Splunk Core User Certification Comprehensive Study Guide

Splunk Components and Basic Architecture

• Splunk Components ($5\%$ of exam material):

  • Search Head: This component is the primary interface used to search data, analyze results, create reports, build dashboards, and configure alerts.

  • Indexer: This component is responsible for four key tasks: receiving data, processing it, indexing it (turning raw data into searchable events), storing that data, and returning search results when queried.

  • Forwarder: This component is used to collect data from various sources and send that data to a Splunk Index.

  • Index: This is the repository or storage location where Splunk stores its indexed data.

• Basic Data Flow Architecture:

  • The standard process follows this path: Data Source $\rightarrow$ Forwarder $\rightarrow$ Indexer $\rightarrow$ Search Head $\rightarrow$ User.

Uses of Splunk and Machine Data Examples

• Core Capabilities:

  • Splunk is designed to collect and index machine data.

  • It allows users to search, analyze, and visualize data.

  • It provides tools to monitor systems and investigate specific events.

  • Users can generate reports, dashboards, and automated alerts based on the data.

• Typical Machine Data Examples:

  • Windows Event Logs

  • Linux logs

  • Firewall logs

  • Web server logs

  • Application logs

  • Network logs

  • Security logs

Splunk Apps, Add-ons, and User Settings

• Splunk Apps:

  • An App is a packaged collection of functionality built for a specific purpose.

  • It typically contains searches, reports, dashboards, visualizations, and specific configurations.

• Apps versus Add-ons:

  • App: Primarily helps users work with and analyze data.

  • Add-on: Primarily assists in the collection, parsing, normalization, or preparation of data. Note that advanced add-on development is generally outside the scope of the Core User exam.

• Customizable User Settings:

  • Users can adjust preferences for Time zone, Default app (the app that opens upon login), Search preferences, and Display preferences.

Basic Splunk Navigation

• Interface Components:

  • Home page: The landing page for Splunk Web.

  • Apps: The menu or area to access installed applications.

  • Search & Reporting: The default app used for most search activities.

  • Search bar: Where SPL (Search Processing Language) queries are entered.

  • Time range picker: Tool to define the temporal boundaries of a search.

  • Fields sidebar: Located to the left of search results, showing Selected and Interesting fields.

  • Timeline: A visual histogram of event distribution over time.

  • Event results: The list of events returned by a search.

  • Search job controls: Tools to manage the execution of a search (e.g., pause, stop).

Basic Searching Concepts ($22\%$ of exam material)

• Basic Search Syntax:

  • Keyword: Searching for a single word, such as $error$, returns events containing that term.

  • Index Search: Specifying the storage location with $index=main$.

  • Field Search: Targeting a specific attribute, such as $status=404$.

  • Combined Criteria: To search multiple fields simultaneously, use $index=main\ host=server01\ user=cory$.

• Boolean Operators:

  • AND: Used when both conditions must be true (e.g., $status=failed\ AND\ user=cory$). Note: AND is implied between search terms if not explicitly written.

  • OR: Used when either condition can match (e.g., $status=404\ OR\ status=500$).

  • NOT: Used to exclude results that match a criteria (e.g., $NOT\ status=200$).

• Wildcards and Phrases:

  • Wildcards: The $*$ character matches any number of characters. For example, $host=web*$ matches $web01$, $web02$, and $webserver$.

  • Search Phrases: Quoted strings are required to search for a specific multi-word phrase, such as $"failed\ password"$.

Time Range Management

• Time Range Principles:

  • Searches only return events within the selected window. If an event happened yesterday but the search is set to "Last $15$ minutes," the event will not appear.

  • Relative Time Modifiers:

    • $-15m$: $15$ minutes ago.

    • $-1h$: $1$ hour ago.

    • $-24h$: $24$ hours ago.

    • $-7d$: $7$ days ago.

    • $now$: Represents the current time.

  • Earliest and Latest: These define the search period boundaries. $earliest=-24h\ latest=now$ searches the previous $24$ hours up to current time.

Identifying Search Results and Event Details

• Event Components:

  • Timestamp: The date and time the event occurred.

  • Raw event: The original, unformatted machine data.

  • Fields / Values: Key-value pairs extracted from the data, such as $host=server01$, $user=cory$, and $action=failed$.

  • Source: The specific file or input source (e.g., $/var/log/auth.log$).

  • Sourcetype: The data format (e.g., $sourcetype=access_combined$).

• Timeline Analysis:

  • The timeline shows event distribution and volume spikes.

  • Spikes might indicate attack activity, system problems, sudden high traffic, or application errors.

• Search Jobs:

  • A search job is the process of executing a query.

  • Controls include Start, Pause, Stop/cancel, and progress monitoring.

  • Results can be saved for future use or exported to various formats.

Using Fields in Searches ($20\%$ of exam material)

• Field Definitions:

  • A field is a named piece of information (e.g., $user$, $host$, $status$).

  • A value is the data assigned to that field (e.g., $cory$, $server01$, $failed$).

• The Four Critical Metadata Fields:

  • index: Defines where the data is stored.

  • host: Defines the system associated with the data.

  • source: Defines where the data input originated (path or source).

  • sourcetype: Defines the type or format of the data.

• Fields Sidebar Categories:

  • Selected Fields: Fields currently displayed in the event list.

  • Interesting Fields: Fields present in at least $20\%$ of the resulting events that Splunk suggests may be relevant.

• Comparison Operators:

  • $=$ (equals)

  • $!=$ (does not equal)

  • > (greater than)

  • < (less than)

  • >= (greater than or equal to)

  • <= (less than or equal to)

Search Processing Language (SPL) Fundamentals ($15\%$ of exam material)

• The Pipe Character ($|$):

  • This character is used to pass the results from the previous command to the next command. The flow follows: Search $\rightarrow$ $|$ $\rightarrow$ Command.

• The Search Pipeline:

  • A typical pipeline order: $index=main\ |\ stats\ count\ by\ user\ |\ sort\ -count$.

  1. $index=main$: Find the raw data.

  2. $stats\ count\ by\ user$: Calculate counts per user.

  3. $sort\ -count$: Sort results by the count in descending order.

• Essential SPL Commands:

  • $table$: Renders specific fields in a tabular format (e.g., $|\ table\ user\ host\ status$).

  • $fields$: Specifically includes or excludes fields from the results (e.g., $|\ fields\ user\ host$).

  • $rename$: Changes a field label (e.g., $|\ rename\ user\ AS\ username$).

  • $dedup$: Removes duplicate events based on a field (e.g., $|\ dedup\ user$).

  • $sort$: Orders results. Use a minus sign ($-$) after sort for descending orders (e.g., $|\ sort\ -count$).

Basic Transforming Commands ($15\%$ of exam material)

• top: Finds the most frequent/common values (e.g., $|\ top\ user$).

• rare: Finds the least frequent/common values (e.g., $|\ rare\ user$).

• stats functions:

  • $count$: Number of events.

  • $sum(field)$: Adds values of a numerical field.

  • $avg(field)$: Calculates the mean.

  • $min(field)$: Finds the smallest value.

  • $max(field)$: Finds the largest value.

  • $dc(field)$: Calculates the distinct count (the number of unique values).

Reports, Dashboards, and Visualizations ($12\%$ of exam material)

• Reports:

  • A report is essentially a saved search. It is reusable and can serve as the source for visualizations.

• Statistical Reports:

  • These present data in table form, such as listing a column for "User" and a column for "Count" (e.g., cory: $150$, alex: $82$, john: $40$).

• Visualizations:

  • Single value: Best for total metrics (e.g., Total alerts = $150$).

  • Line chart: Best for viewing events over a temporal trend.

  • Bar chart: Best for comparing categories (e.g., Events by user).

  • Other options include Column, Pie, and Area charts.

• Dashboards:

  • A dashboard is a compiled collection of panels. Each panel displays information from a search or report, providing a comprehensive overview of system status (e.g., showing failed logins, successful logins, and malware alerts simultaneously).

Data Lookups ($6\%$ of exam material)

• Lookups:

  • A lookup enriches internal results with external data. For instance, matching an IP address from a log ($10.10.10.50$) against a CSV file to add a $department$ field (e.g., $Finance$).

  • Lookup File: The physical data storage, commonly a CSV with rows and columns including field names.

  • Lookup Definition: The configuration within Splunk that tells the system how to interpret and use the lookup file.

• Automatic Lookups:

  • These are configured to automatically append external data to search results whenever a matching field (like an IP or Username) is present in the search.

• Lookup Syntax:

  • $|\ lookup\ users.csv\ username\ OUTPUT\ department$ matches the $username$ field and adds a $department$ field to the results.

Scheduled Reports and Alerts ($5\%$ of exam material)

• Scheduled Reports:

  • Saved searches that run autonomously on a set frequency (every $5$ minutes, every hour, day, or week). At a specific start time, the search runs for a specified time range and generates a report.

• Alerts:

  • Alerts trigger when specific search conditions are met (e.g., Failed\ logins\ >\ 10).

  • Conditions: Can be based on whether any result is returned, if the number of results exceeds a threshold, or if results meet specific secondary criteria.

  • Actions: Alerts can trigger emails, system notifications, or other pre-configured actions.

  • Fired Alerts: Previous alert triggers can be reviewed to identify when they fired and what specific results caused the trigger.

Search Optimization Principles

• Specifying the Index: Searching $index=security\ failed$ is significantly faster than just searching $failed$ because it limits the data blocks the Indexer must scan.

• Time Range Selection: Searching "Last $15$ minutes" is more efficient than searching "All time" if that specific window is all that is required.

• Narrows Early: Filtering criteria like $host=server01$ should be added as early as possible in the search string to reduce the volume of data passed through the pipeline.

Knowledge Objects Distinction

• Core Certified User Focus: Reusable objects including Reports, Alerts, Dashboards, and Lookups.

• Power User Focus: Advanced objects such as Tags, Event Types, Workflow Actions, Data Models, Field Aliases, Calculated Fields, and Macros. These are separate from the Core User requirements.