Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Splunk Admin Cert > Splunk Admin Cert > Flashcards

Splunk Admin Cert Flashcards

1
Q

Installing an app from a file

3

A
  1. Download from Splunkbase
  2. Install from Splunkweb OR the CLI with: splunk install app path-to-appfile
  3. Extract: cd SPLUNK_HOME/etc/apps tar -xf path-to-appfile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Deleting an app command

2

A

. ./splunk remove app

  1. Navigate to SPLUNK_HOME/etc/apps and delete the folder
    * restart server for both
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Two ways to install an add-on or app on a forwarder

A

. CLI

  1. Use deployment server to deploy app.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

DO UF’s(Universal Fowarder) have a web interface?

A

No, Heavy Fowarders do. They can still use apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Does user have default permissions to write in search app?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Users with read permissions can do what?

Users with write permission can do what?

A

Read: See app and use it

Write: add/delete/modify knowledge objects used in the app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Where are apps installed?

A

SPLUNK_HOME/etc/apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can UF parse data?

A

NO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Can HF parse data?

A

YES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Enterprise Trial License limits

3

A
  1. 500mb per day limit
  2. Valid for 60 days, at which point the other 3 license types must be activated
  3. Sales trial license is a trial of varying size and duration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Enterprise License

4

A
  1. Purchased from Splunk
  2. Full functionality for indexing, search head, deployment server, etc.
  3. Sets daily indexing volume
  4. No-enforcement license, can keep searching even if in license violation period.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Free License

2

A
  1. Disables alerts, authentication, clustering, distributed search, summarization and forwarding to non-splunk users.
  2. Allows 500mb/day of indexing and forwarding
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

License Violations

A

5 warning on Enterprise, 3 on free trial, in a rolling 30-day period is a violation.

*resets at midnight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Forwarder License

3

A

.Sets up the server as a heavy forwarder.

  1. Applies to non-indexing forwarders
  2. Allows authentication, but no indexing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Metrics Data

A

counts against a license at a fixed 150 bytes per metric event

*draws from same license quota as event data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

If you update a .conf file but do not restart the instance of splunk, then run a btool on that .conf file, will you see your updates afters running the btool command?

A

YES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What do license pools do?

A

Allow licenses to be subdivided amongst a group of indexers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the license path?

A

SPLUNK_HOME/etc/licenses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

T/F: Splunk provides licenses for metrics and events data

A

False. They share the same license quota as event data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

T/F: Search Heads also need an Enterprise License (or set as a slave to a License Master with an Enterprise License_ even though we have no configured any inputs.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

T/F: If you exceed the daily license quota in a pool, your license will go into a violation.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An app is a collection of..

A

Configuration files, scripts, web assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Can apps be installed on any Splunk instance?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

T/F: Write permissions to an app means that the user’s role is able to modify the app.

A

False. User’s role with write can add/delete/modify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

T/F: Universal forwarders don’t have a web interface, but they can still benefit from an app.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Two required fields for adding native users

A

Username and Password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Optional fields for adding native users

4

A
  • Full name and email address (defaults to none)
    – Time zone (defaults to search head time zone)
    – Default app (defaults to role default app, or home if no role default app)
    – Role(s)
    Defaults to user
    *add password on first login
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does a new role inherit? (2)

A

Capabilities and Index Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Where do you store and manage your local configs?

A

(SPLUNK_HOME/etc/apps/search/local)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How to use btool to debug monitor

A

splunk btool inputs list monitor:///var/log –debug

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Where does Splunk input data?

A

SPLUNK_HOME/var/lib/splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the paths for buckets?

A

Hot/warm: $SPLUNK_HOME/var/lib/splunk/defaultdb/db/*

Cold: $SPLUNK_HOME/var/lib/splunk/defaultdb/colddb/*

Frozen: Directory to where I specify or deleted

Thawed:$SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What .conf do forwarders require?

A

outputs.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How to check for successful connection for indexer and forwarder.

A

Indexer: splunk display listen
Forwarder: splunk list forward-server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How do distributed search peers run searches?

A

In parallel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What phase does the licensing happen?

A

Indexing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are Knowledge Bundles distributed to and by what?

A

Distributed to search peers by search head when intitiated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Knowledge bundle directories

A

Search Head: SPLUNK_HOME/var/run

Search Peer: SPLUNK_HOME/var/run/searchpeers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Distributing indexes and search loads across multiple servers facilitates what kind of scaling?

A

Horizontal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What event breaker do you use for a single line event?

A

EVENT_BREAKER_ENABLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What event breaker do you use for a multi-line event?

A

EVENT_BREAKER = regex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What does * do?

A

Matches anything in that specific directory path segment but does not go beyond that segment in the path.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What does … do?

A

Recurses through directories and subdirectories to match

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Where should you forward search head indexes to?

A

the search peer (indexer) layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What files does a splunk diag produce?

A

tar.gz and diag.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Search Head Clustering

A

Replicated knowledge objects across search heads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Indexer Clustering

A

Replicated buckets (data) across indexers
Can be configured as single or multi site
Allows you to balance growth, speed of recovery and overall disk usage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Additional Components of a cluster

A 
Node
Monitoring Console
Deployment Server
Deployer
License Master
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Can a splunk indexer function as a cluster?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Where does Authentication Method save it’s settings?

A

authentication.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

User accounts stored in directory server

A

– Enforces LDAP user account and password policies
– Users use the same user name and password in Splunk that they use elsewhere
– LDAP groups must be mapped to Splunk roles  Or, this can be done manually in Splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Is the LDAP server rechecked each time a user logs into Splunk?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Can a user log in to LDAP Groups if they don’t have a Splunk Role?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Can Splunk native user be edit or deleted?

A

Both

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What can be changed on LDAP or other users?

A

Time Zone and default app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What does Identity Provider (IDP) do?

A

maintain the user credentials and handles authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are the aliases when configuring SAML?

A

Role
RealName
Mail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

When creating a SAML group, can multiple groups be mapped to a single user role?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Process for Duo Authentication Log on

A
  1. Request Splunk Login
  2. Check authentication/check group mapping
  3. DUO MFA
  4. Create User Session
  5. Log user in Splunk
60
Q

Continuously monitoring created a stanza where?

A

inputs.conf

One-time indexing does not create a stanza in inputs.conf

61
Q

What does data preview do?

A

displays how your processed events will be indexed

62
Q

What phase of the distributed model does license metering happen?

A

Indexer Phase

63
Q

Is the deployment client part of Splunk Enterprise or the UF?

A

UF

64
Q

What can you use to change settings in Splunk .conf files?

A

Splunk Web, CLI, SDK, app install, and/or direct edit

65
Q

When Splunk starts, how are config files merged together?

A

a single run-time model for each file type

66
Q

At index-time merging, does local or default take precedence?

A

local

67
Q

What are Input and Parsing handled by at index-time?

A

Input: handled at source (usually a forwarder)
Parsing: handled by indexers (or heavy forwarders)

68
Q

How is the license meter run during the index phase?

A

As data and initially written to disk, prior to compression.

69
Q

What is the index-time precedence?

A
  1. etc/system/local
  2. etc/apps/search/local
  3. etc/apps/unix/local
  4. etc/apps/search/default
  5. etc/apps/unix/default
  6. etc/system/default
70
Q

Can you modify the sourcetype in inputs.conf or index.conf

A

inputs.conf

71
Q

What does Data Preview display?

A

how your processed events will be indexed

72
Q

Installing a forwarder on a remote machine to…

A
  1. Gather data

2. Send it across the network to Splunk indexer(s)

73
Q

What kind of port to indexers listen on for the forwarded data?

A

Receiving port

74
Q

What do UF’s gather data from and where do they send it?

A

From a host and send it to indexers

75
Q

UF’s are specifically designed to run on production servers. The three things for that are…

A
  1. Minimal CPU Usage
  2. Output bandwidth constrained to 256 KBps by default
  3. No web interface, cannot search or index
76
Q

UF’s have a separate installation binary that has what…

A

built-in license with no limits

77
Q

What is the install directory for a UF?

A

/opt/splunkforwarder

78
Q

UF Configuration Steps

A

Sys admin 1. Set up a receiving port on each indexer. Only need to do once.
Data admin 2. Download and install UF
3. Set up forwarding on each forwarder
4. Add inputs on forwarders

79
Q

Can Splunk run without administrator privileges?

A

Yes

80
Q

Defining a target indexer command

A

splunk add forward-server indexer: receiving-port

  • forwarder logs are automatically sent to the indexer’s _internal index
81
Q

How to check for successful connection from the indexer

A

GUI: index=_internal host=forwarder_hostname
CLI: splunk display listen

82
Q

How to check for successful connection from the forwarder

A

View current forwarder to index config: splunk list forward-server

Remove target index setting: splunk remove forward-server indexer:port

83
Q

Benefit of compressing the feed

A
  • Slight increases CPU utilization

If you want to compress all feeds, set compression on indexer

If you want to compress select feeds, set compression on forwarder

84
Q

Turning on SSL (2)

A
  • Can increase the CPU usage

- Automatically compresses the feed

85
Q

What is the default certificate password?

A

password

86
Q

Automatic Load balancing (3)

A
  • Switch happens only when the forwarder detects EOF
  • Time-based load balancing default frequency is 30 seconds
  • Volume-based load balancing is set on how much data a forwarder send before switching
87
Q

What is the key to making distributed search or clustering work efficiently

A

Load balancing

[tcpout:splunk_indexer]
server=slunk1: 9997, splunk2: 9997, splunk3: 9997

88
Q

How should you enable the event breaker on the UF?

A

Per Sourcetype

89
Q

When does a UF know when to switch to the next indexer? (2)

A
  • an EOF is detected

- a short break in IO activity

90
Q

Where do you add the event breaker setting on UF?

A

props.conf

91
Q

Maximum amount of data the forwarder queues if receiver isn’t reached?

A

maxQueueSize = 500kb

92
Q

Is Indexer Acknowledgement enable or disabled by default?

A

Disabled

93
Q

By how many times does the Indexer Acknowledgement increase the maxQueueSize?

A

3x

94
Q

Use cases for HF

4

A
  • anonymizing or masking or incoming data before forwarding to an indexer
  • predictable version of Python is needed
  • No access to indexers
  • Required by an app
95
Q

What .conf file can you deploy from the deployment server?

A

inputs.conf

96
Q

Splunk can receive data from other instance with what CLI command?

A

./splunk enable listen

97
Q

How to configure HF as a deployment client to the DS

A

./splunk set deploy-poll

creates a deploymentclient.conf

98
Q

Two ways to configure the HF to forward the data to the indexers.

A
  • Manually using CLI

- Deploy outputs.conf from the DS

99
Q

Deployment Server (4)

A

a built-in tool for managing configuration of Splunk instances.

  • Allows you to manage remote splunk instances centrally
  • Requires enterprise license
  • Handles job of sending configs packaged as apps
  • can auto restart remote splunk instances
100
Q

What is Forwarder Management?

A

a graphical interface on top of the deployment server

101
Q

Server class

A

maps a client group to one or more deployment apps

  • gets saved in serverclass.conf
102
Q

Deployment clients

A

Splunk instances that are connected to the DS that are phoning home. You establish the connection from the DC.

103
Q

Deployment App best practice

A
  • create small and discrete deployment apps
  • take advantage of .conf file layering
  • use a naming convention
104
Q

Apps/Add-ons

A

must be installed in /etc/apps

Splunk web does no exist on a UF

105
Q

To enable forwarder management

A
  1. On the DS, add one or more apps in /etc/deployment-apps
  2. in the Forward Management UI, create one or more server classes
  3. On forwarders, run “splunk set deploy-poll
  4. Verify on the DS
  5. Verify on forwarders in etc/apps
106
Q

Monitoring Console

A
  • runs every 15 minutes by default

- relies on internal logs

107
Q

** A monitor input can define a directory tree as the data source. (3)

A
  • Splunk recursively traverses through the directory structure
  • All discovered text files are consumed, including compressed files
    • unzips compressed files automatically before ingesting them, one at a time
  • Any files added to the directory tree in the future are included
    - auto detects and handles log file rotation
108
Q

followTail

A
  • Splunk ignores existing content in the file, but indexes new data as it arrives
  • DO NOT leave followTail enabled indefinitely
109
Q

ignoreOlderThan

A
  • A file whose modtime falls outside this time window will not be indexed
    • After a file is ignored, it will never be considered as an input again, even if it is updated
110
Q

Monitor input options in inputs.conf

A
  • Can contain a wildcard in stanza
  • All attributes (sourcetype, host, index, etc.) are optional
  • Defaults apply if omitted and default host is in etc/system/local/inputs.conf
111
Q

Host_segment

A

the number at the end (e.g. host_segment = 3) uses that numbers segment of the directory path as the host name for files in that directory.

112
Q

Editing inputs

A
  • editing inputs.conf only changes new data
  • Splunk monitor inputs are tracked by fishbucket
  • Does NOT re-index when inputs.conf is edited
113
Q

Re-index for editing inputs

A
  • Delete old data on indexer(s)
  • change the inputs.conf on the deployment server (or forwarders)
  • Reset the fishbucket checkpoint on the involved forwarders
  • Restart
114
Q

What does resetting the monitor checkpoint do?

A

Re-indexes ALL the data, resulting in more license usage and duplicate events.

115
Q

btprobe

A
  • use to reset the checkpoint for an individual input

- Requires stopping forwarder or indexer

116
Q

Network inputs

A

Adds a layer of resiliency to your topology

  • Buffering, load balancing, cloning, etc…
  • Indexer restart will not cause data loss of TCP or UDP inputs
117
Q

connection_host

A

defines how the host field is set (dns, ip, none)

118
Q

**acceptFrom

A

List address rules separated by spaced or commas

  • a single IPv4 or IPv6
  • a CIDR block
  • A DNS
  • a wildcard * and !
119
Q

queueSize

A
  • defaults to 500kb

- independent of the forwarder’s maxQueueSize

120
Q

Persistent Queue

A
  • provides file-system buffering of data
  • adds additional buffer space after memory buffer. Must set a queueSize.
  • written to disk on the forwarder in home/var/run/splunk.
  • Useful for high-volume data that must be preserved in situations where it cannot be forwarded, such as if the network is unavailable.
121
Q

UDP

A

Splunk merges the UDP data until it finds a timestamp by default
-Can override during the parsing phase

122
Q

HEC (HTTP event collector)

A
  • secure and scalable

- disabled by default

123
Q

StatsD

A

– Network daemon that runs on the Node.js platform
– Client libraries available in many programming languages
– Primarily used to measure performance of application code
– Introduces statsd line metric protocol, often sent UDP/TCP

124
Q

collectD

A

– Open source daemon that collects performance metrics from a variety of sources
– Primarily used to measure infrastructure performance
 100 frontend plugins
 CPU, memory, disk, network,
uptime, load, etc.
– Can send data to HEC
 Using write_http_plugin

125
Q

mcollect

A

mcollect index=
• mcollect converts events into metric data points, then writes the converted metric index on the search head
• Causes new data to be written to a metric index for every run of the search
• If you are forwarding data to the indexer, your data will be inserted on the indexer instead of the search head

126
Q

mcatalog

A
  • mcatalog returns a list of values from all metric indexes, unless an index name is specified in the WHERE clause
  • Use this command to determine the values – i.e., the metric names and dimensions – that are available for searching and analysis
127
Q

props.conf

A

a config file that is referenced during all phases of Splunk data processing.

128
Q

Where can you use wildcards and regex in props?

A
  1. source::

2. hosts::

129
Q

What do you use to override utf-8 encoding?

A

charset

130
Q

Event Boundaries

A

automatically handles line breaking for common source types, even multi-line events

131
Q

is SHOULD_LINE_MERGE for single or multi line events?

A

Single

Set to true by default

132
Q

Mulit-Line Events

A

– Looks for a new line with a date at the start
BREAK_ONLY_BEFORE_DATE = true (default)
– Allows a maximum of 256 lines per event
MAX_EVENTS = 256 (default)
– Many other options – for example,
BREAK_ONLY_BEFORE =

133
Q

What .conf is custom timestamp extraction in?

A

props.conf

134
Q

TIME_PREFIX =

A

matches character right BEFORE the date/timestamp.

135
Q

MAX_TIMESTAMP_LOOKAHEAD =

A

specifies how many characters to look beyond the start of the line for a timestamp

136
Q

When possible, define meta field values during the what phase?

A

Input phase.

137
Q

What are the two methods of raw data transformations?

A
  • SEDCMD: uses only props

- Tranforms: uses props.conf and transforms.conf

138
Q

Transformation is based on what attributes?

A

– SOURCE_KEY indicates which data stream to use as
the source for pattern matching (default: _raw)
– REGEX identifies the events from the SOURCE_KEY that will be processed (required)
 Optionally specifies regex capture groups
– DEST_KEY indicates where to write the processed data (required)
– FORMAT controls how REGEX writes the DEST_KEY (required)

139
Q

If Error or Warning is found in the incoming _raw, what should its index field value be changed to?

A

itops

140
Q

What does (?!) mean?

A

ignore case

141
Q

Indexed extractions are the what phase of what .conf

A

Input phase of props.conf

142
Q

Does Splunk software parse structured data that has been forwarded to an indexer?

A

Nope

143
Q

What is a lookup

A

A Splunk data enrichment knowledge object

  • used only during search time
  • lookup stanzas are defined in transforms and props
144
Q

Four types of lookups

A

– File-based uses a csv file stored in the
lookups directory
– KV Store requires collections.conf that
defines fields
– External uses a python script or an executable
in the bin directory
– Geospatial uses a kmz saved in the lookups
directory to support the choropleth visualization

145
Q

Other types of conf files

A

– macros.conf, tags.conf, eventtypes.conf, savedsearches.conf, etc.

ag-Splunk Admin Cert (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions