Indexer Clustering (Architecture and theory) Flashcards
How to change linux hostname?
hostnamectl set-hostname
What is the command to install splunk package?
rpm -ivh
Tell us the boot command
./splunk enable boot-start -systemd-managed 0 -user splunk –accept-license –auto-ports
How to make a component a license-slave of license-master?
./splunk edit licenser-localslave -master_uri https://:8089
or /etc/system/local/server.conf
[license]
master_uri = https://[ip]:8089
How to create an Indexer clustering?
- Configure CM
- Configure indexers and peer with CM
- Configure and connect SH to Cluster Master
How to configure an instance to become CM with a single command?
./splunk edit cluster-config -mode master -replication_factor 2 -search_factor 2 -secret -cluster_label
How to connect Indexers with a CM?
./splunk edit cluster-config -mode slave -master_uri https://:8089 -secret
How to validate that indexer is connected with CM?
tail -f splunkd.log
GUI of CM
How to validate that all peers are checking in to the CM?
./splunk list cluster-peers
How to connect SH to CM?
On search head: ./splunk edit cluster-config -mode searchhead -master_uri https://:8089 -replication_port 8080 -secret
How to configure component to become a deployment client?
./splunk set deploy-poll https://:8089
or edit
$SPLUNK_HOME/etc/system/local/deploymentclient.conf
How to configure given component to send internal logs to an indexer?
with outputs.conf:
[tcpout]
disabled = false
defaultGroup = studentXX-indexers
forwardedindex.filter.disable = true
indexAndForward = false
[tcpout:studentXX-indexers]
disabled = false
server = studentXX-idx01-ip:9997, studentXX-idx02-ip:9997, studentXX-idx03-ip:9997
Where can we change the splunk components name?
server.conf:
[general]
serverName = student01-CM01
How to Validate and push bundles to peers?
Validate CM bundle:
./splunk validate cluster-bundle –check-restart
Deploy apps from Master Node to Peer-nodes by applying the Cluster Bundle:
./splunk apply cluster-bundle
Validate that the bundle is valid:
./splunk show cluster-bundle-status
./splunk list cluster-config
What is Event Processing?
Event processing covers everything that happens to your data between the time you define an input and the time the data appears in the Splunk index.
During indexing, Splunk Enterprise performs event processing. It processes incoming data to enable fast search and analysis, storing the results in the index as events. While indexing, Splunk Enterprise enhances the data in various ways, including by:
Separating the datastream into individual, searchable events:
- Creating or identifying timestamps.
- Extracting fields such as host, source, and sourcetype.
- Performing user-defined actions on the incoming data, such as identifying custom fields, masking sensitive data, writing new or modified keys, applying breaking rules for multi-line events, filtering unwanted events, and routing events to specified indexes or servers.
What types of indexes we have?
Splunk Enterprise supports two types of indexes:
- Events indexes. Events indexes impose minimal structure and can accommodate any type of data, including metrics data. Events indexes are the default index type.
- Metrics indexes. Metrics indexes use a highly structured format to handle the higher volume and lower latency demands associated with metrics data. Putting metrics data into metrics indexes results in faster performance and less use of index storage, compared to putting the same data into events indexes. For information on the metrics format, see the Metrics manual. There are minimal differences in how indexers process and manage the two index types. Despite its name, event processing occurs in the same sequence for both events and metrics indexes. Metrics data is really just a highly structured kind of event data.
What is the events index?
Events indexes impose minimal structure and can accommodate any type of data, including metrics data. Events indexes are the default index type.
What is metrics index?
Metrics indexes use a highly structured format to handle the higher volume and lower latency demands associated with metrics data. Putting metrics data into metrics indexes results in faster performance and less use of index storage, compared to putting the same data into events indexes. For information on the metrics format, see the Metrics manual.
What is data pipeline?
The route that data takes through Splunk Enterprise, from its origin in sources such as log files and network feeds, to its transformation into searchable events that encapsulate valuable knowledge. The data pipeline includes these segments: Input Parsing Indexing Search
What are data’s pipeline segments?
Input Parsing Indexing Search
What is an indexed field?
A field that is incorporated into the index at index time. Indexed fields include the default fields, such as host, source, and sourcetype, as well as custom index-time field extractions. In rare cases, there is some value to adding fields to the index. However, this can negatively affect indexing performance and search times across your entire deployment. There is no way to modify or remove field extractions afterwards. You can add non-indexed fields, which are extracted at search time.
What is index time?
The time span from when Splunk Enterprise receives new data to when the data is written to a Splunk Enterprise index. During that time, the data is parsed into segments and events; default fields and timestamps are extracted; and transforms are applied.
What is search time?
Refers to the period of time beginning when a search is launched and ending when it finishes. During search time, certain types of event processing take place, such as search time field extraction, field aliasing, source type renaming, event type matching, and so on.
What it is the best time to perform most knowledge-building activities?
Conversely, as a general rule, it is better to perform most knowledge-building activities, such as field extraction, at search time. Index-time custom field extraction can degrade performance at both index time and search time. When you add to the number of fields extracted during indexing, the indexing process slows. Later, searches on the index are also slower, because the index has been enlarged by the additional fields, and a search on a larger index takes longer. You can avoid such performance issues by instead relying on search-time field extraction.
How Splunk names it’s buckets?
Bucket names depend on:
a) The state of the bucket: hot, warm/cold/thawed
b) The type of bucket directory: non-clustered, clustered-originating, clustered replicated
