Installation and Configuration

Question 1

How does ES know local customer domain names so it can detect internal vs external emails?

Answer 1

The Corporate Web and Email Domain Lookups are edited during initial configuration.

Question 2

Where would you navigate to edit Domain Tables?

Answer 2

1. Configure>Content>Content Management
2. Select Type:Managed Lookup
3. Edit any of the Domain lookups: Corporate Web Domains, Corporate Email Domains, Cloud Domains (external vendor sites)

Question 3

What are the default ports that must be configured for Splunk ES to function?

Answer 3

• SplunkWeb (8000)
• Splunk Management (8089)
• KV Store (8191)

Question 4

Which tool is used to update indexers in ES?

Answer 4

Splunk_TA_ForIndexers.spl

Question 5

Which of the following is accurate regarding the input phase?
- Applies event-level transformations
- Fine-tunes metadata
- Performs character encoding
- Breaks data into events with timestamps

Answer 5

Performs character encoding.

Question 6

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

Answer 6

Add a new search head and install ES on it.

Question 7

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

Answer 7

$SPLUNK_HOME/etc/shcluster/apps

Question 8

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

Answer 8

Splunk_TA_ForIndexers.spl

Question 9

Installation Checklist

Answer 9

1. Confirm the environment meets minimum system requirements for Splunk Enterprise and ES.
2. Increase the Splunk Web upload size limit in web.conf
3. Install ES on the search head
4. Install any required TAs
5. Create Splunk_TA_ForIndexers to deploy to indexers.
6. Deploy input-time technical add-ons to forwarders.

Question 10

ES needs to be installed on a search head with _____.

Answer 10

Only default built-in and CIM-compliant apps.

Question 11

What are the search head requirements for installing ES?

Answer 11

1. A dedicated server or cluster for the ES search head(s) with only CIM-compliant apps installed
2. 64-bit OS, minimum 32 GB RAM and 16 processor cores
3. Configure search head forwarding
4. If enabling Monitoring Console, do not use distributed mode

Question 12

To which of the following should the ES application be uploaded?
- The indexer
- The dedicated forwarder
- The search head
- The KV store

Answer 12

The search head

Question 13

What are the reference minimum requirements for OS, CPU, and RAM for an ES search head?

Answer 13

OS: 64 bit
RAM: 32 GB
CPU: 16 cores