Learning Splunk - Using Fields

The video tutorial covers the use of fields in Splunk, including selected, interesting, and all fields. It explains how to adjust time ranges for searches, the impact of real-time searches on CPU usage, and how to filter search results using the timeline. The tutorial also discusses field types, case sensitivity, and advanced filtering techniques. Additionally, it demonstrates the use of CIDR notation and wildcards for efficient searching.

What are the default fields present in every Splunk event?

• IP, port, and protocol

• command, session, and log

• user, action, and process

• host, source, and source type

What is the default time range for searches in Splunk?

• Last 7 days

• All time

• Last 15 minutes

• Last 24 hours

Why should real-time searches be avoided in Splunk?

• They are not accurate

• They consume a lot of CPU resources

• They do not update in real-time

• They are difficult to configure

What happens when you run a real-time search in Splunk?

• It shows historical data

• It updates as new data comes in

• It only shows data from the last hour

• It does not display any data

How can you add a term to a search in Splunk?

• By exporting the data

• By using a command line

• By clicking on the term in the event

• By typing it manually

What is the significance of case sensitivity in Splunk field names?

• It affects the search results

• It has no significance

• It only matters for numeric fields

• It is important for date fields

What can you use to filter results based on time in Splunk?

• The command line

• The export function

• The timeline

• The settings menu

What are interesting fields in Splunk?

• Fields selected by the user

• Fields present in at least 20% of events

• Fields that are not indexed

• Fields present in all events

How can you search for a network range in Splunk?

• Using CIDR notation

• Using a wildcard at the start

• Using a specific IP address

• Using a port number

What is a potential downside of using wildcards at the beginning of a value in Splunk searches?

• It is not supported by Splunk

• It makes the search faster

• It provides more accurate results

• It is an inefficient way to search