Learning Splunk - Hands-On Lab: Search Pipeline

The video tutorial guides users through a hands-on lab using Splunk to analyze network traffic. It involves creating a search to identify top TCP and UDP ports passing through a firewall over the last 15 minutes. Users are encouraged to experiment with different visualizations and limits to find the most effective representation of the data. The tutorial covers setting up the search in Splunk, exploring various visualization options, and saving the results as a report for future use in a dashboard. The next section will delve deeper into data visualization techniques using Splunk.

What is the primary task assigned in the first section of the tutorial?

• Develop a new firewall rule.

• Create a search for top TCP and UDP ports over the last 15 minutes.

• Install a new version of Splunk.

• Analyze the source ports of incoming connections.

Why is the destination port chosen for analysis in the Splunk interface?

• It is easier to analyze than the source port.

• It is the default setting in Splunk.

• It is the port that other machines connect to.

• It represents the port from which data is sent.

Which visualization type was initially found to be less effective?

• Column chart

• Bar chart

• Pie chart

• Line graph

What was the final visualization choice for the report?

• Column chart

• Line graph

• Scatter plot

• Pie chart

What is the next step after saving the report with the visualization?

• Export the report to a PDF

• Use the report in a dashboard

• Share the report with colleagues

• Delete the report