Knowledge Check Flashcards by Tobi Funke

Which installer will the System Admin use to install the heavy forwarder

Splunk Enterprise

How well did you know this?

Not at all

Perfectly

Which configuration file tells a Splunk instance to ingest data?

inputs.conf

How well did you know this?

Not at all

Perfectly

True or False. The best place to add a parsing configuration on an indexer would be the SPLUNK_HOME/etc/system/local directory as it has the highest precedence.

False. It is best to put the configuration file in the local directory of your app

How well did you know this?

Not at all

Perfectly

When you configure the inputs using Settings > Add Data, under what directory is the inputs.conf created?

It depends on the App Context setting on the Input Setting stage. Best practice is to put the configuration file in the local directory of you app. If you have clustering enabled, then the SPLUNK_HOME/etc/system/local may not be the highest in the precedence order. More details are available in the Cluster Admin course.

How well did you know this?

Not at all

Perfectly

True or False. You cannot change the sourcetype when you go through the Settings > Add Data wizard.

False. You can change the source type from the dropdown. In fact, you can even create a new source type. We will learn how to do this in Module 9

How well did you know this?

Not at all

Perfectly

Splunk will not create an inputs.conf file when you use the Upload option in Settings > Add Data

True. Upload is a one-time process, so Splunk does not create an inputs.conf

How well did you know this?

Not at all

Perfectly

If the forwarder is set to send its data to 2 indexers at 30 second intervals, does it switch exactly at the 30th second?

Not always, the forwarder does not want to send half an event to indexer1 and the other half to indexer2. To avoid this situation, for example, if the forwarder is tailing a file, then it waits for an EOF or a pause in IO activity before it switches

How well did you know this?

Not at all

Perfectly

True or False, Turning SSL on between the forwarder and the receiver automatically compresses the feed

True

How well did you know this?

Not at all

Perfectly

What configuration file on the forwarder defines where data is to be forwarded to?

outputs.conf

How well did you know this?

Not at all

Perfectly

True or False. The HF has a GUI.

True

How well did you know this?

Not at all

Perfectly

True or False. The UF and the HF can be used to mask data before transmitting to indexers.

False. Only the HF, specifically Splunk Enterprise instances, can perfom data masking.

How well did you know this?

Not at all

Perfectly

True or False. The listening port (HF) has to be 8089

False. 8089 is the management port. The listening port can be any port

How well did you know this?

Not at all

Perfectly

On the DS, what is the difference between the apps sitting in the SPLUNK_HOME/etc/apps folder versus the SPLUNK_HOME/etc/deployment-apps?

The apps in the /etc/apps folder are for the Deployment Server and the apps in the /etc/deployment-apps are apps for deployment to a client

How well did you know this?

Not at all

Perfectly

When an app is deployed from the DS to the client, where will you find that app on the client by default?

Apps by default are deployed from the DS to clients in the SPLUNK_HOME/etc/apps folder

How well did you know this?

Not at all

Perfectly

True or False. Deployment Clients poll the DS on port 9997

False. Clients poll the DS on its management port (8089 by default)

How well did you know this?

Not at all

Perfectly

True or False. You can use the wildcards, … and * in the Whitelist and Blacklist.

False. The wildcards, … and * are meant for the stanzas

How well did you know this?

Not at all

Perfectly

True or False. The host_regex setting in inputs.conf can extract the host from thhe filename only.

False. It can extract the host form the path of the file

How well did you know this?

Not at all

Perfectly

After a file monitor is set up and is running, if you decide to change the host value, will new host value be reflected for the old data that has already been ingested?

No. All changes apply to the new data only. To reflect changes for you old data, you may need to delete and re-ingest the old data

How well did you know this?

Not at all

Perfectly

In our environment, we have a UF, an Indexer and a SH. Which instance contains the _fishbucket index?

Each instance will have its own local _fishbucket index.

How well did you know this?

Not at all

Perfectly

True or False. Persistent Queue and Memory Queue can be applied to Network as well as Scripted inputs

True

How well did you know this?

Not at all

Perfectly

Why is it a Best Practice to send data to a syslog collector that writes into a directory structure and then have a UF/HF ingest the data from the directory structure?

If the UF has to be restarted, the _fishbucket will prevent data loss

How well did you know this?

Not at all

Perfectly

True or False. An interval setting for scripted inputs can be specified in cron syntax

True. You can specify the interval in either number of seconds or cron syntax

How well did you know this?

Not at all

Perfectly

Is it possible to use the host value and not the DNS name or IP address for a TCP input? How?

Yes, it is possible. Under the stanza in inputs.conf set the connection_host to none and specify the host value

How well did you know this?

Not at all

Perfectly

True or False. You can set up a windows input using a UF on the windows server and send the data to an Indexer running on Linux

True

How well did you know this?

Not at all

Perfectly

True or False. You can collect ActiveDirectory data from a Windows Server remotely using wmi.conf

False. Only event logs and performance monitoring logs can be collected using wmi.conf

True or False. Event Collector can be set up on a UF

False. Event collector can be set up on an Indexer or HF

True or False. Data can be sent in json or any raw data format to the event collector

True

True or False. StatsD data can be used to collect metric data using HTTPs and HEC

False. CollectD can be used to collect metric data using HTTPs and HEC

True or False. Metrics data also needs values for host, source type and index

True

True or False. Time extraction can be done using props.conf on the UF and HF

False. You will learn how to specify Time Extraction if the file contains a header line. But if it does not contain a header line, then time has to be extracted on the HF/Indexer

True or False. Event boundaries can be defined using props.conf at the UF

True. You may want to define event boundaries for certain event types at the UF level. Remember the more you do at the UF level the more resources you will need

True or False. When extracting a timestamp, if the parser finds the indexer's OS time, it will use that as the first preference.

False. When all else fails, the Indexer's OS time is used as the last preference

True or False. sedcmd can be used to eliminate unwanted events

False. You have to use transforms.conf sedcmd can only be used to mask or truncate data

True or False. When using tranforms.conf, the SOURCE_KEY is set to _raw by default

True. If you do not specify the SOURCE_KEY in transforms.conf, it defaults to _raw

True or False. props.conf and transforms.conf are used to store Field Extractions, Lookups, Saved Searches and macros

False. They are used only for Field Extractions and Lookups

True or False. Any user belonging to any user role has the ability to reassign any KO

Fals. Only users belonging to the admin role can assign any KO

True or False. When you are using Splunk Web and select the REGEX option in the Field Extractor, it uses props.conf and transforms.conf in the background

False. It only uses props.conf Delimiter based extractions entries in props.conf and transforms.conf are manually created

Which installer will you use to install the Search Head?

Splunk Enterprise

When you install Splunk on a Windows OS, you also have to configure the boot-start?

False. You only need to do that on a Linux installation

True or False. The default Splunk Web port is set to 8000

True

True or False. Splunk provides separate licenses for metrics and events data

False. Metrics data draws from the same license quota as event data

True or False. Search Heads also need an Enterprise License (or set as a slave to a License Master with an Enterprise License) even though we have not configured any inputs

True

True or False. If the indexing exceeds the daily license quota in a pool, your license will go into a violation

False. If the indexing exceeds the allocated daily quota in a pool, an alert is raised. If it is not fixed by midnight then the alert turns into a warning. 5 or more warnings on an enforced Enterprise license or 3 warnings on a Free license, in a rolling 30-day period, is a violation

True or False. Write permissions to an app means that the user's role is able to modify the app

False. User's role with write permission can add/delete/modify knowledge objects used in the app

True or False. Universal forwarders don't have a web interface, but they can still benefit from an app

True

Which configuration file tells a Splunk instance to ingest data?

inputs.conf

True or False. When Splunk starts, configuration files are merged together into a single run-time model for each file type

True

True or False. btool shows on-disk configuration for requested file

True

True or False. Splunk, by default automatically sets the frozen path when you create an index

False. Frozen path is not set by default. Data is set to delete by default

True or False. When Hot Buckets roll to Warm they go to a different directory

False, Hot and Warm buckets stay in the same directory. When Hot buckets roll to Warm they are renamed

True or False. _introspection index tracks system performance and Splunk resource usage data

True

True or False. Frozen buckets roll to Thawed automatically

False. To thaw a frozen bucket you will have to start by copying the bucket directory from the frozen directory to the index's thaweddb directory and follows the steps mentioned on slide "Restoring Frozen Bucktes"

True or False. When creating an Index from the web, it creates a stanza in inputs.conf

False. It creates a stanza in indexes.conf

True or False. When running the splunk clean command, you can set a date range for the events you want to delete.

False. There is no option to set a date range

True or False. If you are installing a Search Head and an Indexer, Splunk requires an admin account on each instance

True

True or False. If you want a role that is "like" user but with some capabilities turned off, you can create a new role that inherits from the user role and remove some of the capabilities

False. You will have to create a new role that does NOT inherit from the user role, turn on all of the same capabilities as in user role, except those you want turned off

True or False. You can unlock a user from the CLI

True

True or False. You have to configure a separate receiving port on the indexer for each universal forwarder

False. You do not have to create a separate port for each UF

True or False. When you install a UF on a Windows OS, you get a GUI for the UF

False. Universal Forwarders do not have a GUI on Windows OS or other OSs

The command splunk add forward-server indexer:receiving-port will create stanza(s) in which conf file?

outputs.conf

True or False. When adding a Search Peer you have to enter a username and password of an account on the search peer, the account must have the edit_role capability

False. The account must have edit_user capability

True or False. Knowledge bundles contain knowledge objects required by the indexers for searching

True

True or False. A quarantined search peer is prevented from performing new searches but continues to attempt to service any currently running search

True

As an admin, you want to look at the contents of the zip file created as a result of executing a diag. How would you check it?

Splunk it! Ingest the zip file on your test server into a test index

What are the two types of clustering provided by Splunk?

Indexer clustering and search head clustering