Brainscape_Flash_Cards_CSV Flashcards
What is the default port for splunkd?
8089
What is the default port for Splunk Web?
8000
What is the default port for Web app-server proxy?
8065
What is the default port for KV Store?
8191
What three ulimit resources need to be increased on Splunk indexers?
- core file size 2. number of open files 3. max user processes
What is the cli command to set Splunk to run when a server is rebooted?
./splunk enable boot-start -user splunk
What is SPLUNK_HOME usually located (in the file system)?
/opt/splunk
What are the three main directories under SPLUNK_HOME?
- bin 2. etc 3. var
What folder to the Splunk executables normally go into?
/opt/splunk/bin
What folder contains all the Splunk licenses, configs, apps, etc?
/opt/splunk/etc/
What folder contains the Splunk indexes by default?
/opt/splunk/var/lib/splunk
What is the cli command to see what port splunkd is listening on?
./splunk show splunkd-port
What is the cli command to see what port Splunk Web is listening on?
./splunk show web-port
What is the cli command to start, stop, and restart Splunk?
./splunk [start | stop | restart ]
What is the cli command to see the status of Splunk on a server?
./splunk status
How long is a trial license valid for?
60 days
How much data can you ingest with a trial license?
500 mb per day
How much data can you ingest with the free license?
500 mb per day
When does the ‘daily license quota’ reset?
At midnight of each day
What is the definition of a license ‘warning’ in Splunk?
If the amount of data ingested in a day exceeds the allocated daily quote in a pool
When do you get a ‘violation’ when using an Enterprise license?
Five or more warnings in a rolling 30-day period.
When do you get a ‘violation’ when using a free license?
Three or more warnings in a rolling 30-day period.
What data is used to calculate how much data you ingested in a day?
All data that flows through the parsing pipeline
What is the cli command to add a license to Splunk?
./splunk add license [path to license file]
What folder does the Splunk licenses get saved to when you install a license?
/opt/splunk/etc/licenses/[type_of_license]
Which URI do you use when you want to ‘point’ a Splunk server at a Master license server?
https://[ip_address_of_server]:8089/
What do ‘pools’ do?
They allow licenses to be subdivided and assigned to a group of indexers
Why would you use ‘pools’?
A mulit-tenant Splunk environment is the most common reason.
Which folder are apps installed to?
/opt/splunk/etc/apps
What is an ‘add-on’?
It is a subset of an app that usually contains data collection but no GUI (reports or dashboards)
What is the command to install a Splunk app from the CLI?
./splunk install app [path-to-appfile]
What is another way to install an app using tar? (What is the actual command)?
- cd SPLUNK_HOME/etc/apps 2. tar -xf [path-to-appfile]
What does the ‘-c’ option for the tar command do?
Creates a new archive
What does the ‘-x’ option for the tar command do?
Extract files from an archive
What does the ‘-C’ option for the tar command do?
Change to directory specified after this option
What does the ‘-v’ option for the tar command do?
Verbosely list files processed
What does the ‘-f’ option for the tar command do?
use archive file or device specified after this option
What does the ‘-z’ option for the tar command do?
Filter the archive through gzip
What is the command to delete a Splunk app from the CLI?
./splunk remove app [app_folder]
What can a user do to an app if they have ‘read’ permissions to it?
They can see the app and use it
What can a user do to an app if they have ‘write’ permissions to it?
They can add/delete/modify knowledge objects used in the app
By default, what permissions do users have within the ‘search’ app?
Read permissions only
What local file (and path) will show you how to use all the .conf files?
SPLUNK_HOME/etc/system/README
Where does Splunk put the configuration files that is ‘ships with’?
In the ‘default’ directories
How do you edit a configuration file in a ‘default’ directory?
You DON’T! You copy the file to the ‘local’ directory and only had the changes that you want to that file. That files contents should be very small.
What are the three ‘layers’ of configuration files that impact configuration file precedence?
user, app, and system
What are the two schemes or ‘contexes’ that Splunk users to determine configuration file precedence?
app/user context or global context
What is the configuration file precedence in global context (from highest to lowest precedence) for non-cluster peer nodes?
- system local directory 2. app local directories 3. app default directories 4. system default directory
