Deploying Splunk

Question 1

What is considered as a ‘Splunk Validated Architecture’ (SVAs) ?

Answer 1

Splunk Validated Architectures (SVAs) are proven reference architectures for stable, efficient, and repeatable Splunk deployments

SVAs offer topology options that consider a wide array of organizational requirements, so you can easily understand and find a topology that is right for your requirements

It does not contain implementation choices (baremetal, virtual etc), nor deployment sizing.

Question 2

Why an intermediate forwarder should be avoided and only used in specific cases?

Answer 2

1) A large data stream from many endpoints is funneled through a single pipe that exhausts your system and network resources.
2) Limited failover targets for the endpoints in case of IFfailure (your outage risk is reverse proportional to the number of IFs)
3) Small number of indexers are served at any given point in time. Searches over short time periods will not benefit from parallelization as much as they could otherwise.

Question 3

Why you should use an odd number when you deploy a SHC?

Answer 3

SHC captain election is peformed using a majority-based protocol. An odd number of nodes ensures that a SHC can never be split into even numbers of nodes during network failures.

Question 4

Explain what the category M14 means?

Answer 4

• Multi-Site Indexer Cluster

* Multi-Site SearchHead Cluster and add. SearchHead Cluster for ES (contained within a site)

Question 5

Explain what the category C13 means?

Answer 5

• Single-Site Indexer Cluster

* Single-Site SearchHead Cluster with a dedicated SearchHead Cluster for ES

Question 6

Explain what the category M12 means?

Answer 6

• Multi-Site Indexer Cluster

* Multiple SearchHeads (non-clustered) and a dedicated single SearchHead for ES

Question 7

How can you easily check if the network latency for multi-site indexer is within the recommendations of <100ms ?

Answer 7

Simply do a long-term (which needs to cover peak business hours) ping from site A indexer to site B indexer. You can output the ping data into file and index it via oneshot to analyze it (not in production environment)

Question 8

What is the difference between category M13 and M14 in terms of SearchHead clustering?

Answer 8

In category M13, the SHCs are standalone and the search artifacts are not replicated between the sites.

M14 is consideres as the most complex implementation, it contains a streched SearchHead Cluster over all sites.

Question 9

If a device logs only via API and software can not be installed, which input technology would be best practise to use?

Answer 9

Splunk HEC

Question 10

What is a DCN?

Answer 10

A data collection node (eg Heavy Forwarder)

Question 11

What is the meaning of DR?

Answer 11

Set of processes necessary to ensure recovery of service after a disaster

Question 12

How can a manual DR be archieved in Splunk?

Answer 12

Backup of
> Splunk configurations (/etc/*)
> Indexes (introduce a specific backup concept for clustered indexer)

Question 13

How can an automatic DR be implemented in Splunk?

Answer 13

Through introducing multiple sites (if one site goes down, the other site still have all data available (only if the replication factor is set accordingly))

Question 14

What is the meaning of HA?

Answer 14

A design methodology whereby a system is continuously operational, bounded by a set of predetermined tolerances

Question 15

Why an all-in-one Splunk instance could grow to a distributed environment?

Answer 15

• End of testing
• End of the PoC
• System reached its search and index limitations
• Introduction of failover strategies
• Dedicated teams for dedicated SearchHeads

Question 16

In which specific cases an intermediate forwarder makes sense?

Answer 16

Specific cases where an intermediate forwarder may makes sense:

Sensitive data needs to be obfuscated/removed before sending across the network to indexers. An example is when you must use a public network

Strict security policies do not allow for direct connections between endpoints and indexers such as multi-zone networks or cloud-based indexers

Bandwidth constraints between endpoints and indexers requiring a significant subset of events to be filtered

Data routing reasons