Module 2

Question 1

Index time process

Answer 1

Input phase:
Universal and heavy forwarder, data is open and read, configs are applied to data stream, sent out for indexing
Parsing phase:
Indexer & Heavy forwarder, data broken to events, extract default metadata fields (host, source, sourcetype, index), ID timestamps
Indexing phase:
Indexer, writes data to disk, runs license meter, build index structure

Question 2

Options to add data

Answer 2

In the add data:
Upload - uploads local files, only gets indexed once
Monitor - monitor files and directories, ports etc (automatically uploaded to splunk as it goes)
Forward - Get data from remote machines (data from a forwarder)

Question 3

OS | Default Splunk Installation Directory | Directory for App Config Files

Answer 3

Windows | C:\Program Files\Splunk | C:\Program Files\Splunk\etc\apps
Linux | /opt/splunk/ | /opt/splunk/etc/apps
Mac OS | /Applications/Splunk | /Applications/Splunk/etc/apps