specified in the SPL, or saved with a saved search, overrides the picker. This is the usual explanation when a dashboard panel appears to ignore the time range you selected.

It defaults to now. The reverse is not permitted: if you specify a latest time you must also specify an earliest time, or the search will not bound the range the way you intend.

It snaps the time back to the start of that unit. So -1d@d means go back 24 hours, then snap to midnight, giving you the beginning of yesterday rather than this time yesterday. Snapping always rounds down, never up.

Fast, Smart, and Verbose. Smart is the default: it acts like Verbose for event searches, discovering all fields, and like Fast when the search contains a transforming command. Fast mode turns field discovery off to gain speed.

It charts how many matching events occurred over each slice of the search's time range, making spikes and gaps obvious. Clicking a bar zooms the results into that slice. This filters what you are viewing without editing your SPL.

Because that search returns raw events, not a results table. The Statistics and Visualization tabs only populate once a transforming command such as stats, top, rare, or chart has turned those events into rows and columns.

An ad hoc job is retained for 10 minutes after it finishes. Sharing the job extends its lifetime to 7 days and grants read permission to Everyone. Viewing an active job resets its timer, and once the lifetime expires the job is deleted.

Pause suspends the job so you can resume it. Finalize stops the search early but keeps every result gathered so far. Cancel stops the job and throws the results away. Finalize is the right choice when a long search has already found enough.

Splunk offers to add that field-value pair to your search, or to exclude it from the results. It rewrites the SPL for you, which is the quickest way to refine a search. The added term is ordinary SPL that you can then edit by hand.

A Report, a Dashboard Panel, an Alert, or an Event Type. Saving as a report preserves the search string, time range, and display settings for reuse. Exporting results is separate and offers CSV, JSON, XML, or raw event output.

host is the machine an event came from, source is the file or input path it arrived through, and sourcetype describes the format of the data. They exist on every event, making them the fastest way to slice data by origin.

host, source, and sourcetype. Selected fields are displayed beneath each event in the results list. You can promote any other field to selected, after which it appears under every event that actually contains it.

In at least 20% of the events returned. That threshold explains why a field you know exists can be missing from the sidebar: it is present but too sparse in this result set. Search for it directly or add it as a selected field.

Field names are case-sensitive, but the terms you search for are not. status and Status are two different fields, while searching failed also matches FAILED. Boolean operators such as AND, OR, and NOT must be uppercase to work as operators.

At search time, each time a search runs, rather than when the data was indexed. That is why a newly created field extraction immediately applies to data already sitting in the index, and why the original raw event text is never altered.

The bare keyword scans the raw text of events for that string anywhere it occurs. The field-value pair matches only events where the extracted field status holds that value, so it is far more precise and normally faster.

The != form only returns events that actually have a status field at all. NOT additionally returns events where the field is missing entirely. Reach for NOT whenever the absence of a field should also count as a match.

=, !=, <, <=, >, and >=. Comparisons only work against field-value pairs, never bare keywords, so bytes>1000 is valid while a naked >1000 is not. Numeric comparisons require the field to contain numeric values.

At the beginning. A leading wildcard such as *error forces Splunk to scan far more data because the index cannot be used efficiently. Trailing wildcards like status=4* are fine and are used routinely.

Use the IN operator, as in status IN (401, 403, 404). It is functionally the same as chaining OR conditions on that one field, but it is shorter to type and much easier to read later.

Each pipe feeds the results of the command on its left into the command on its right. The search command is implied at the very beginning, which is why you type index=web error instead of search index=web error.

Parentheses first, then NOT, then OR, then AND. The eval and where commands reverse the last two, evaluating AND before OR. AND is implied between adjacent terms, and NOT applies only to the single term that follows it.

Writing index=web restricts the search to one index rather than every index your role can read, which cuts the work enormously. Index, sourcetype, host, and time are the filters to place first, before the first pipe.

The plus form keeps only the fields you list; the minus form removes them. Plus is the default when no sign is given. The internal fields _raw and _time survive the fields command unless you name them explicitly, as in fields - _raw.

Both select fields, but table also formats output as a table with columns in exactly the order you listed, and it is non-streaming. Put table at the end of a search, and use fields earlier in the pipeline to trim data as it flows.

Use rename with quotation marks around the new name: rename bytes AS "Bytes Sent". Do the renaming before piping into table, because table can only select fields that already exist under that name; it cannot rename anything.

It keeps only the first event for each distinct host and discards the later duplicates. Supply a number to keep more, as in dedup 3 host. Add a sortby clause to control which event ends up counting as the first one.

Prefix the field with a minus sign: sort - bytes. A plus sign, or no sign at all, sorts ascending. When you give no count, sort returns at most 10000 results; sort 0 returns every result.

It converts individual events into a statistics table of rows and columns. stats, top, rare, and chart are the common examples. Only after a transforming command runs do the Statistics and Visualization tabs have anything to display.

Ten rows, holding the most common values of user. It adds a count column and a percent column showing each value's share of the events. The results arrive already sorted from most common to least common.

Give it a number, as in top 5 user, which is identical to top limit=5 user. Setting limit=0 returns every distinct value. Add showperc=false when you want the counts but not the percent column.

The three most common product values within each individual category, not merely the three most common products overall. The BY clause splits the calculation into separate groups, which is how you compare leaders across segments.

It returns the least common values of a field, the mirror image of top, and takes the same arguments including the default limit of 10. Use it to surface unusual values such as seldom-seen error codes or rarely active accounts.

Without BY it returns exactly one row, aggregating the entire result set. With BY it returns one row per distinct value of that field, or one row per unique combination when you list several fields.

count counts every event. count(status) counts only the events where status actually has a value. dc(status), short for distinct_count, counts how many different status values appeared rather than how many events did.

count, sum, avg, min, max, plus values for distinct values and list for all values including duplicates. Use AS to name the resulting column, for example stats sum(bytes) AS "Total Bytes" BY host.

The search string together with its time range and display settings, so it can be rerun without retyping any SPL. A report is the reusable building block you later schedule, share, or drop onto a dashboard as a panel.

New reports are private to their owner by default. Sharing has to be changed to App or All apps in the report's permissions before anyone else can see it. The report also lives inside the app it was saved in.

On the Reports listing page, using the Edit menu for that report, which also offers clone and delete. Changing the underlying SPL is different: open the report in Search, adjust the search, and save your changes.

Visualizations require numeric, time-based, or aggregated results. Pipe the events through a transforming command first, such as stats count BY status, and the Visualization tab will then offer chart types to choose from.

Save a search straight to a dashboard panel using Save As, or add an existing saved report to a dashboard. Either route lets you create a brand new dashboard or append the panel to a dashboard that already exists.

A report-backed panel stays linked to that report, so editing the report updates every dashboard using it. An inline search is a private copy living inside that one dashboard and has to be edited panel by panel.

It matches a field in your events against a column in a table and then adds that table's other columns to those events as new fields. A CSV lookup is called a static lookup because its contents change only when you replace the file.

Upload the CSV as a lookup table file, create a lookup definition that names the file and sets the matching rules, then optionally configure it as an automatic lookup. Every lookup type requires a definition before it can be used.

An automatic lookup is applied to all matching searches at search time with no SPL required, while the lookup command applies it only where you type it. In the command, OUTPUT overwrites existing fields and OUTPUTNEW leaves them untouched.

A scheduled report runs on a schedule and delivers its results every single time. An alert runs on a schedule or in real time but acts only when its trigger condition is satisfied, such as the result count crossing a threshold.

Throttling suppresses further triggering for a set period so one noisy condition cannot flood you with actions. Fired alerts appear under Activity then Triggered Alerts, where severity (Info, Low, Medium, High, Critical; Medium by default) only groups them.