Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Interview Practice > Interview Questions > Flashcards

Interview Questions Flashcards

1
Q

When you’re standing up a brand new indexer, what is the overall process for adding it to a cluster?

A
  1. Go to settings
  2. Go to indexer clustering
  3. Make the instance a peer node
  4. Connect to the cluster master through management port (8089)
  5. Indicate the peer replication port (8080)
  6. Add security key
  7. Enable peer node
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the process for adding an index to an environment?

A
  1. Go to settings
  2. Go to Indexes
  3. Go to new index
  4. Name the index
  5. Save
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can you make data CIM compliant?

A
  1. Create tags

Example: Let’s say you have Office A, Office B, and Office C. You want to be able to find events quickly that are associated with hosts in Office B. You would create a tag with the IP addresses of all hosts for Office B. The tag would allow you to reference Office B events quickly.

  1. Create field aliases

Example: My data model has a field called http_fallon. However in my source data, let’s say my name is spelled incorrectly. I would use a field alias to capture the misspelling of my name in the source data and map it to the correct field name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What extension do you use in developing dashboards?

A

XML extensions which are cascading style sheets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What tools do you use to monitor the health of your system?

A

Monitoring Console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where are Splunk logs located in Linux?

A

splunk_home/var/log/splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the purpose of a monitoring console?

A

Allows you to monitor the performance health (or just health) of your Splunk environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the difference between replication factor and search factor?

A

Replication factor specifies how many total copies of raw data the cluster should maintain. Search factor specifies how many copies are searchable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the purpose of the security key?

A

Authenticates communication between the cluster nodes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Walk me through the process of adding a license master and cluster master to an environment.

A
  1. Go to settings
  2. Go to licensing
  3. Add the license by uploading it into the system (select install)
  4. Restart Splunk
  5. To make the server a cluster master go to settings
  6. Go to indexer clustering
  7. Select master node
  8. Select next
  9. Specify the replication factor and search factor
  10. specify what the security key is
  11. enable the master node and restart
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Walk me through the process of pointing servers to the license master.

A
  1. go to settings
  2. licensing
  3. change the instance to a slave instance
  4. enter the license master URI
  5. save and restart
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Walk me through creating an indexing cluster.

A

For each indexer, do the following

  1. settings
  2. indexer clustering
  3. enable indexer clustering
  4. click peer node, click next
  5. connect the peer node to the cluster master by putting the master URI in and the management port in (8089)
  6. indicate what the peer replication port is
  7. specify what the security key is and enable the peer node
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do you configure the indexers to receive logs sent from the forwarders?

A
  1. settings
  2. forwarding and receiving
  3. configure receiving
  4. indicate what the listening port is (9997)
  5. save
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How would you troubleshoot if the forwarder is not communicating with the deployment server?

A

Run splunk status on the forwarder. Then make the sure the IP address in the deployment client.conf file is for your deployment server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are two ways to filter out unwanted data?

A

Send events to null queue in transforms.conf file or black listing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

If you have issues with Splunk where would you go to see what is the problem?

A

Splunkd.log which is the primary log for the splunk server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Explain the importance of CIM

A

Splunk CIM is used to normalize data for matching basic or common fields in a dataset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Splunk has stopped indexing your data, and we need to find crash logs. Which internal log file do you check, and what is the path to that log?

A

splunkd.log, which would be found in: /$SPLUNK_HOME/var/log/splunk/splunkd.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Name the 3 main Splunk components.

A

Forwarder
Indexer
Search Head

20
Q

Name all of the Splunk components.

A

Universal Forwarder
Indexer
Search head
Deployment server
Deployer
Cluster master
License master
Heavy Forwarder

21
Q

What does the indexer do?

A

parse and store data

22
Q

What is a deployment server responsible for?

A

The Splunk system that distributes apps and configurations to universal forwarders and heavy forwarders.

23
Q

What do you need to do in order to create a deployment server?

A

Create a serverclass.conf file in the etc/system/local directory of your instance.

24
Q

What is the function of a deployer?

A

Used to distribute apps and other configuration updates to search head cluster members.

25
Q

What is an undistributed environment?

A

In an undistributed environment, you will have Splunk Enterprise installed on a single server instance—this single machine handles all of the indexing of data and searches of that data

26
Q

What is a distributed environment?

A

In a distributed environment, indexing and search functions are divided across at least two machines—an indexer on one server that receives and indexes data, and a search head on a separate server that communicates with the indexer to service search requests – two instances, each performing a different function.

27
Q

What is a clustered environment?

A

In a clustered environment, you would combine multiple indexers and/or search heads into an indexing/search head cluster for high availability (in case a server goes down) and data redundancy (storing more than one copy of the data across the indexing cluster).

28
Q

What would you do if you wanted to provide even better disaster recovery for a clustered environment?

A

You can build a multisite cluster wherein you have two indexing and/or search head clusters at different physical locations or sites

29
Q

If a client does not want to bring data into their environment from a universal forwarder or heavy forwarder what other options do they have to send data to splunk?

A

HEC (HTTP Event Collector)
Apps and Ad-ons
Syslog

30
Q

HTTP Event Collector is a method for onboarding data. Describe it.

A

Enables data to be sent over HTTP (HyperText Transfer Protocol) directly to Splunk Enterprise or Splunk Cloud Platform from our application.

31
Q

Syslog is a method for onboarding data. Describe it.

A

Used to process data from machines that we cannot install a Splunk forwarder on, such as network devices. Examples include logs from firewalls, switches, routers, etc.

32
Q

What does Splunk DB Connect allow you to do?

A

Allows us to import tables, rows, and columns from a database directly into Splunk Enterprise, which indexes the data.

33
Q

What is the props.conf file used for?

Provide two examples of what happens with data in the props.conf file.

A

To parse data and make sense out of data

event breaking takes place, timesheet stamping takes place, truncation takes place

34
Q

Describe what happens during the data parsing process.

A

data that you need is extracted, data is normalized

35
Q

What is phoning home?

A

Forwarders way of communicating with the deployment server.

36
Q

Name three web ports.

A

8000 – Splunk Web port
8089 – management port

9997 – indexers listen on port to receive data from forwarders

8080 – replication port

37
Q

What is the outputs.conf file used for?

A

Used by forwarder to forward data to the indexer

38
Q

What is white list?
What is blacklist?

A

White list – IP address that’s permitted to access the network

Black list – IP address that’s blocked from accessing the network

39
Q

An executive looks at a dashboard every morning. The dashboard pulls data from your environment and it looks at a 24 hour period.

This morning nothing came up. The executive is upset and wondering where their report is. You go to the dashboard to investigate. The dashboard itself has not changed. What are next steps in troubleshooting why the report isn’t producing results?

A

Check the extractions and fields that you’re using to make sure that they have values

40
Q

Name 3 ways that you can optimize searches?

A

Narrow the time window

Specify what the index, source, and sourcetype are

Be specific in your search (avoid using wildcards)

Limit the number of events retrieved (i.e. use the head command)

41
Q

Provide examples of knowledge objects and explain what they are.

A

saved searches (search that’s made available for later use)

alert (runs in real time or on a schedule specified by the user, triggered when results meet user defined conditions, once it’s triggered it can initialize one or more alert actions)

42
Q

What kind of servers do you run in your environment?

A

Linux servers

43
Q

What does a fishbucket do?

A

monitors data so it’s not duplicated

helps to prevent reindexing

44
Q

What is an intermediary forwarder used for?

A

Used for security purposes. If there is a security breach, the intermediary forwarder would keep data from being easily accessed on the indexers

45
Q

What is your favorite Linux command? What does it allow you to do in the command line?

A

chown

allows you to change ownership of a file

Splunk Interview Practice (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions