Installation Manual Flashcards
What is splunkd process
Process that accesses, processes and indexes streaming IT data.
It also handles search requests.
splunkd processes and indexes your data by streaming it through a series of pipelines, each made up of a series of processors.
splunkd also provides the Splunk Web user interface
What ports are used by splunkd
splunkd runs a Web server on port 8089 with SSL/HTTPS turned on by default.
It also runs a Web server on port 8000 with SSL/HTTPS turned off by default
What is splunkweb.exe?
splunkweb installs as a legacy service on Windows only
Prior to version 6.2, it provided the Web interface for Splunk Enterprise. Now, it installs and runs, but quits immediately
On Windows systems, splunkweb.exe is a third-party, open-source executable that Splunk renames from pythonservice.exe
processes for Splunk Enterprise on Windows
Splunkd
Splunkweb
splunk.exe
splunk-admon
splunk-perfmon
splunk-netmon
splunk-regmon
splunk-winevtlog
splunk-winhostmon
splunk-winprintmon
splunk-wmi
splunk-wmi
When you configure a performance monitoring, event log or other input against a remote computer, this program runs. Depending on how you configure the input, it either attempts to attach to and read Windows event logs as they come over the wire, or executes a Windows Query Language (WQL) query against the Windows Management Instrumentation (WMI) provider on the specified remote machine.
splunk-winprintmon
splunk-winprintmon runs when you configure a Windows print monitoring input in Splunk. This input gets detailed information about Windows printers and print jobs on the local system
splunk-winhostmon
splunk-winhostmon runs when you configure a Windows host monitoring input in Splunk. This input gets detailed information about Windows hosts.
splunk-winevtlog
You can use this utility to test defined event log collections, and it outputs events as they are collected for investigation. Splunk Enterprise has a Windows event log input processor built into the engine
splunk-regmon
splunk-regmon.exe runs when you configure a Registry monitoring input in Splunk. This input initially writes a baseline for the Registry in its current state (if requested), then monitors changes to the Registry over time
splunk-netmon
splunk-netmon runs when you configure Splunk Enterprise to monitor Windows network information on the local machine.
splunk-perfmon
splunk-perfmon.exe runs when you configure Splunk Enterprise to monitor performance data on the local Windows machine. This binary attaches to the Performance Data Helper libraries, which query the performance libraries on the system and extract performance metrics both instantaneously and over time.
splunk-admon
splunk-admon.exe runs whenever you configure an Active Directory (AD) monitoring input. splunkd spawns splunk-admon, which attaches to the nearest available AD domain controller and gathers change events generated by AD. Splunk Enterprise stores these events in an index.
splunk.exe
It provides the command-line interface (CLI) for the program. It lets you start, stop, and configure Splunk Enterprise, similar to the *nix splunk program.
Splunk on NFS
Use block level storage rather than file level storage for indexing your data. And avoid using NFS whenever possible
If you use NFS, note the following:
Do not use NFS to host hot or warm index buckets. Splunk Enterprise on NFS is supported only with cold or frozen buckets.
Do not use NFS to share cold or frozen index buckets amongst an indexer cluster, as this potentially creates a single point of failure.
Splunk Enterprise does not support “soft” NFS mounts. These are mounts that cause a program attempting a file operation on the mount to report an error and continue in case of a failure.
Only “hard” NFS mounts, where the client continues to attempt to contact the server in case of a failure, are reliable with Splunk Enterprise.
Do not disable attribute caching. If you have other applications that require disabling or reducing attribute caching, then you must provide Splunk Enterprise with a separate mount with attribute caching enabled.
Do not use NFS mounts over a wide area network (WAN). Doing so causes performance issues and can lead to data loss.
Splunk and CIFS/SMB
Splunk Enterprise supports the use of the CIFS/SMB protocol for the following purposes, on shares hosted by Windows hosts only:
Storage of cold or frozen Index buckets.
When you use a CIFS resource for storage, confirm that the resource has write permissions for the user that connects to the resource at both the file and share levels
