Topic 2: Questions Set 2
Which of the following searches would create a graph similar to the one below?
A. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states
B. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time
C. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status
D. None of these searches would generate a similart graph.
Explanation: The following search would create a graph similar to the one below:
index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status
maxspan=1d | timechart count by status
The search does the following:
It uses index_internal to specify the internal index that contains Splunk logs and
metrics.
It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates
the Splunk Enterprise Security app.
It uses fields sourcetype, status to keep only the sourcetype and status fields in
the events.
It uses transaction status maxspan=1d to group events into transactions based on
the status field with a maximum time span of one day between the first and last
events in a transaction.
It uses timechart count by status to create a time-based chart that shows the count
of transactions for each status value over time.
The graph shows the following:
It is a line graph with two lines, one yellow and one blue.
The x-axis is labeled with dates from Wed, Apr 4, 2018 to Tue, Apr 10, 2018.
The y-axis is labeled with numbers from 0 to 15.
The yellow line represents “shipped” and the blue line represents “success”.
The yellow line has a steady increase from 0 to 15, while the blue line has a sharp
increase from 0 to 5, then a decrease to 0, and then a sharp increase to 10.
The graph is titled “Type”.
A user runs the following search:
index—X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product,
action usenull=f useother—f
Which of the following table headers match the order this command creates?
A. The chart command does not allow for multiple statistical functions.
B. Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase
C. Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase
D. Count: product, sum: product, count: action, sum: action
Explanation:
The correct answer isC. Product, count: addtocart, count: remove, count: purchase, sum:
addtocart, sum: remove, sum: purchase1.
In Splunk, thechartcommand is used to create a table or a chart visualization from your
data2.Thechartcommand takes at least one function and one field, and optionally another
field to group by2.
In the given search, thechartcommand is used with two functions (countandsum), two fields
(domainandprice), and two fields to group by
(productandaction).Theusenull=fanduseother=foptions are used to exclude null values and
other values from the chart2.
Thechartcommand creates a table with headers that match the order of the fields and
functions in the command1.The headers for thecountfunction are prefixed withcount:, and
the headers for thesumfunction are prefixed withsum:1.The values of
theproductandactionfields are used as the suffixes for the headers1.
Therefore, the table headers created by this command areProduct,count: addtocart,count:
remove,count: purchase,sum: addtocart,sum: remove, andsum: purchase1.
These kinds of charts represent a series in a single bar with multiple sections
A. Multi-Series
B. Split-Series
C. Omit nulls
D. Stacked
Explanation: Stacked charts represent a series in a single bar with multiple sections. A chart is a graphical representation of data that shows trends, patterns, or comparisons. A chart can have different types, such as column, bar, line, area, pie, etc. A chart can also have different modes, such as split-series, multi-series, stacked, etc. A stacked chart is a type of chart that shows multiple series in a single bar or area with different sections for each series.
The gauge command:
A. creates a single-value visualization
B. allows you to set colored ranges for a single-value visualization
C. creates a radial gauge visualization
Which of the following searches would return a report of sales by product-name?
A. chart sales by product_name
B. chart sum(price) as sales by product_name
C. stats sum(price) as sales over product_name
D. timechart list(sales), values(product_name)
What field must be present in order to use the timechart command?
A. _raw
B. rime
C. _time
D. index
Explanation: The timechart command in Splunk requires the _time field to be present in the dataset because it uses time as the primary axis for charting data. The _time field represents the time of events and is essential for commands that generate visualizations based on time, such as timechart. This command groups the events into time intervals and performs statistical functions on those time intervals. Without the _time field, the timechart command will not function properly.
Page 8 out of 46 Pages |
Previous |