Splunk Core Certified User: key terms

Flashcards for this exam Splunk Core Certified User guide

• Field ExtractionThe process of identifying and pulling named fields out of raw event data, at index time or search time.Intermediate
• LookupA Splunk knowledge object that enriches events by matching field values against an external table or source.Intermediate
• SourcetypeA Splunk field that identifies the format of data, determining how it is parsed and how fields are extracted.Foundational
• Splunk IndexA repository in Splunk where ingested data is stored and from which searches retrieve events.Foundational
• Splunk Search Processing LanguageThe query language used in Splunk to search, filter, transform and visualize machine data.Foundational
• Splunk Universal Forwarder (UF)A lightweight Splunk agent that collects data from hosts and sends it to indexers or heavy forwarders.Intermediate
• stats CommandAn SPL transforming command that calculates aggregate statistics such as count, sum, average and distinct count, grouped by fields.Foundational