19.1 Splunk Dashboards and Visualizations

Question 1

Splunk uses the _______ feature to display specific values from search results in an easy-to-read spreadsheet.

Answer 1

Splunk uses the Statistics feature to display specific values from search results in an easy-to-read spreadsheet.

Question 2

The eval command is used to _________.

Answer 2

The eval command is used to design new fields or modify existing fields.

Question 3

Designing poor alerts can cause two types of issues: ______ and ________.

Answer 3

Designing poor alerts can cause two types of issues: false positives and false negatives.

• False positives occur when conditions are met and an alert is triggered, but the security situation being monitored did not actually occur.
• False negatives occur when the condition is met and an alert is not triggered, meaning the security situation occurred undetected.

Question 4

_______ is a method of looking at historical data to determine how much activity is considered “normal.”

Security professionals use baselining to determine a _______.

A _______ is the condition or level that, when met, triggers an alert.

Answer 4

Baselining is a method of looking at historical data to determine how much activity is considered “normal.”

Security professionals use baselining to determine a threshold.

A threshold is the condition or level that, when met, triggers an alert.

Question 5

________ are similar to the RPM dial found in the dashboard of a car.

Answer 5

**Radial gauges** are similar to the RPM dial found in the dashboard of a car.

Question 6

Splunk can create location-specific reports with the ______ and ______ commands.

Answer 6

Splunk can create location-specific reports with the iplocation and geostats commands.

Question 7

_______ are a collection of multiple visualizations in a single location.

The visualizations are placed in different sections, called ______.

Answer 7

**Dashboards** are a collection of multiple visualizations in a single location.

The visualizations are placed in different sections, called **panels**.

Question 8

Panels can contain: (4)

Answer 8

Panels can contain:

• Single value visualizations
• Multiple value visualizations
• Geographic maps
• Statistical charts