Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Admin Knowledge Check > Knowledge Check > Flashcards

Knowledge Check Flashcards

1
Q

Which installer will the System Admin use to install the heavy forwarder

A

Splunk Enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which configuration file tells a Splunk instance to ingest data?

A

inputs.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

True or False. The best place to add a parsing configuration on an indexer would be the SPLUNK_HOME/etc/system/local directory as it has the highest precedence.

A

False. It is best to put the configuration file in the local directory of your app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

When you configure the inputs using Settings > Add Data, under what directory is the inputs.conf created?

A

It depends on the App Context setting on the Input Setting stage. Best practice is to put the configuration file in the local directory of you app. If you have clustering enabled, then the SPLUNK_HOME/etc/system/local may not be the highest in the precedence order. More details are available in the Cluster Admin course.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False. You cannot change the sourcetype when you go through the Settings > Add Data wizard.

A

False. You can change the source type from the dropdown. In fact, you can even create a new source type. We will learn how to do this in Module 9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Splunk will not create an inputs.conf file when you use the Upload option in Settings > Add Data

A

True. Upload is a one-time process, so Splunk does not create an inputs.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

If the forwarder is set to send its data to 2 indexers at 30 second intervals, does it switch exactly at the 30th second?

A

Not always, the forwarder does not want to send half an event to indexer1 and the other half to indexer2. To avoid this situation, for example, if the forwarder is tailing a file, then it waits for an EOF or a pause in IO activity before it switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or False, Turning SSL on between the forwarder and the receiver automatically compresses the feed

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What configuration file on the forwarder defines where data is to be forwarded to?

A

outputs.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or False. The HF has a GUI.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

True or False. The UF and the HF can be used to mask data before transmitting to indexers.

A

False. Only the HF, specifically Splunk Enterprise instances, can perfom data masking.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

True or False. The listening port (HF) has to be 8089

A

False. 8089 is the management port. The listening port can be any port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

On the DS, what is the difference between the apps sitting in the SPLUNK_HOME/etc/apps folder versus the SPLUNK_HOME/etc/deployment-apps?

A

The apps in the /etc/apps folder are for the Deployment Server and the apps in the /etc/deployment-apps are apps for deployment to a client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When an app is deployed from the DS to the client, where will you find that app on the client by default?

A

Apps by default are deployed from the DS to clients in the SPLUNK_HOME/etc/apps folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or False. Deployment Clients poll the DS on port 9997

A

False. Clients poll the DS on its management port (8089 by default)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True or False. You can use the wildcards, … and * in the Whitelist and Blacklist.

A

False. The wildcards, … and * are meant for the stanzas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False. The host_regex setting in inputs.conf can extract the host from thhe filename only.

A

False. It can extract the host form the path of the file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

After a file monitor is set up and is running, if you decide to change the host value, will new host value be reflected for the old data that has already been ingested?

A

No. All changes apply to the new data only. To reflect changes for you old data, you may need to delete and re-ingest the old data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In our environment, we have a UF, an Indexer and a SH. Which instance contains the _fishbucket index?

A

Each instance will have its own local _fishbucket index.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

True or False. Persistent Queue and Memory Queue can be applied to Network as well as Scripted inputs

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why is it a Best Practice to send data to a syslog collector that writes into a directory structure and then have a UF/HF ingest the data from the directory structure?

A

If the UF has to be restarted, the _fishbucket will prevent data loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

True or False. An interval setting for scripted inputs can be specified in cron syntax

A

True. You can specify the interval in either number of seconds or cron syntax

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Is it possible to use the host value and not the DNS name or IP address for a TCP input? How?

A

Yes, it is possible. Under the stanza in inputs.conf set the connection_host to none and specify the host value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

True or False. You can set up a windows input using a UF on the windows server and send the data to an Indexer running on Linux

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

True or False. You can collect ActiveDirectory data from a Windows Server remotely using wmi.conf

A

False. Only event logs and performance monitoring logs can be collected using wmi.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

True or False. Event Collector can be set up on a UF

A

False. Event collector can be set up on an Indexer or HF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

True or False. Data can be sent in json or any raw data format to the event collector

A

True

28
Q

True or False. StatsD data can be used to collect metric data using HTTPs and HEC

A

False. CollectD can be used to collect metric data using HTTPs and HEC

29
Q

True or False. Metrics data also needs values for host, source type and index

A

True

30
Q

True or False. Time extraction can be done using props.conf on the UF and HF

A

False. You will learn how to specify Time Extraction if the file contains a header line. But if it does not contain a header line, then time has to be extracted on the HF/Indexer

31
Q

True or False. Event boundaries can be defined using props.conf at the UF

A

True. You may want to define event boundaries for certain event types at the UF level. Remember the more you do at the UF level the more resources you will need

32
Q

True or False. When extracting a timestamp, if the parser finds the indexer’s OS time, it will use that as the first preference.

A

False. When all else fails, the Indexer’s OS time is used as the last preference

33
Q

True or False. sedcmd can be used to eliminate unwanted events

A

False. You have to use transforms.conf sedcmd can only be used to mask or truncate data

34
Q

True or False. When using tranforms.conf, the SOURCE_KEY is set to _raw by default

A

True. If you do not specify the SOURCE_KEY in transforms.conf, it defaults to _raw

35
Q

True or False. props.conf and transforms.conf are used to store Field Extractions, Lookups, Saved Searches and macros

A

False. They are used only for Field Extractions and Lookups

36
Q

True or False. Any user belonging to any user role has the ability to reassign any KO

A

Fals. Only users belonging to the admin role can assign any KO

37
Q

True or False. When you are using Splunk Web and select the REGEX option in the Field Extractor, it uses props.conf and transforms.conf in the background

A

False. It only uses props.conf Delimiter based extractions entries in props.conf and transforms.conf are manually created

38
Q

Which installer will you use to install the Search Head?

A

Splunk Enterprise

39
Q

When you install Splunk on a Windows OS, you also have to configure the boot-start?

A

False. You only need to do that on a Linux installation

40
Q

True or False. The default Splunk Web port is set to 8000

A

True

41
Q

True or False. Splunk provides separate licenses for metrics and events data

A

False. Metrics data draws from the same license quota as event data

42
Q

True or False. Search Heads also need an Enterprise License (or set as a slave to a License Master with an Enterprise License) even though we have not configured any inputs

A

True

43
Q

True or False. If the indexing exceeds the daily license quota in a pool, your license will go into a violation

A

False. If the indexing exceeds the allocated daily quota in a pool, an alert is raised. If it is not fixed by midnight then the alert turns into a warning. 5 or more warnings on an enforced Enterprise license or 3 warnings on a Free license, in a rolling 30-day period, is a violation

44
Q

True or False. Write permissions to an app means that the user’s role is able to modify the app

A

False. User’s role with write permission can add/delete/modify knowledge objects used in the app

45
Q

True or False. Universal forwarders don’t have a web interface, but they can still benefit from an app

A

True

46
Q

Which configuration file tells a Splunk instance to ingest data?

A

inputs.conf

47
Q

True or False. When Splunk starts, configuration files are merged together into a single run-time model for each file type

A

True

48
Q

True or False. btool shows on-disk configuration for requested file

A

True

49
Q

True or False. Splunk, by default automatically sets the frozen path when you create an index

A

False. Frozen path is not set by default. Data is set to delete by default

50
Q

True or False. When Hot Buckets roll to Warm they go to a different directory

A

False, Hot and Warm buckets stay in the same directory. When Hot buckets roll to Warm they are renamed

51
Q

True or False. _introspection index tracks system performance and Splunk resource usage data

A

True

52
Q

True or False. Frozen buckets roll to Thawed automatically

A

False. To thaw a frozen bucket you will have to start by copying the bucket directory from the frozen directory to the index’s thaweddb directory and follows the steps mentioned on slide “Restoring Frozen Bucktes”

53
Q

True or False. When creating an Index from the web, it creates a stanza in inputs.conf

A

False. It creates a stanza in indexes.conf

54
Q

True or False. When running the splunk clean command, you can set a date range for the events you want to delete.

A

False. There is no option to set a date range

55
Q

True or False. If you are installing a Search Head and an Indexer, Splunk requires an admin account on each instance

A

True

56
Q

True or False. If you want a role that is “like” user but with some capabilities turned off, you can create a new role that inherits from the user role and remove some of the capabilities

A

False. You will have to create a new role that does NOT inherit from the user role, turn on all of the same capabilities as in user role, except those you want turned off

57
Q

True or False. You can unlock a user from the CLI

A

True

58
Q

True or False. You have to configure a separate receiving port on the indexer for each universal forwarder

A

False. You do not have to create a separate port for each UF

59
Q

True or False. When you install a UF on a Windows OS, you get a GUI for the UF

A

False. Universal Forwarders do not have a GUI on Windows OS or other OSs

60
Q

The command splunk add forward-server indexer:receiving-port will create stanza(s) in which conf file?

A

outputs.conf

61
Q

True or False. When adding a Search Peer you have to enter a username and password of an account on the search peer, the account must have the edit_role capability

A

False. The account must have edit_user capability

62
Q

True or False. Knowledge bundles contain knowledge objects required by the indexers for searching

A

True

63
Q

True or False. A quarantined search peer is prevented from performing new searches but continues to attempt to service any currently running search

A

True

64
Q

As an admin, you want to look at the contents of the zip file created as a result of executing a diag. How would you check it?

A

Splunk it! Ingest the zip file on your test server into a test index

65
Q

What are the two types of clustering provided by Splunk?

A

Indexer clustering and search head clustering

Splunk Admin Knowledge Check (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions