Intro to knowledge objects
Fields – when a search is made the fields are displayed. This helps in narrowing the data which contains only that specific field/keyword. the events,
All the fields can be found in the field side bar, on hover and clicking on the fields specifically, it can be added to the search.
Field extractions
field aliases – normalize data to provide a normal name if the current name is like another field or common!
calculated fields – perform calculations based on existing fields.
lookups – sources like csv can be configured to additional fields and events in search
Event types – same combination over and over- save the search as event type to categorize the data
Tags – key value pairs can be made into tags, can be used in search as event type
note: event types and tags can be also noted in the field side bar
Workflow Actions – interact with external resources to narrow the searches, http get and post to external sources and back to Splunk for secondary searches.
Reports – Repeated search can be saved as reports
Alerts – to receive a notification, search can be saved as alerts
both are used for scheduling
Macros – similar or more complicated syntax – can store entire search strings including commands,
Data models – data sets can be events, can be used in pivot
Name ur objects using Six segmented keys
- Group
- type
- platform
- category
- time
- Description
Primary type of knowledge objects
permissions lay a key role in creating and sharing KO,
- private –
- Specific App
- All apps
When a user creates a ko, it automatically private and only available to that user,
when a power user or admin creates a Ko, it is shared across all users, and has control on other roles by hide/give permissions
only admin has access to allow ko to access across all apps, can edit permissions, can read or edit private objects created by anyone.
Admin can only reassign a ko to user- when the user leaves the org but has knowledge.
- Primary functions of workflow actions? interact with external resources to narrow the searches
- which knowledge objects can have an eval expression? calculated fields
- Which knowledge object can communicate to external sources using the HTTP GET and POST methods? workflow actions
- knowledge objects to be scheduled and executed at specific times? alerts/reports
- By default, what user role is required to make a knowledge object available to all apps? any user
- Where can you find the list of fields returned from events? fields sidebar
- When a user has left the organization, what haens to the knowledge objects? admin can edit the permission, user level info
- which kind of knowledge objects can be searched in pivot? data models
- Which are used to manually extract the fields? regex, delimiters like commas, spaces.
- Which of the knowledge objects can contain eval? calculated fields? macros?
- Which of the user roles can create knowledge objects? Power user, admin, user
- When a ko is crated wo can access its contents? user created and admin
- Which of the types can be uploaded to create a lookup? csv
- What are the three predefined sharing options for a knowledge object? private, shared in all apps, shared in app
- which knowledge object type can store entire search strings including commands? macros