Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Core Consultant - Preperation > Configuration Management > Flashcards

Configuration Management Flashcards

1
Q

What is the idea behind a deployment app?

A

To create a container for a specific task, e.g to extract data from one data source. Or a container which helds configuration for indexer etc.

The idea is to have small and reusable configurations, packed in one container called deployment app or app.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

If you are the developer of an app, where do you place your configurations?

A

myapp/default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

If you are a PS consultant and you download the configuration base apps, where do you configure?

A

/local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

To deploy a cluster, can you use deployment apps to setup the clustering?

A

There is no clear answer to that. The PS base configurations does contain apps for clustering which shows that you can use apps to do that.

During the Core Implementation class in 2017 it was explained, that it is not recommended to do that.

I personally think it is possible but in case of changes (eg change of rep factor), all the changes needs to be done through editing the .conf files and not through the GUI, because the GUI changes will be saved in a different app context.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where do you put the follwing app?

org_cluster_master_base

A

On the CM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If you want to control the master-apps through the deployment server, which pre-configured base app do you use?

A

org_master_deploymentclient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The CM has a simplified version of the deployment server included, what base configuration apps are intended to be placed in the master-apps directory?

A

1) org_cluster_indexer_base
2) org_all_indexes
3) If wished, TA-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which base config apps are not intended to push out via the CM and needs to be placed by hand?

A

org_site_n*

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a simple scenario of using the deployment features of CM, DS and DEP without messing everything up?

A

1) CM only deploys apps designed for the indexer tier
2) DEP only deploys apps designed for search tier
3) DS only deploys apps designed for forwarder tier

Another simple scenario would be to use the DS for everything and also to push from the DS apps directly into the /master-apps and /shcluster directory.

KISS (keep it simple and smart)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why would org_all_indexes be placed on a search head?

A

To enable typeahead features in Splunk Web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What would be an alternative to the Splunk Deployment Server?

A

3rd party software management tools like Chef, Puppet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the default home phone intervall?

A

60s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Is it possible to chain/cluster a Deployment Server and place them behind a loadbalancer?

A

Yes, through the following configuration:

  • set crossServerChecksum = true in Global Stanza on Primary and Secondary deployment servers in Serverclass.conf [global] stanza
  • Change repositoryLocation to /deployment-apps on Secondary DS deploymentclient.conf
  • Change serverRepositoryLocationPolicy = rejectAlways on secondary deploymentclient.conf
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What instance types is base config org_indexer_volume_indexes installed on?

A

Indexer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What instance types is base config org_full_license_server installed on?

A

Searchheads, indexer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What instance types is base config org_all_forwarder_outputs installed on?

A

Cluster Master, Search Head, Forwarder

17
Q

Describe ways to manage a deployment server efficiently

A
  • Keep a clear structure in the app names
  • Keep a clear structure in blacklists/whitelists
  • May use a class name within the clientName for better categorization
  • May use a third-party software to distribute apps, like chef or puppet
  • Use a second DS (special configuration required)
  • Talk to the system admins to introduce a clear name schema
18
Q

Does the deployment server has a limit in providing deployment clients?

A

Yes. The limit is very dynamic and its based on the underlying OS and the amount of apps as well as the number of connected deployment clients.

As a general rule, the limit can be between 1000-10000 deployment clients.

If you are using a Windows deployment server, the maximum is around 2000 deployment clients (in case you are using the reference hardware)

If you are using a Linux deployment server, the maximum is around 10000 deployment clients (in case you are using the reference hardware)

It is recommended to tune the homephoneintervall after the PS engagement is over. It is always recommended to monitor the load of the deployment server and also if a sluggish experience starts when the forwarder pull/download apps

19
Q

How does the network connection looks like when a deployment client is connecting to a deployment server?

A

The deployment client connects to the API of the deployment server via 8089/tcp. The connection is stateful and does not requiere a firewall adjustment on the forwarder (eg open port 8089)

20
Q

How does a deployment client recognizes that it needs to download an app?

A

The deployment client holds an app checksum and compares this checksum with the one on the deployment server. If there is a mismatch, the deplyoment client downloads it again.

The deployment server never initiates the connection to a deployment client, its always the other direction.

21
Q

Assume you just opened the app.conf in a deployment app and save it without changing anything within the file, does that trigger an app download from the deployment client?

A

Yes, it does.

The checksum is partly built by the timestamp of config files. If a file gets saved again without changing, the timestamp changes, hence the checksum changes too.

22
Q

How do you take away the function that the checksum is calculated based on the timestamp?

A

Set crossServerChecksum = true

Also useful if you have multiple deployment servers behind a load-balancer

23
Q

Which configuration file you need to add to transform a standard Splunk installation into a deployment server?

A

/opt/splunk/etc/serverclass.conf

24
Q

Can the transformation from a standard splunk installation to a deployment server be done through a base config app?

A

No, this does not work since the config file for the deployment server lives directly in the /etc directory

25
Q

Lets say you have a multi-site architecture and you want to provide the same sets of apps to your deployment clients, but just on a different site, what would be a possible scenario without using the deployment server from the first site?

A

To define one deployment server as ‘master’ and the second one as ‘slave’. Means the second one will be the deploymentclient from the master to fetch all the apps. Forwarders on the second site point now towards the second deployment server.

At next the second deployment server needs to be configured with a new serverclass.conf. The deploymentclient.conf on the second deployment server also needs to adjustments:

1) repositoryLocation to /deployment-apps
2) serverRepositoryLocationPolicy = rejectAlways

26
Q

In which scenario you would mess up all your deployment?

A

By not having a plan and a clear instruction for the client

27
Q

How does a serverclass.conf looks like and which three levels does a serverclass.conf contain?

A

A serverclass.conf is a config file which makes sure that the defined hosts/groups get their defined apps/configurations. It is the heart of the deployment server functionality.

The three level architecture in serverclass.conf:
1) the global level (global settings for all serverclasses)
2) ServerClass (a server class is a collection of
  applications)
3) app (this stanza maps an application to the specified server class
28
Q

What filter functions are available in the deployment server?

A

1) blacklist/whitelist filter

2) machine type filter (x64 etc.)

29
Q

What attribute in the serverclass can result in a restart of the receiving deploymentclients?

A

restartSplunkd=true

Splunk Core Consultant - Preperation (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions