SPLK-1002 Practice Questions

Event types are custom categories of events that are based on search criteria. Event types can be

used to label events with meaningful names, such as error, success, login, logout, etc. Event types

can also be used to create transactions, alerts, reports, dashboards, etc. Event types can be created

in two ways:

By going to the Settings menu and clicking Event Types > New. This will open a form where you can

enter the name, description, search string, app context, and tags for the event type.

By selecting an event in search results and clicking Event Actions > Build Event Type. This will open a

dialog box where you can enter the name and description for the event type. The search string will

be automatically populated based on the selected event.

Event types cannot be created by using the searchtypes command in the search bar, as this command

does not exist in Splunk. Event types can also be created by editing the event_type stanza in the

transforms.conf file, not the props.conf file.

Reference: https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html

The stats command is faster and more efficient than the transaction command, especially in large

environments. The stats command is used to calculate summary statistics on the events, such as

count, sum, average, etc. The stats command can group events by one or more fields or by time

buckets. The stats command does not create new events from groups of events, but rather creates

new fields with statistical values. The transaction command is used to group events into transactions

based on some common characteristics, such as fields, time, or both. The transaction command

creates new events from groups of events that share one or more fields. The transaction command

also creates some additional fields for each transaction, such as duration, eventcount, startime, etc.

The transaction command is slower and more resource-intensive than the stats command because it

has to process more data and create more events and fields.

An event type in Splunk is defined by a search string that returns a specific set of events. The search

string index=games sourcetype=score player=* score>9999 is valid because it filters events based on

specific criteria directly within the main search command. This search will find all events in the

games index with a sourcetype of score, where the player field exists, and the score is greater than

9999. This specificity and direct filtering make it suitable for defining an event type.

Reference:

Splunk Docs: Create event types

Splunk Answers: Defining event types

Search workflow actions are custom actions that run a search when you click on a field value in your

search results. Search workflow actions can be configured with various options, such as label name,

search string, time range, app context, etc. One of the options is to define the time range of the

search when creating the workflow action. You can choose from predefined time ranges, such as Last

24 hours, Last 7 days, etc., or specify a custom time range using relative or absolute time modifiers.

Search workflow actions do not run as real-time searches by default, but rather use the same time

range as the original search unless specified otherwise. Search workflow actions cannot be

configured as scheduled searches, as they are only triggered by user interaction. Search workflow

actions can be configured with any valid search string that includes any search command, such as

transaction.

The relationship between data models and pivots is that data models provide the datasets for pivots.

Data models are collections of datasets that represent your data in a structured and hierarchical way.

Data models define how your data is organized into objects and fields. Pivots are user interfaces that

allow you to create data visualizations that present different aspects of a data model. Pivots let you

select options from menus and forms to create charts, tables, maps, etc., without writing any SPL

code. Pivots use datasets from data models as their source of data. Pivots and data models are not

the same thing, as pivots are tools for visualizing data models. Pivots do not provide datasets for data

models, but rather use them as inputs.

Therefore, only statement A is true about the relationship between data models and pivots.

A chart is a graphical representation of your search results that shows the relationship between two

or more fields2. You can display a chart in stack mode by changing the Stack Mode option in the

Format menu2. Stack mode allows you to stack multiple series on top of each other in a chart to

show the cumulative values of each series2. Therefore, option C is correct, while options A, B and D

are incorrect because they are not ways to display a chart in stack mode.

POST workflow actions are custom actions that send a POST request to a web server when you click

on a field value in your search results. POST workflow actions can be configured with various options,

such as label name, base URL, URI parameters, post arguments, app context, etc. One of the options

that are required to create a POST workflow action is post arguments. Post arguments are key-value

pairs that are sent in the body of the POST request to provide additional information to the web

server. Post arguments can include field values from your data by using dollar signs around the field

names.

:

The following statements about tags are true: tags are based on field/value pairs and tags categorize

events based on a search. Tags are custom labels that can be applied to fields or field values to

provide additional context or meaning for your data. Tags can be used to filter or analyze your data

based on common concepts or themes. Tags can be created by using various methods, such as search

commands, configuration files, user interfaces, etc. Some of the characteristics of tags are:

Tags are based on field/value pairs: This means that tags are associated with a specific field name and

a specific field value. For example, you can create a tag called “alert” for the field name “status” and

the field value “critical”. This means that only events that have status=critical will have the “alert” tag

applied to them.

Tags categorize events based on a search: This means that tags are defined by a search string that

matches the events that you want to tag. For example, you can create a tag called “web” for the

search string sourcetype=access_combined. This means that only events that match the search string

sourcetype=access_combined will have the “web” tag applied to them.

The following statements about tags are false: tags are case-insensitive and tags are designed to

make data more understandable. Tags are case-sensitive and tags are designed to make data more

searchable. Tags are case-sensitive: This means that tags must match the exact case of the field name

and field value that they are associated with. For example, if you create a tag called “alert” for the

field name “status” and the field value “critical”, it will not apply to events that have status=CRITICAL

or Status=critical. Tags are designed to make data more searchable: This means that tags can help

you find relevant events or patterns in your data by using common concepts or themes. For example,

if you create a tag called “web” for the search string sourcetype=access_combined, you can use

tag=web to find all events related to web activity.

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Eval

The eval command calculates an expression and puts the resulting value into a search results field.

If the field name that you specify does not match a field in the output, a new field is added to the

search results.

If the field name that you specify matches a field name that already exists in the search results, the

results of the eval expression overwrite the values in that field.