topic Re: if no events in Getting Data In

if no events

kimmyb — Mon, 26 Sep 2022 06:26:30 GMT

when i was learning splunk i encountered following question:

analyze following SPL query
* | outputlookup my dummy.cvs
if no events were generated for the query, choose the appropriate option

available answers :

a.at least one event needs to be created to add results to mydummy
b.my dummy .cvs will be created but the file will be empty
c.outputlook cannot be used for queries which generate 0 results
d. my dummy.cvs should be created before events can be added
e. my dummy.cvs will be created

im doubting between C or D , or am i totally wrong ?

Re: if no events

gcusello — Mon, 26 Sep 2022 06:32:59 GMT

Hi @kimmyb,

usually isn't correct to answer in Community to an examination question!

Anyway in my opinion, you're totally wrong!

Ciao.

Giuseppe

Re: if no events

chaker — Mon, 26 Sep 2022 06:33:25 GMT

Hi @kimmyb ,

The best way to learn is to try it for yourself in your own Splunk test environment. You can test this on the free license or sales trial.

Make a query that generates no results:

index=bunk sourcetype=bunk | outputlookup my dummy.cvs

Then use inputlookup. If the csv does not exist, you will get an error message.

| inputlookup dummy.cvs

Re: if no events

kimmyb — Mon, 26 Sep 2022 06:41:22 GMT

it was not in an exam, just in between my learnings

Re: if no events

kimmyb — Mon, 26 Sep 2022 06:43:25 GMT

problem is , i cant install on my work pc, no admin rights
so for me i can t put theory into practise 😞

So thats why im following all sorts of learnings on splunk in order to get to now more about it.

Re: if no events

gcusello — Mon, 26 Sep 2022 06:46:16 GMT

Hi @kimmyb,

in this case you have a problem: you need an environemt for your tests and practice.

Eventually ask to your company to have a cloud environment to install yur Splunk, otherwise it will be very difficoult (or probably an impossible mission!) for you!

Ciao.

Giuseppe

Re: if no events

kimmyb — Mon, 26 Sep 2022 06:47:58 GMT

indeed 😞
all the theory seperate look ok but putting it in large picture without test env indeed is difficult