Pass Your Splunk SPLK-1001 Exam Easy!

Splunk SPLK-1001 Splunk Core Certified User exam dumps vce, practice test questions, study guide & video training course to study and pass quickly and easily. Splunk SPLK-1001 Splunk Core Certified User exam dumps & practice test questions and answers. You need avanset vce exam simulator in order to study the Splunk SPLK-1001 certification exam dumps & Splunk SPLK-1001 practice test questions in vce format.

Searching and Reporting

1. The Search App

Welcome to this segment and this section. In this short video, I want to explore the SPLANC Search and Reporting app. This app comes preinstalled with Splunk Enterprise, and you can access it very easily from the Splunk homepage by simply clicking on Search and Reporting. Now recall that apps that have graphical user interfaces will appear in our app browser on the sidebar here. So search and reporting do have a graphical user interface. And the first thing I want to do is explore the landing page of the search app. We have a search bar where we type in our SPL Spunk processing language. We have our time picker, we have our search mode picker, we have smart mode, fast mode, and verbose mode, and we'll talk more about that in a later lecture. We have our data summary, and we've seen this a few times already before.This shows us all of the data that is coming into our Splunk instance and the metadata for it. So here's the host metadata, the sources metadata, and the source types metadata. We also have quick links to the Splunk documentation and a Splunk tutorial. And one of the great features of Splunk is that you can click here on "expand your search history" and see every search you've ever done here.I have more than nine pages of searches. So if you put together a really complex, really powerful search and you accidentally lose it, it will be stored here as long as you've actually used it as a search. Up at the top in the green bar, we have quick links to data sets, reports that we've created, alerts that we've created, and dashboards that we've created, and that is really all there is to the Flanc search app. And I thank you for joining me in this segment. I look forward to seeing you in the next segment.

2. The Search Pipeline

Welcome to this segment on the SPlanc search pipeline. It's important to understand how Splanc deals with the search string that you put in. And this has implications for the performance of Splunk as well. So let's get the basics down. And Splunk relies heavily on that Unix pipe operator. It's the key right above your Enter key on most US keyboards. This is a funny bumper sticker that Splunk sells on their website. It says Splunk. Put that in your pipe and Splunk it. Here's how the search pipeline looks at a very high level. We have a lot of data over on the left side and then just the data we want in the format we want over on the right side. A Splunk SPL search string is really a process of whittling down the data until you get exactly what you want and in the format that you want it. Let's take a look at a mock search. The big part of the data there on the left side might just be a broad metadata search. Host equals my host, source type equals CSV, and then we might include some keywords to sort of narrow it down. Perhaps we're only interested in failures, failures, or locked. Or if we have specific fields we're looking for, like user equals some username, we can narrow it down even further. Then we're doing a pipe. And a pipe really means to take all of the data before it on the left side and then do something with it. And this is where we enter our commands, common commands, account evaluation, and so on, and then we do another pipe, and this is where we create our visualisation or statistical table that displays the data we want in the format we want. It looking at a real search. And don't worry too much about the mechanics of the search as we will go over SPL in more depth in another lecture. But let's break this down. We have, first of all, source type = Win, event log security, event code = 4625, and user = Star. That's all before the first pipe. We're searching for a specific source type in event log security, that is, the security portion of the Windows event logs, event code 4625. If you look it up, you'll discover that it's a failed login attempt that Windows records, and then user equals asterisk. That really means that we want Splunk to pull in all of the users. We don't have a specific user in mind that we're searching for. And then we're finally building either a table or a visualization. In this case, we're doing a time chart. So we're building a line chart that spans, or in other words, it takes a sample of the data every hour, and we're counting by event code and by users. So that means that we want the time chart to display time on the x axis, and we want to know the users that are most in violation of generating that event code. In other words, we want to know the users that have the most failed login attempts. In other words, we're piping the previous data into that time chart command. We're using the span 1 hour statement, which means I'm forcing the chart to have 1 hour increments. And for that event code, I specifically searched for 4625. So it's only going to bring in that event code. If I did "event code equals star wildcard," then it would bring in all event codes. And here's what that time chart looks like: we have the count of failed logins by user, and Splunk builds us a nice line chart, and it colour codes all the users. And we can do other things with it too. You can say that we only want to know the top ten, or the rarest ten, users with the least number of failed login attempts. We can also just build a statistical table using the stats command instead of the time chart command. And it would look something like this where users on theleft side and then count is on the right side. And of course we could sort by count as well, including the default field of "_." Time will then allow us to make more sense of this data by putting a timestamp on each of the events. So here we're saying we want a statistical table, and we want the users listed and the number of failed logins, and we want our table with that table command. We're saying we want our table to show that the first field will be time, the second field will be user, and the third field will be the event code, and then we're going to sort by time. So this is a use case in which we would want to know the most recent time a user failed to logon and how many log-on attempts that user had. So putting that exact search back into our search pipeline, we can see that we're getting a lot of data up front. If you log security event code 4625 for every single user in a large organization, then there might be a lot of users. Then we're doing a pipe stats count, event code by user, and then time. And finally, we are visualising it with a table that has the timestamp, the user, and the count of event codes. And then we're sorting by time because we want to know the newest, most recent violation and how many violations there were. So that's just an example of the Splunksearch pipeline, and I hope you're really pumped to learn a little bit about SPL. We'll dive into basic SPL; we'll look at time; we'll look at the time chart; we'll do some intermediate SPL as well. So please stay away from me. I'm really excited about this.

3. Basic Searching

Welcome to the segment on basic searching. I have a feeling that this is what you've been waiting for. In this segment, we're going to talk about how to start creating your very first basic Splunk search string. And we'll start by learning what the basic search terms, or as I like to call them, building blocks, are. and they're built on keyword phrases. Field wildcards and boolean keywords are just what you would expect. Failed error phrases are multiple keywords, and we put phrases in quotes because they have a space in the middle. Fields are key-value pairs, so something equals something else. An example of a field would be user equals and then the username. We'll talk about fields in more detail later in the course. Wildcards are important to understand as well. Using the asterisk, what we are telling Splunk is that we don't care what takes the place of that asterisk. So if we use the first wild card thereasterisk A-I-L-E-D splunk will find failed or perhaps mailedor anything else that ends in a iled. If we use fail Asterisk, Splunk may return fail, failures, and the user may receive the same. If we use "user equals asterisk," that's telling Splunk that we want to pull in every single user. Boolean operators in Splunk are and and not, and they are case sensitive. An example of a boolean operator in a searchstring might be if we wanted to find dataabout two specific users, we might say user equalsuser one capital and user equals user two. Splunk would then only show us events that contained both of those users. Next we have commands. And commands do things with data. Our keywords and fields bring in the data, and then commands do stuff with it. Commands come after a pipe, as we'll see in just a second here. But some of the most basic and well-used commands are chart and time chart. This returns results as tabular output for charting and time. The x axis of the chart is forced to be time in chart, whereas in chart you define what the x axis should be. Rename is self-explanatory; sort is self explanatory.Stats provides statistics, and often you would use stats to build a statistical tabular table. We can use eval to calculate an expression dupe to remove duplicates. And the ever-popular table command builds a table with the specified fields that you specify. So if you do table space field one, space field two, and space field n, for example, Here is how we construct a basic search. The first thing we do is put in our search terms. These could be metadata like host source or source type, if we know what those are. Or we could use a wild card, of course, and let keywords and booleans and anything back in the basic search terms slide. Then we use that pipe operator key, which is the key right above your enter key on most US keyboards, and then we can start typing commands. This is how we massage the data. Don't be put off by that pipe operator. All that means for Splunk is to take whatever comes before it and then do something with it. So here's a mock search. If we have search terms like "host equals myhostlocal," and as we know, "host" is a metadata keyword that's automatically assigned and smoked unless we specify otherwise, and the same with source, And then we have user equals asterisk, which means we want to know information about all the users, and we have message equals fail asterisk, which means we are not sure if the message is fail, failure, failed, failures, or something like that. So we're just bringing everything that begins with fail and using a boolean operator or and lock asterisks, so that could be lock locked locks, I guess. So we're telling Splunk that we want to know every user, and we want the message to equal something that starts with fail or something that starts with lock, and that's different than if we did, and then the message would have to contain both fail and lock. But since we're doing either, the message can contain fail or lock. Next, we're doing some commands, and right at the start, we can see the popular table command, and then we simply list the fields that we want the table to have as columns. So we have underscore time, which is Splunk's default time field, and we'll talk more about time later. We have user, which we've pulled in with that user equals asterisk, so we have pulled in the user fields so it will display something there, and then message, and message will either contain fail or lock. And after the next pipe, we are renaming those fields because, let's say that underscore time, lowercase user, and lowercase message are not what we want to see. So we're saying rename underscore time as "time" with a capital T, user as "user" with a capital U, and message as "message" with a capital M, and then we do another pipe and we sort by the time field. So pause the video right now and see if you can come up with what the output of the search string is going to look like. Here is what it will look like. We have three fields: three-column time, user, and message. We have a timestamp, we have usernames, and we have the message that either contains fail or lock. Let's take a look at basic searching in our demo. We've logged into our Splunk search head, and what I want to do right now is add some new data. I want to add the homework data set as a CSV file. So I'm going to go to settings, add data upload, select file, and there it is: homeworkdataset CSV. It will upload it. We click next and check everything out on the source type. It is a CSV; it's pretty self-explanatory for Splunk. So we're good with that. On input settings, I want to name the host field value, and the index can stay at default. Review and submit, and let's go back home and to the search app. And since we specified that the host field value is homework, we can bring up this entire set of data just by using that metadata field. And there it is: 2000 rows, 2000 events. And this is bringing in everything. Now, because we are in smart mode, and we'll talk about modes in a different lecture, because we are in smart mode, Splunk attempts to detect fields for us based on key-value pairs. Remember, key value pairs are just like "thishost equals homework"; that's a key value pair. Source equals homework data in a CSV; that's also a key-value pair. So Slunk attempts to determine what fields are out there in the data automatically, which is great, and we can get a snapshot and take a quick look at these fields. So for example, a domain has five different values or five factors, and there they are. So in our mock search, let's say that we want to bring in the domain data. And let's say that we don't care which domain data it is because we just want to know the name of the domain because we want to use it later. So we'll simply do "domain equals" and let's run that search. And again, 2000 events, because every single event has that field in it. Let's see what other fields might be interesting to us. We have a tight field that has five different factors or five different values. Retry success. Lock and fail And NA. So let's imagine that we want to know about FAIL and LOCK, just like in the slide. So let's do a Boolean. and that field was called type. So we'll say type equalsfail asterisk or lock asterisk. Now this should narrow our total events down quite a bit. It cut our number of events by more than half. So we only have 949 now, because we're only looking for events that have this word or this word in them. So what can we do with this data right now? Well, we could create a table that shows the domain and the type. That would be pretty simple and pretty easy to do. So let's do that with a table command. And remember, for commands, we first do this pipe and then the command, and then the fields we want. The table command syntax is table space field one, space field two, space field n, right? So we want tables, domains, and types. Let's see what that gives us. This gives us a nice list of each domain and whether they pass or fail. But it still doesn't tell us a very good story because we need a timestamp. So recall that the default timestamp field in Splunk is underscore time, and we can simply add that to our table. So now we have a timestamp, a domain, and a type that's either fail or lock. That still doesn't really tell us everything we need to know. I think we would need to know what user account has failed or is locked. So let's go back to our raw events, and because we've already put a command in here, we actually need to change this to verbose mode and go back to our raw events, and let's see if there's a user field. There is a user field. It looks like it's USR, and those do look like usernames. So let's bring that in with a wild card, and then we'll also add it to our table, and it doesn't really matter where you put this. So bringing in all user values and let's putthe user field right before domain and let's seewhat that gives us in a table. Okay, this is a much better picture. We have a timestamp, a username, a domain, and whether the account is locked or has failed. In this section, we talked about basic search structure and put together a very basic search in Splunk. And I thank you for joining me, and I look forward to doing some more searching with you in the upcoming sections.

4. Dealing with Time

Dealing with time. Time is extremely important to understand in Splunk. You can imagine that if you had a bunch of events that you were investigating and they had no time stamps, it would be a very confusing ordeal because you could have data from as early as six years ago all the way up until the current time and it would be totally unorganized. Splunk defines a timestamp as being from the split second, and the link is at the bottom, and it is a default field that represents time information in an event. Most events contain timestamps. In cases where an event does not contain timestamp information, Splunk attempts to assign a timestamp value to the event at index time. The default time field for Splunk is underscore time. It's a Splunk-generated field, and it's added automatically based on patterns that Splunk attempts to recognise as time. And those patterns come from the raw event data. If there isn't an explicit time field, Splunk will try to guess which part of the data is representing time. And as a very last resort, Splunk will set the timestamp to the current system time. So there's no event left behind when it comes to time. That's how important time is. And for Splunk administrators, we can also see the importance of time in doing our SPL. Splunk uses the timestamp information for that time selector over on the right side of the search bar. And as you can see, we have a lot of presets. We have real time, which gives us, for example, a 32nd window, and it would refresh every 30 seconds. We have a relative who is self-explanatory, and we have unlimited time. I caution you to use all time because if you have a lot of data and you tell Splunk to search something throughout all time on that data, it could go back as far as six years ago. And that's going to take Splunk a long time to get you any results, and it's going to be extremely resource-intensive on whichever machine you are running the search on. So a good rule of thumb is to pick a reasonable time range for your SPL search. Sometimes time is not in the user-friendly format that we would like it to be in. Often it's in Unix format, which, if you've ever seen Unix format, takes a little bit of internal processing by the user to figure out what time is actually being displayed. Luckily, Splunk comes with a bunch of built-in time-conversion variables, and using the eval command combined with this strip time STR for time, we can change the default time format to one of our choosing. So here's how the eval command works in that scenario. It's after a pipe because it's a command. You use the keyword eval, then we name the new field. So in this case, I've just used time, but you could use timestamp or whatever you want really equals, then the keyword STRF time, then parentheses the original fill, which in this case is underscore time comma, and then inquotes the variables that represent the new format of the time that you want, which we'll look at on the next slide. Here are just some of the time variables that Splunk has built in for us, and they all start with percent signs. We have a capital H, which will display the hour in a 24-hour clock. We have capital I, which will do the same thing, but with a twelve-hour clock. We have capital M and capital S for minute and second, and we have a lowercase P that will display either AM or PM. And obviously, that works especially well with the capital I. We can also convert dates the way we want them. And of course, date variables also start with percent zones. And we have A in capitals for the full day. Name. Lowercase D displays the day of the month in number format with a leading zero, and lowercase E does the same thing without a leading zero. Capital B gives us the full month name. Lowercase B gives us an abbreviated month name. Lowercase M gives us month as a number, capital Y gives us a four-digit year, and lowercase Y gives us a two-digit year. Okay, pop quiz time. Suppose the time is 1 7 30 2 p. m. and we want to convert it, and we've used the strings on the left side of that table. And I want you to pause the video now and see if you can compute the output of that string based on the time above. Okay, are you ready for the big reveal? Capital I gives us the hourly and twelve-hour hour format.Capital M gives us the minute, and then that lowercase P gives us the Am or the P M stamp. and we can really put any marker in the middle, though. See, I have a colon there. You could have put a dash or whatever you wanted, really. The second is capital H and capital M, which gives us a 24-hour hour and a minute. The third one down just adds a capital S, which gives us the second. The fourth one down is only capitals, which would only display the seconds. The fifth one down is a lower case Palone, which would only display a M or PM. I don't imagine why you would want to use that, but you can, and the same is true for dates. So suppose the date is January 2017 at 10730 02:00 p.m., and we want to convert the date and time using those strings on the left. Go ahead and pause the video and see if you can compute the output. Okay, are you ready? That lowercase D will give us the day of the month; the capital B gives us the full month name. Capital Y gives us the four-digit year. Capital I gives us the twelve-hour hour, capital M gives us the minutes, and lowercase P puts an am or pm marker on it. On the second one down, capital H gives us the 24 hour marker, capital M gives us the minutes, lowercase B gives us the abbreviated month, and lowercase Y gives us the two-digit year. And on the third one down, this is something you probably wouldn't use. I cannot imagine a scenario when you would ever use alternating lowercase in capital Y, but you could theoretically do it, and the output would be two-digit year, four-digit year, two-digit year, four-digit year. So, let's take a look in our Splunk search head on 17, 2017; 17, 2017. And using our homework data, let's take a look at how to deal with time. Here we are in our Splunk search header. Let's bring in our homework data. And remember, we could either do host-equals homework or we can click on Data Summary and simply choose homework. And I'm comfortable leaving this up at all times because I know there are only 2000 events, so it should populate pretty quickly. And here we go. Let's look at the first event, and we'll look at the raw event data, which is here at the top. And it was very easy for Splunk to pick out the time because I included time as one of the fields in the homework data. And here is where time has been assigned, and this is a Unix timestamp. So let's create a simple table with a simple scenario that's going to have a timestamp and a username. So maybe in this hypothetical situation, we want to know when a user attempted to access our system. So we'll do the pipe, and then the keyword table will underscore the time user. But we have to include "user equals asterisk" because we want to include all users. And let's run that. And now we have a timestamp, and the timestamp looks okay. I mean, people could probably figure out the date and the time there, but let's say that that is not sufficient. Let's play around with the time here. So remember, in between these two pipes, we're going to do an eval statement, and let's call our field timestamp equals comma and then, in quotes, the time variables that we want to include. So let's say we want twelve-hour time, a colon, and the minute. And for right now, let's say we don't care about anything else, and we'll change this underscore timefield to our new field, which is time stamp. And of course, we have to include the stride time command. Now we see the twelve-hour hour marker and the minute marker, and then our associated user. And we probably also want to see the A or P marker. And there it is. Now let's also bring in the date, and maybe we'll put it before the time information. Let's do a lowercase D and a capital B and a comma. Now, what's that going to bring up for us? Lowercase D will give us the day of the month. Capital B will give us the full month name. Then we put a comma in there. Now, just for fun, let's try my little crazytime variable evaluation that I showed you in the slides where you simply alternated year formats. And there is that weird timestamp that doesn't really mean anything there. Those are the basics of how you deal with time in Splunk. I really appreciate you joining me in this section, and I look forward to seeing you next time.

5. Search Modes, Fields, and Field Discovery

Welcome back and welcome to searchmodes, fields, and field discovery. As we've seen before, the search app has three modes, and you can select the mode right under the time picker in the search bar. Splunk has fast mode, smart mode, and verbose mode. In Fast Mode, no fields are discovered except the default three metadata fields that we talked about. And Splunk assumes that you know which fields you want and have specified them in the search string. If you use fast mode, obviously fast mode is fast because you're doing the work of specifying the fields instead of Splunk's engine trying to figure out what the fields are. Smart Mode attempts to return the best results for whatever search you're running. It attempts to detect and return interesting fields. And verbose mode uses the Splunk engine to detect and return all the fields. Verbose mode is slow, but if you're not sure which fields you will want to report on if the data set is, for example, unfamiliar to you, choose this mode. Okay, so in Smart Mode and Verbose Mode, I said that Splank uses the Splanx engine to discover fields. Well, how does that actually happen? During field discovery, Splank detects fields that are key-value pairs. That's what a field is. In Splunk, key equals value, soerror equals failed level equals critical. Those would be examples of fields with errors equaling anything, and then anything that would be an example of a field. Anything equals anything. That's an example of a field as well. Notice how the first 50 key value pairs are displayed in the field browser on the left hand side. And then it has a little drop-down that says "Show more fields" if more are available. But one of the main points of this class was that Splunk can also deal with unstructured data where things are not always in nice key-value pairs. And what if that happens? What if the data is a bunch of, well, this data is, I would say, semi-structured, but what if there are key-value pairs? What if there are fields in this data, for example, that you want to extract but that are not in nice, neat key-value pairs? Well, Splunk has a very powerful and very useful field extraction tool, and it's pretty easy to use. The engine behind it works using regular expressions. However, Splunk has some tools built in to help you, because regular expressions are kind of a pain to write and not everybody knows how to use regular expressions.And of course, it's beyond the scope of this class. But I will show you how to use the built-in tools with Splunk in our demo. Let's go to the search app, and let's bring in our homework data. We can enter host = homework. Or we could click on the data summary button, like I've just done, and click "homework." We could also just type "host" plus "homework.That is the host name value we assigned to that data the first time we imported it. Notice it is a key-value pair. Host is a metadata type for Splunk. So Splunk always brings in these three selected fields: host, source, and source type. That is default Splunk metadata. And here are our search modes over here. Right now it is in verbose mode because I've only specified a host. So Splunk is thinking this person doesn't know what fields are in this data. So I better go in Verbose Mode and try to figure out all the fields that are available. And here we are in the first 50 listed here, and one more is available. And let's say that none of these fields that Splunk has found in verbose mode is a field that we want. So we can go and extract new fields. and this will bring us to the Splunk field. Extraction tools. And if you're really good with regular expressions, you can write the regular expression yourself. But the first thing we need to do is select a sample. So let's select an event in our data that has the field we want. And let's just say, for example, it's this. And now Splunk shows us the event data, and we'll click Next, and we'll select Method. Now, either one of these would work since this is a CSV file. It's still nicely laid out with the comma separation. So we could use delimiters, where Splunk automatically attempts to extract the fields and you can specify which fields are which. But I want to show you this regular expression method because it does a lot better with unstructured data. So click on "Regular Expression." And then next, it says to highlight one or more values in the sample data to create fields. So let us say that this value right here is a field that we want to keep track of and the field that we want to use in our search. But it doesn't have a key-value pair, so Splunk didn't detect it, and it's just a random numerical value. But let's say that it's important to us. So we'll highlight it, and Smunk will ask for a fieldname, and let's say that it is a system ID. Now it says to look through the data and verify that the right fields have been extracted, and Splunk has actually written a regular expression behind the scenes. And let's click Next, and we'll validate this. Everything looks good. If Splunk has detected something that was not whatwe meant to extract, we can just simply clickthe X there and it's sort of teaching Splunk. We'll validate it, and we'll name the extraction. I don't really care what it's called, so I'm going to leave the default and we'll set permissions. Unless there is a specific reason for restricting access, I prefer to set all apps. And we'll click "Finish," and we'll click "Explore the fields I just created." And instead of this auto-generated search that Splunk has given us, let's go back to host equalshomework and notice that now this field system ID is detected, and it is those numerical values. So now we can use that field in our search, and we'll bring in all the system IDs, and let's make a simple table with system ID and maybe state. Now we can know which systems are in what state. Now splunk state is in verbose mode, but we could actually do fast mode on this since we've specified the fields we want and we've created a table with them. Fills and filled extractions are extremely powerful in Splunk, and the good news is they're not hard to learn or to use. So I thank you for joining me in this segment, and I look forward to seeing you next time.

Go to testing centre with ease on our mind when you use Splunk SPLK-1001 vce exam dumps, practice test questions and answers. Splunk SPLK-1001 Splunk Core Certified User certification practice test questions and answers, study guide, exam dumps and video training course in vce format to help you study with ease. Prepare with confidence and study using Splunk SPLK-1001 exam dumps & practice test questions and answers vce from ExamCollection.