1
Q
Lookup
A
Outside non-event data added to an index to provide supporting info/context
(Dataset)
2
Q
Two steps to setup a lookup
A
Upload lookup file (CSV)
Define lookup type
3
Q
Lookup command
A
inputlookup
4
Q
Lookups are assigned to which apps?
A
Only the one imported to or with permissions.
5
Q
Output clause
A
Choose which fields lookup returns
(New fields)
6
Q
outputnew clause
A
Prevents overwriting existing fields
7
Q
inputlookup command
A
Load results from static lookup
Works on file and imported definition {values}
8
Q
Time-based lookups
A
Can be created if a field contains a timestamp
Splunk Fundamentals 1
flashcards
Decks in class (14)
# Cards
-
Module 1: Machine Data3
-
Module 2: What is Splunk?13
-
Module 3: Installing Splunk6
-
Module 4: Getting Data In5
-
Module 5: Basic Searching18
-
Module 6: Using Fields8
-
Module 7: Best Practices5
-
Module 8: SPL Fundamentals16
-
Module 9: Transforming Commands11
-
Module 10: Reports and Dashboards6
-
Module 11: Pivots and Datasets6
-
Module 12: Lookups8
-
Module 13: Scheduled Reports and Alerts9
-
RFI4
