Splunk Course Cumulative Quiz Answers & Breakdown Questions
Ch. 1 Intro to Splunk
What is the most efficient way to limit search results returned?
ANS: time
Q: What is an event in Splunk?
ANS: data that has been indexed in Splunk, assigned a timestamp, host, source, and source type.
Ex. Event Data: system/ app logs, security alerts
Which command can be used to further filter results in a search?
ANS: search
Q: What is a command?
ANS: command is another word for function in Splunk, but it also has sub functions which are actually called functions in Splunk
Ex. Search Commands: search, eval, where
Ex. Transforming Commands: stats, chart, timechart
Ex. Streaming Commands: Process each event individually (e.g., rex, fields, table).
Ex. Generating commands: Create new events (e.g., inputlookup, makeresults).
Ex. Dataset processing commands: Modify datasets (e.g., dedup, sort, join).
What are the default roles in Splunk Enterprise?
ANS: Power, Admin, User
Which Splunk infrastructure component stores ingested data?
ANS: Index
Q: What is the index?
ANS: Splunk data repository, that holds event data
Q: What are other examples of Splunk infrastructure?
ANS: Forwarders, Indexers, Search Head
What search will return results contain the words fail, failure, or failed?
ANS: fail*
Q: How does the wildcard* operand work in Splunk for searches?
ANS: matches any number of characters, and can’t be put at the beginning of the search term
Q: Why is the wildcard* operand less efficient in search’s?
ANS: It finds all terms containing search term in it
ex. fail* → fail, failure, fail404 vs. ex. fail → fail
Which search mode behaves differently depending on the type of search being run?
ANS: Smart
Q: What are the different search modes?
ANS: Fast Mode, Smart Mode, Verbose Mode
Q: How are the search modes different?
ANS:
Fast Mode: Prioritizes speed by limiting the amount of data returned. It extracts only default fields (like host, source, and sourcetype) and does not perform search-time field extraction unless explicitly specified.
Smart Mode (default): Balances speed and detail. It switches between Fast and Verbose modes depending on whether the search includes transforming commands.
Verbose Mode: Returns the most comprehensive event data, including all extracted fields, but at the cost of slower performance.
You can find more details in the Splunk documentation. Would you like help choosing the best mode for your searches?
By default, who is able to view a saved report?
ANS: The user who created it
Q: What is a saved report?
What determines the timestamp shown on returned events in a search
ANS: The time zone defined in user settings
By default, how long does a search job remain active?
ANS: 10min
Q: What is a search job?
ANS: process that tracks and manages searches performed within the system. Whenever you run a search, open a report, or load a dashboard panel, Splunk creates a search job to handle the query execution. Each search job generates a search artifact, which contains the results and metadata associated with the search.
Which of the following searches will return results containing the terms failed, password, or failed password?
ANS: failed OR password || failed OR password OR "failed password"
Q: Why is quotation marks required for “failed password”?
ANS: a search term requires quotation marks if it contains spaces in order to be found together
By default, which of the following roles are required to share knowledge objects?
ANS: Admin || Power
When a search is run, in what order are events returned?
ANS: reverse chronological order
Which of the following Booleans can be used in a search?
ANS: AND, NOT, OR
Ch. 2 Using Fields
At search time, if an event has an equal(=) sign, the data to the left is treated as a ______ and the data to the right is treated as a ______.
ANS: field name, value
Q: What is a field?
ANS: key value pair of extracted event data
The fields command allows you to do which of the following? - Include fields (fields +), Exclude fields (fields -), Include fields (fields)
At search time, _______ extracts fields from raw event data.
ANS: field discovery
Q: What is field discovery?
ANS: process of extracting key value pairs from event data
In the Fields sidebar, Interesting Fields occur in at least ________ of resulting events.
ANS: - 20%
True or False: Once you rename a field, the new field name must be used in the rest of the search string.
ANS: TRUE
Q: What is the search string?
ANS: This is basically all the “code” contained in your search
To remove fields from a search, you would use the _________ command.
ANS: fields-
Which of the following fields are default selected fields?
ANS: host, sourcetype, source
True or False: Fields are knowledge objects.
ANS: True
Q: What are knowledge objects?
ANS: user-defined entities that enrich and structure data, making it easier to search, analyze, and visualize.
Ch. 3 Scheduling Reports & Alerts
What is a primary benefit of scheduling reports?
ANS: Scheduling a report reduces the demand that concurrently running reports can put on your system hardware.
When are actions triggered for a real-time alert?
ANS: As soon as alert conditions are met
Q: What is a real-time alert?
ANS: an alert that continuously monitors incoming data and triggers as soon as specific conditions are met
Q: What is a real-time report?
ANS: A real-time report in Splunk continuously updates as new data streams in, allowing users to monitor live events without waiting for scheduled updates.
Which Edit setting allows a report to be displayed to users outside of your organization?
ANS: Embed
Q: What does Embed mean?
ANS: integrating Splunk reports, dashboards, or external content into other platforms or web pages.
Which alert action allows you to send a message to an external chat room?
ANS: Webhook
Q: What are alert actions?
ANS: alert actions are automated responses triggered when an alert condition is met.
Ex. alert actions, email notifications, webhook, logging events, mobile alerts, csv lookup output
Which of the following user roles are able to display a report in all apps?
ANS: Admin
Q: What is an app in Splunk?
ANS: packaged collection of configurations, dashboards, reports, and other components that extend Splunk's functionality for specific use cases.
Which alert action allows you to send an event to your Splunk deployment for indexing?
ANS: Log event #
Q: What alert actions should you know for the exam?
Which of the following user roles are able to display a report in the app in which it was created?
ANS: The user who created the report, and admin #
Which of the following prebuilt alert actions can be triggered when a report is run?
ANS: Output results to a lookup or Send an email #
Which scheduled alert type will continuously run in the background?
ANS: Real-time
Which alert setting allows you to control how many alert actions are taken when trigger conditions are met?
ANS: Throttle
What are 2 types of alerts?
ANS: Scheduled, Real-time
Which scheduled report setting helps determine when concurrent reports will run?
ANS: Schedule Priority
Q: How does the Schedule Priority work?
If a dashboard panel is powered by a scheduled report, how frequently will its contents update?
ANS: The dashboard panel updates any time the dashboard is opened or manually refreshed.
Which scheduled report setting allows you to define a time range for a report to run if it is delayed?
Schedule Window?
Q: How does the Schedule Window work?
ANS: Instead of executing searches at an exact time, the schedule window lets Splunk shift the execution slightly to balance system load and prevent resource spike.
Ch. 4 Scheduling Reports & Alerts
Which clause can be used with the top command to change the name of the count column?
ANS: countfield
Which argument can be used with the timechart command to specify the time range to use when grouping events?
ANS: span
Which of the following commands can return a count of all events matching search criteria over a specified time period?
ANS: stats
Q: Why is it stats and not count?
ANS: count is a sub function, so you have to use stats count
Which argument can be used with the geostats command to control the column count?
ANS: globallimit
Which command removes duplicate field values in search results?
ANS: dedup
Which clause can be used with the top command to specify a number of values to return?
ANS: limit
Which optional argument of the addtotals command changes the label for row totals in a table?
ANS: fieldname
Q: What is the structure of the addototals command and how does it work?
Which command can be used to exclude fields from search results?
ANS: fields
Which type of default map visualization uses shading to represent relative metrics?
ANS: Choropleth Map
Which command changes the appearance of field values?
ANS: fieldformat
Q: How does the fieldformat command work?
Which clause can be used with the rare command to specify whether or not a percentage column is created?
ANS: showperc
In a single series data table, which column provides the x-axis values for a visualization?
ANS: The first column
How many columns are displayed in a visualization by default when using the chart command?
ANS: 10
When using the timechart command, which axis represents time?
ANS: X-axis
How can the order of columns in a table be changed?
ANS: By changing the order of fields specified in the table command
Ch. 5 Working with Time
What will the strftime function return when using the %H argument with the _time field?
ANS: convert the hour into your local time based on your time zone setting of your Splunk web sessions
Using earliest=-30d@d latest=@d is how to return results from 30 days ago up until the time the search was executed.
ANS: False
Q: Why is this false?
Choose the search that will sort events into one minute groups.
ANS: | bin _time span = 1m || | bin _time span = 1mins
Q: How does the bin command work?
When using the following search arguments, what will be returned? | timechart count span=1h
ANS: chart of events in 1 hour chunk
@timeUnit will always round up and go forward through time.
ANS: False
Which of the following are default time fields?
ANS: date_year, date_mday, date_hour
The _______ and _______ time modifiers will override the time range picker in a historical report.
ANS: earliest, latest
date_time always reflects your local time zone and not the time/date from raw events.
ANS: False
Q: Why false?
Ch. 6 Statistical Processing
If you use the stats command with two functions and a BY clause, which function is the BY clause applied to?
ANS: both functions
True or False: Using an OVER and a BY clause with the chart command will create a multiseries data series.
ANS: TRUE
True or False: The pow(X,Y) eval function returns Y to the power of X.
ANS: False
True or False: Only one field can be created when using the eval command.
ANS: False
True or False: You can use wildcards (*) with the rename command to rename multiple fields that match a pattern.
ANS: True
Which eval function would you use to round numerical values?
ANS: round
Which of these functions lists ALL values of the field X?
ANS: list(X)
Which of these eval functions takes no arguments?
ANS: random
By default, the sort command lists results in ___ order.
ANS: ascending
To display the least common values of a field, use the ___ command.
ANS: rare
True or False: The timechart command will always have _time as the X-axis.
ANS: True
When using the top command, add the BY clause to ___.
ANS: return results grouped by the field you specify in the BY clause
True or False: Use useother=false with the chart command if you want to hide the OTHER column.
ANS: True
When renaming fields with spaces or special characters, use the rename command and include the new field name in ___.
ANS: double quotes
When you use the stats command with a BY clause, what is returned?
a statistical output for each value of the named field
Ch. 7 Leveraging Lookups and Subsearches
Which return expression would return the first 3 values of the IP field as key-value pairs?
ANS: | return 3 IP
True or False: Subsearch results are combined with an AND Boolean and attached to the outer search with an OR Boolean.
ANS: False
Q: Why false? - Subsearch results are combined with an OR Boolean and attached to the outer search with an AND Boolean.
If using | return $<field>, the search will return:
ANS: The 1st <field> value
ANA: If you see return $ it means only the field value
True or False: Subsearches are always executed first.
ANS: True
What character should wrap a subsearch?
ANS: brackets []
Complete the lookup expression. The lookup should output IP, EMAIL, and DEPT values as ip, email, and dept. These lookup output fields should overwrite existing fields.
| lookup newEmployees.csv USERNAME as Username <missing>
ANS: | lookup newEmployees.csv USERNAME as Username OUTPUT IP as ip, EMAIL as email, DEPT as dept
Which of these inputlookup expressions is invalid?
ANS: | inputlookup map.kml
True or False: When using the outputlookup command, you can use the lookup's filename or definition.
ANS: TRUE
What command should you use if you want to write the results of a search to a lookup?
ANS: outputlookup
Q: what does inputlookup do?
If using | return <field>, the search will return:
ANS: The 1st <field> and its value as a key-value pair
What fields will be added to the event data when this lookup expression is executed? | lookup knownusers.csv user
ANS: All fields from knownusers.csv
Q: Why is it all fields?
Subsearches work best if they produce a large or small dataset? (Hint: Subsearches pass results to the outer search for filtering.)
ANS: small
True or False: Access lookup data by including a subsearch in the basic search with the inputlookup command
ANS: True
Ch. 8 Intro to Knowledge Objects
What are the three predefined sharing options for a knowledge object?
ANS: Shared in all apps, Shared in app, Private
Which knowledge object type can contain an eval expression?
ANS: Calculated fields
Q: What is a calculated field?
ANS: a field that is dynamically created at runtime by the eval command
Which knowledge object type can communicate with external sources using the HTTP GET and POST methods?
ANS: Workflow actions
What are the primary functions of a workflow action?
ANS: Passing information back to Splunk to run a secondary search, Communicating with an external source using the HTTP GET method, Communicating with an external source using the HTTP POST method
By default, what user role is required to make a knowledge object available to all apps?
ANS: Admin
When a user has left your organization, what happens to their knowledge objects?
ANS: An admin can reassign them to another user.
Which knowledge object type can be searched in Pivot?
ANS: Data models
Q: What is a Data Model?
Which knowledge object type can store entire search strings, including commands?
ANS: Macros
Q: What is a Macro?
ANS: a saved portion of a search string that can be reused, like a piece of code in a loop
Ex. index=web_logs status=500 OR status=503 OR status=504
define macro error_status: status=500 OR status=503 OR status=504
index=web_logs |
error_status
Where can you find a list of all fields returned from events?
ANS: The fields sidebar
Which of the following file types can be uploaded to create a lookup?
ANS: CSV
Which two of the following knowledge object types can contain an eval expression?
ANS: Calculated fields & Macros
Which of the following methods can be used to manually extract fields?
ANS: Delimiters, Regular Expressions, or RegEx
Q: Which knowledge objects can be scheduled to execute at specific times?
ANS: Alerts, Reports
Q: Which of the following user roles can create knowledge objects?
ANS: Admin, Power User
Q: By default, when a knowledge object is created, who can access its contents?
Ch. 9 Search Optimization
An accelerated report must include a ___ command.
ANS: transforming
Q: What are examples of transform commands?
ANS: stats, timechart, top
What is the proper syntax to include if you want to search a data model acceleration summary called "mydatamodel" with tstats?
ANS: from datamodel=mydatamodel
Q: What is the difference between tstats and stats command?
ANS:
tstats is significantly faster because it operates on indexed metadata rather than raw event data. It retrieves statistics from tsidx files, meaning it can only work with index-time fields like sourcetype, host, source, and _time
stats, on the other hand, works on raw event data, allowing it to process both index-time and search-time fields. This makes it more flexible but also slower compared to tstats.
Which command type is allowed before a transforming command in an accelerated report?
ANS: distributable streaming commands
Q: distributable command examples
ANS: eval
If you run the datamodel command by itself, what will Splunk return?
ANS: all the data models you have access to
Which component stores acceleration summaries for ad hoc data model acceleration?
ANS: the search head
True or False: By default, Power and Admin users have the privileges that allow them to accelerate reports.
ANS: True
True or False: The tstats command needs to come first in the search pipeline because it is a generating command.
ANS: True
Q: What is a generating command?
ANS: a search command that creates or retrieves events rather than processing existing ones. These commands are typically used at the beginning of a search pipeline and can pull data from indexes, lookups, or other sources.
Ex. Generating Commands: search, inputlookup, tstats, metadata, makeresults
Which option used with the data model command allows you to search events?
ANS: search & flat
Q: What are datamodel commands?
ANS: help you interact with and analyze data models, which are structured representations of indexed data designed for efficient searching and reporting.
Ex. Datamodel Commands: datamodel, pivot, tstats, search, flat
Q: What does the flat command do?
ANS: it takes key value pairs and puts them into a table
On the Searches, Reports, and Alerts page, you will see a ___ if your report is accelerated.
ANS: yellow lightning bolt
Report acceleration summaries are stored alongside ___ in the ___.
ANS: buckets & indexes
Q: What are buckets?
ANS: Storage containers inside indexes that hold data based on relevancy and when it was indexed