How do you rate the Workshop?

5 * !, Awesome!, Epic!, Excellent!

studbud

Splunk Introduction Workshop

93 termsStudBud Administration30 plays

Splunk concepts and tool overview. Full Quiz, both days.

Flashcards93 cardsFPractice quizPHost liveL

Questions 93

Answers

1
Which parameter to add to show only 1 result for Top and Rare Commands?
1
Limit=1
Only 1
Results=1
2
Which element does not belong to the Search tab?
Business Areas
Time Range Picker
Fields SIde Bar
Events
3
Business Areas can be accessed from a dropdown menu.
False
True
4
What is the default number of results for Top and Rare Commands?
10
5
1
3
5
The Sort Command can be used on Numbers and on Strings.
True
False
6
Every Event has its own timestamp.
True
False
7
Field names are case insensitive.
True
False
8
Command that creates a new variable:
Eval
Value
Var
New
9
Stats Command syntax allows the renaming of its results.
True
False
10
What Fields are displayed by default on Top and Rare Commands?
Count
Percent
Sum and Percent
Count and Percent
11
Command that removes subsequent duplicates:
Hide
Dedup
Remove
Delete
12
Eval Function that rounds a number to the desired decimal places.
shape
integer
round
transform
13
Adding more detail to a Search reduces the subset of data.
False
True
14
Dashboards can be accessed from within the Business Areas.
True
False
15
Which Command sorts in descending order?
| sort dow
| sort -
| sort \/
| sort +
16
What is the Command to create Event sets of 12 hours?
| bin _time span=half
| bin _time span=12h
| bin _time span=midday
| bin _time span=24-12
17
How to retrieve Events since midnight?
earliest=@mid
earliest=00:00
earliest=midnight
earliest=@d
18
Eval Function that checks if the Field matches the specified string.
| validate(field,string)
| like(field,string)
| match(field,string)
| compare(field,string)
19
Calculated Fields support aggregate statistics.
True
False
20
Stats does not support the use of the "by" clause.
False
True
21
How do you rate the Workshop?
5 * !
Awesome!
Epic!
Excellent!
22
A table can't have Fields sorted in ascending and others descending order at the same time.
True
False
23
Which Role is able to perform realtime Searches?
Power
Admin
Super
User
24
How to retrieve all time Events?
earliest=0 latest=end
earliest=0 latest=now
earliest=start latest=end
earliest=start latest=now
25
Alias supports the use of the eval Command.
False
True
26
Stats Function that returns the number of occurrences:
Dc
Occurrences
Sum
Count
27
Eval Function to check the size of a String.
| size(string)
| lenght(string)
| len(string)
| stringsize(string)
28
Which is not a Business Area?
Product Engagement
Content Providers
Platform Usage
Device Issues
29
Command that orders Events:
Order
Classify
Group
Sort
30
How to disable the percent Field on Top and Rare Commands?
showperc=diasbled
showperc=false
percent=false
no percent
31
Wildcards cannot be used when looking for Field's values.
False
True
32
Where are Events stored at?
Bins
Drawers
Pools
Indexes
33
Eval Function that evaluates a condition and performs an action based on the result.
boolean
perform
validate
If
34
How to change the name of the Custom.ACTN Field?
Swap
Change
Switch
Rename
35
A Search time range can only be set by the time range picker.
False
True
36
Data cannot be filtered on Dashboards.
True
False
37
It is not possible to drilldown on Dashboards.
True
False
38
How to sort Field a,b in ascending order and c in descending order?
| sort -a -b +c
| sort a b c --+
| sort + a b -c
| sort - a b +c
39
strftime Function is used to retrieve the current time.
False
True
40
Stats Function that returns the number of distinct occurrences:
Count
Times
Sum
Dc
41
On Splunk no login is required.
False
True
42
Which is not a comparison operator in Splunk?
!=
<=
?=
=
43
A group of graphs and tables showing Key Performance Indicators is a...
Search
Dashboard
Page
Data
44
How to remove the HouseholdID Field from the returned Events?
| -HouseholdID
| remove HouseholdID
| fields -HouseholdID
| dedup HouseholdID
45
Both Searches will retrieve results.
True
False
46
Function that returns the current time:
Now()
Time()
CurrentTime()
Today()
47
Dashboard tables allow data to be sorted.
True
False
48
Command to calculate aggregate statistics:
Agg
Stats
Aggregate
Statistics
49
Within All Fields Window, Field's coverage is displayed.
False
True
50
Eval Commands can be used within stats Commands.
False
True
51
When using the table Command, the order of the Fields matter.
False
True
52
All data arriving on Splunk comes from the same source.
True
False
53
A Query that retrieves meaningful data is a...
Search
Query
Order
Question
54
Function used to format the time.
changetime
formattime
edittime
strftime
55
Events, Patterns, Statistics and Visualization are tabs under Search.
True
False
56
How to change a Field's name?
| change old_name with new_name
| substitute old_name with new_name
| replace old_name with new_name
| rename old_name as new_name
57
Which index is storing Italy's Data?
cloudera_it
cloud_italy
splunk_it
italian_data
58
This is a valid Command: | fields - UserID DeviceID +HouseholdID
True
False
59
There are 4 Business Areas on Italy's App.
False
True
60
What is the Command to exclude the DeviceID Field from results?
| delete DeviceID
| fields -DeviceID true
| fields -DeviceID
| fields DeviceID
61
To rename a field on the Stats Command which clause is used?
as clause
rename clause
edit clause
modify clause
62
What is the correct syntax of the bin Command?
| bin _time span=<interval>
| _time bin span=<interval>
| bin _time
| bin span=<interval> _time
63
Stats Commands enables statistics calculations.
True
False
64
Both Searches will retrieve the same number of Events.
True
False
65
Which Command sorts in ascending order?
| sort /\
| sort +
| sort
| sort up
66
Who is able to see their own Dashboards and Dashboards shared with them?
User
Admin
Power
Super
67
Splunk receives Technical and Behavioral Events.
True
False
68
Command used to return the 5 most recent Events for a historical Search.
| latest 5
| lifo 5
| head 5
| recent 5
69
How to display only the date?
strftime(now(),"%H:%M:%S %d/%m/%Y")
strftime(now(),"%d/%m/%Y")
strftime(now(0),"%d/%m/%Y")
strftime(now,"%d/%m/%Y")
70
Only one Function can be used per stats Command.
False
True
71
Time fields can't be manipulated.
True
False
72
Under which tab are queries executed?
Search
Dashboards
Home
Glossary
73
Command that indicates where to get data from:
database=cloudera_it
INDEX=cloudera_it
data from cloudera_it
index=cloudera_it
74
What is the tool we are exploring today?
Graylog
Qlik
Kibana
Splunk
75
Field values are not case sensitive.
False
True
76
What is the default page when opening Italy's App?
Home
Dashboards
Search
Business Areas
77
Command used to return the last 10 Events starting at the end of the result set.
| old 10
| fifo 10
| push 10
| tail 10
78
A stats Command can be applied to the results of a previous stats Command.
True
False
79
On Italy's App we can only see 2 Business Areas.
False
True
80
Data can be exported from Dashboards.
False
True
81
How to retrieve Events from yesterday?
earliest=-1d@d latest=@d
earliest=-1d@d latest=@mid
earliest=yesterday latest=midnight
earliest=@d latest=-1d@d
82
When using the table Command, each column is an Event.
True
False
83
Which tab displays statistical graphs?
Visualization
Graphs
Views
Widgets
84
An alias replaces or removes the original Field name.
True
False
85
Command that filters results using a specified condition:
With
Filter
Validate
Where
86
Italy's App has a Glossary page.
True
False
87
To exclude more than one Field we use | fields - <Field1> <Field2> ... Command.
False
True
88
Calculated Fields are used replace eval Commands.
True
False
89
Field that stores the event's time?
_timestamp
Time
_eventTime
_time
90
A Field can have multiple aliases.
False
True
91
What is the Command that manipulates the _time Field to fit into subsets?
Bin
Shape
Manipulate
Time
92
Which Role is not one of the main Splunk Roles?
Admin
User
Power
Super
93
On Splunk Home, where is the Apps panel located?
Left section
Middle section
Bottom section
Right section

Splunk Introduction Workshop Flashcards | StudBud

Splunk Introduction Workshop

93 termsStudBud Administration30 plays

Splunk concepts and tool overview. Full Quiz, both days.

Flashcards93 cardsFPractice quizPHost liveL

Questions 93

Answers

1
Which parameter to add to show only 1 result for Top and Rare Commands?
1
Limit=1
Only 1
Results=1
2
Which element does not belong to the Search tab?
Business Areas
Time Range Picker
Fields SIde Bar
Events
3
Business Areas can be accessed from a dropdown menu.
False
True
4
What is the default number of results for Top and Rare Commands?
10
5
1
3
5
The Sort Command can be used on Numbers and on Strings.
True
False
6
Every Event has its own timestamp.
True
False
7
Field names are case insensitive.
True
False
8
Command that creates a new variable:
Eval
Value
Var
New
9
Stats Command syntax allows the renaming of its results.
True
False
10
What Fields are displayed by default on Top and Rare Commands?
Count
Percent
Sum and Percent
Count and Percent
11
Command that removes subsequent duplicates:
Hide
Dedup
Remove
Delete
12
Eval Function that rounds a number to the desired decimal places.
shape
integer
round
transform
13
Adding more detail to a Search reduces the subset of data.
False
True
14
Dashboards can be accessed from within the Business Areas.
True
False
15
Which Command sorts in descending order?
| sort dow
| sort -
| sort \/
| sort +
16
What is the Command to create Event sets of 12 hours?
| bin _time span=half
| bin _time span=12h
| bin _time span=midday
| bin _time span=24-12
17
How to retrieve Events since midnight?
earliest=@mid
earliest=00:00
earliest=midnight
earliest=@d
18
Eval Function that checks if the Field matches the specified string.
| validate(field,string)
| like(field,string)
| match(field,string)
| compare(field,string)
19
Calculated Fields support aggregate statistics.
True
False
20
Stats does not support the use of the "by" clause.
False
True
21
How do you rate the Workshop?
5 * !
Awesome!
Epic!
Excellent!
22
A table can't have Fields sorted in ascending and others descending order at the same time.
True
False
23
Which Role is able to perform realtime Searches?
Power
Admin
Super
User
24
How to retrieve all time Events?
earliest=0 latest=end
earliest=0 latest=now
earliest=start latest=end
earliest=start latest=now
25
Alias supports the use of the eval Command.
False
True
26
Stats Function that returns the number of occurrences:
Dc
Occurrences
Sum
Count
27
Eval Function to check the size of a String.
| size(string)
| lenght(string)
| len(string)
| stringsize(string)
28
Which is not a Business Area?
Product Engagement
Content Providers
Platform Usage
Device Issues
29
Command that orders Events:
Order
Classify
Group
Sort
30
How to disable the percent Field on Top and Rare Commands?
showperc=diasbled
showperc=false
percent=false
no percent
31
Wildcards cannot be used when looking for Field's values.
False
True
32
Where are Events stored at?
Bins
Drawers
Pools
Indexes
33
Eval Function that evaluates a condition and performs an action based on the result.
boolean
perform
validate
If
34
How to change the name of the Custom.ACTN Field?
Swap
Change
Switch
Rename
35
A Search time range can only be set by the time range picker.
False
True
36
Data cannot be filtered on Dashboards.
True
False
37
It is not possible to drilldown on Dashboards.
True
False
38
How to sort Field a,b in ascending order and c in descending order?
| sort -a -b +c
| sort a b c --+
| sort + a b -c
| sort - a b +c
39
strftime Function is used to retrieve the current time.
False
True
40
Stats Function that returns the number of distinct occurrences:
Count
Times
Sum
Dc
41
On Splunk no login is required.
False
True
42
Which is not a comparison operator in Splunk?
!=
<=
?=
=
43
A group of graphs and tables showing Key Performance Indicators is a...
Search
Dashboard
Page
Data
44
How to remove the HouseholdID Field from the returned Events?
| -HouseholdID
| remove HouseholdID
| fields -HouseholdID
| dedup HouseholdID
45
Both Searches will retrieve results.
True
False
46
Function that returns the current time:
Now()
Time()
CurrentTime()
Today()
47
Dashboard tables allow data to be sorted.
True
False
48
Command to calculate aggregate statistics:
Agg
Stats
Aggregate
Statistics
49
Within All Fields Window, Field's coverage is displayed.
False
True
50
Eval Commands can be used within stats Commands.
False
True
51
When using the table Command, the order of the Fields matter.
False
True
52
All data arriving on Splunk comes from the same source.
True
False
53
A Query that retrieves meaningful data is a...
Search
Query
Order
Question
54
Function used to format the time.
changetime
formattime
edittime
strftime
55
Events, Patterns, Statistics and Visualization are tabs under Search.
True
False
56
How to change a Field's name?
| change old_name with new_name
| substitute old_name with new_name
| replace old_name with new_name
| rename old_name as new_name
57
Which index is storing Italy's Data?
cloudera_it
cloud_italy
splunk_it
italian_data
58
This is a valid Command: | fields - UserID DeviceID +HouseholdID
True
False
59
There are 4 Business Areas on Italy's App.
False
True
60
What is the Command to exclude the DeviceID Field from results?
| delete DeviceID
| fields -DeviceID true
| fields -DeviceID
| fields DeviceID
61
To rename a field on the Stats Command which clause is used?
as clause
rename clause
edit clause
modify clause
62
What is the correct syntax of the bin Command?
| bin _time span=<interval>
| _time bin span=<interval>
| bin _time
| bin span=<interval> _time
63
Stats Commands enables statistics calculations.
True
False
64
Both Searches will retrieve the same number of Events.
True
False
65
Which Command sorts in ascending order?
| sort /\
| sort +
| sort
| sort up
66
Who is able to see their own Dashboards and Dashboards shared with them?
User
Admin
Power
Super
67
Splunk receives Technical and Behavioral Events.
True
False
68
Command used to return the 5 most recent Events for a historical Search.
| latest 5
| lifo 5
| head 5
| recent 5
69
How to display only the date?
strftime(now(),"%H:%M:%S %d/%m/%Y")
strftime(now(),"%d/%m/%Y")
strftime(now(0),"%d/%m/%Y")
strftime(now,"%d/%m/%Y")
70
Only one Function can be used per stats Command.
False
True
71
Time fields can't be manipulated.
True
False
72
Under which tab are queries executed?
Search
Dashboards
Home
Glossary
73
Command that indicates where to get data from:
database=cloudera_it
INDEX=cloudera_it
data from cloudera_it
index=cloudera_it
74
What is the tool we are exploring today?
Graylog
Qlik
Kibana
Splunk
75
Field values are not case sensitive.
False
True
76
What is the default page when opening Italy's App?
Home
Dashboards
Search
Business Areas
77
Command used to return the last 10 Events starting at the end of the result set.
| old 10
| fifo 10
| push 10
| tail 10
78
A stats Command can be applied to the results of a previous stats Command.
True
False
79
On Italy's App we can only see 2 Business Areas.
False
True
80
Data can be exported from Dashboards.
False
True
81
How to retrieve Events from yesterday?
earliest=-1d@d latest=@d
earliest=-1d@d latest=@mid
earliest=yesterday latest=midnight
earliest=@d latest=-1d@d
82
When using the table Command, each column is an Event.
True
False
83
Which tab displays statistical graphs?
Visualization
Graphs
Views
Widgets
84
An alias replaces or removes the original Field name.
True
False
85
Command that filters results using a specified condition:
With
Filter
Validate
Where
86
Italy's App has a Glossary page.
True
False
87
To exclude more than one Field we use | fields - <Field1> <Field2> ... Command.
False
True
88
Calculated Fields are used replace eval Commands.
True
False
89
Field that stores the event's time?
_timestamp
Time
_eventTime
_time
90
A Field can have multiple aliases.
False
True
91
What is the Command that manipulates the _time Field to fit into subsets?
Bin
Shape
Manipulate
Time
92
Which Role is not one of the main Splunk Roles?
Admin
User
Power
Super
93
On Splunk Home, where is the Apps panel located?
Left section
Middle section
Bottom section
Right section