Splunk Core Certified User flashcards
Splunk Core Certified User · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Universal Forwarder
- A lightweight Splunk component that collects data and sends it to indexers or another forwarder; it cannot index data, perform index-time parsing, or host a web interface.
- Heavy Forwarder
- A full Splunk Enterprise instance used mainly to collect and forward data; it can parse, filter, route, and run scripted inputs, and includes Splunk Web.
- Indexer
- The Splunk component that receives data, parses it into events, and writes those events to disk as time-based buckets that searches read from.
- Search head
- The Splunk component that hosts the search interface, dispatches searches to indexers, and merges the returned results for display to the user.
- Bucket lifecycle
- Indexed data moves from hot to warm to cold to frozen buckets as it ages; frozen buckets are deleted by default unless archiving is configured.
- Default ports 8000, 8089, 9997
- Port 8000 serves Splunk Web, port 8089 handles management and REST calls to splunkd, and port 9997 receives forwarded data over the Splunk-to-Splunk protocol.
- inputs.conf and outputs.conf
- inputs.conf on a forwarder defines which files, ports, or scripts it collects from; outputs.conf defines which indexers it sends that data to.
- Splunk Web default URL
- Splunk Web listens on port 8000, so the interface is reached at http://<hostname>:8000 using the administrator account created during installation.
- Smart, Fast, Verbose modes
- Search modes that trade speed for detail. Smart is the default and adapts to result size, Fast skips field discovery, and Verbose returns all field data.
- Time range picker
- The control beside the search bar that limits a search to a window such as Last 24 hours; changing the selection re-runs the search over the new window.
- Apps menu
- The menu that lists installed Splunk apps and switches between them; each app groups its own dashboards, saved searches, and configuration objects.
- Timeline
- The bar chart beneath the search bar showing event counts over time; clicking a bar or dragging across a region changes the search time range.
- Settings menu
- The administrative area of Splunk Web containing users and roles, data inputs, indexes, lookups, field extractions, calculated fields, and server settings.
- Implicit AND in searches
- Terms separated by spaces are combined with AND, so every term must be present; use OR to accept either term and NOT to exclude one.
- Boolean operator precedence
- In Splunk searches NOT binds tightest, then OR, then AND; parentheses must be used to force a different evaluation order.
- field=value syntax
- Matches events where the field exactly equals the value; quote values containing spaces, and use field=* to require only that the field exists.
- Trailing wildcard rule
- The asterisk matches any string, but it is efficient mainly at the end of a value; leading wildcards are slow and generally avoided in searches.
- Pipe operator
- The pipe sends the current result set as input to the next search command, allowing commands such as stats or table to be chained together.
- Search-generating command required first
- A Splunk search must begin with a command that produces results, such as search or a data-retrieval command, before any pipe is used.
- Default fields
- host, source, sourcetype, index, _time, and _raw appear in every event without any configuration and are available to every search.
- Alias versus calculated field
- A field alias gives an existing field a second name without copying data; a calculated field uses an eval expression to create a new search-time field.
- Lookup
- A CSV file or KV store table used to add fields to events by matching a key field, applied with the lookup command or read directly with inputlookup.
- Automatic lookup
- A lookup configured for a sourcetype or host so events are enriched automatically, without adding a lookup command to each search.
- Macro
- A reusable block of search syntax saved as a knowledge object, invoked inside backticks within a search, and optionally defined to accept arguments.
- rex command
- A search-time command that extracts fields from raw event text using a regular expression with named capture groups such as (?<user>\w+).
- stats command
- Calculates aggregates over search results, for example | stats count, avg(bytes) BY host, producing one result row per unique by-field value.
- dc distinct count
- The dc() stats function counts unique values of a field, for example | stats dc(user) AS unique_users, ignoring duplicates in the result set.
- timechart command
- Creates a chart with _time on the x-axis and a statistical value on the y-axis; span sets the bucket size, such as span=1h.
- Scheduled alert
- A saved search that runs automatically on a cron schedule and performs actions such as sending email or calling a webhook when its condition is met.
- Alert throttling
- Suppresses alert actions for a configured time window, optionally scoped by field values, so the same condition does not fire repeatedly.
- Save As Report
- The Save As > Report option stores a search together with its formatting so it can be re-run later and added to dashboards as a panel.
- Dashboard panel
- A dashboard is a collection of panels, each showing a saved search result as a chart, table, single value, or map that refreshes from the search.