Admin Guide 9.0.4

Question 1

Best practice for optimal performance - dedicated machines

Answer 1

Adding more physical machines dedicated to Splunk Enterprise translates into better performance than having more resources in a single machine.
Where possible, split up your indexing and searching activities across a number of machines, and only run one Splunk Enterprise component on each machine.
Performance is reduced when you run Splunk Enterprise on machines that share resources with other services.

Question 2

Best practice for optimal performance - antivirus

Answer 2

If you use anti-virus programs on the servers running Splunk Enterprise, make sure that all Splunk software directories and programs are excluded from on-access file scans.

Question 3

Best practice for optimal performance - indexes

Answer 3

Use multiple indexes, where possible.
Sending all data to one index can cause I/O bottlenecks on your system and complicate retention calculations and access controls

Question 4

Best practice for optimal performance - disk/volume considerations

Answer 4

Don’t store your indexes on the same physical disk or volume as the operating system.
The disk that holds your operating system or its swap file is not a recommended place for Splunk Enterprise data storage.
Put your indexes on other disks or volumes mounted on the machine

Question 5

Best practice for optimal performance - buckets location

Answer 5

Don’t store the hot and warm buckets of your indexes on network volumes
Always use fast, local disk for the index hot and warm buckets.
You can specify network shares for the cold and frozen buckets of an index using Distributed File System (DFS) volumes or Network File System (NFS) mounts.

Question 6

Best practice for optimal performance - minimal disk space

Answer 6

The volume or mount that contains your indexes must have approximately 5 gigabytes of free disk space by default, or indexing will stop.

Question 7

Splunk web default port

Answer 7

8000

http://localhost:8000

http://<hostname>:8000</hostname>

Question 8

Configuration files

Answer 8

These files are located under your Splunk installation directory (usually referred to in the documentation as $SPLUNK_HOME) under /etc/system.

Question 9

preferred Splunk Enterprise component to integrate into a Windows system image

Answer 9

universal forwarder is designed to share resources on computers that perform other roles, and does much of the work that an indexer can, at much less cost.
You can also modify the forwarder’s configuration using the deployment server or an enterprise-wide configuration manager with no need to use Splunk Web to make changes.

Question 10

access Splunk Free from a remote browser

Answer 10

You cannot access Splunk Free from a remote browser until you have edited $SPLUNK_HOME/etc/local/server.conf and set allowRemoteLogin to Always.