Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Enterprise System Administration 9.0 > Module 1 - Deploying Splunk > Flashcards

Module 1 - Deploying Splunk Flashcards

1
Q

Four stages of Splunk

A
  • Input any text data
  • Parse the data into events
  • Index and store events
  • Search and report
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Deployment types

A
  1. Single server. Good for tests and development
  2. Single server with inputs (forwarders). Forwarders installed at data source
  3. Distributed non cluster. Collection tier: universal and heavy forwarders, other input. Indexing tier: multiple indexers. Search tier: search head
  4. Distributed non cluster with central management. Same as 3 but also includes license manager, monitoring console and deployment manager as separate components
  5. Clustered environment. Search head clustering: Replicates knowledge objects. Indexer clustering: Replicates data across indexers, Single-site or multi-site, Allows balance of growth, speed of recovery and disk usage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Deployment server purpose

A

Manages forwarders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cluster environment licensing

A

Doesn’t require additional licenses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Cluster environment components

A

Search head cluster
Indexer cluster
Forwarders
License manager
Monitoring console
Cluster manager
Shc deployer
Deployment server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Splunk enterprise packages

A

Splunk enterprise package includes all components
Universal forwarder package includes forwarder client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Server hw requirement for indexer

A

12-48 CPU cores or 24-96 vCPU
12-128GB RAM
Disk capable at least 800 IOPS
SSD for hot/warm buckets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Server hw requirement for search head

A

16 CPU cores or 32 vCPU
12GB RAM
2 x 10K RPM 300GB SAS drives, or better

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Default network ports Splunk enterprise

A

Splunkd - 8089
Web server- 8000
Web app server Proxy - 8065
KV store - 8191
No default ports for S2S receiving ports, any network/http input, index replication ports, search replication ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Default network ports Universal forwarder

A

Splunkd - 8089
NO default for any network/https input

No other components present on UF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How to view resource limits

A

ulimits -a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Best practice parameters on search beds and Indexers

A

File descriptors (ulimit -n) >= 64k, based on buckets and searches
Max user processes (ulimit -u) >= 16k, based on forwarders / concurrent searches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

NTP on Splunk

A

Enable. Best practise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Splunk users requirements

A

Avoid using root or administrator on windows

Read files and directories configured for monitoring by Splunk
*NIX: /var/log is not typically open to non-root accounts
# Write to the Splunk Enterprise directory (SPLUNK_HOME)
# Execute any scripts required (alerts or scripted input)
# Bind to the network ports Splunk is listening on
*NIX: non-root accounts cannot access reserved ports (< 1024

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Start Splunk automatically on Linux

A

Enable boot-start manually

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Start Splunk automatically on Windows

A

Started automatically by default

17
Q

Installing Splunk on Linux

A

tar zxvf splunk_package.tgz-C /opt

18
Q

Splunk directory structure

A

SPLUNK_HOME

Linux - /opt/splunk
Windows c:\Program files\Splunk

/opt/splunk/bin - contains executables
/opt/splunk/etc - configuration and licenses
/opt/splunk/car/lib/splunk - indexes

19
Q

What is SPLUNK_HOME

A

/opt/splunk

20
Q

What is SPLUNK_DB

A

/opt/splunk/var/lib/splunk

21
Q

Running Splunk at boot

A

Linux - run after installation
splunk enable boot-start -user username -systemd-managed 1

Windows - by default services set to auto start: splunkd and splunkweb

22
Q

splunkd

A

Runs on 8089 by default
Spawns and controls all splunk processes: splunk web proxy, KV store, introspection services, all searches, scripted input or scripted alert
Access, processing and indexing of incoming data
Handles all searches and displays results

23
Q

View splunkd status from CLI

A

splunk status

24
Q

Splunk web

A

Webui
Provides front end for splunkd

Http://x.x.x.:8000

25
Q

Default port for splunk web

A

8000

26
Q

Splunk web server setting

A

Access from Settings > Server settings > General settings
Configure host name, default port Default web server port, whether web server is active or not, if to use https or not

27
Q

Disable/enable web server

A

Can disable from webui
Cannot enable webui from GUI. Must do it from CLI

28
Q

Server restart

A

Any general settings modification trigger messages alert with link to restart server.

Another option to restart from GUI: settings > server controls > restart splunk

Restart from CLI: splunk restart

29
Q

CLI Start or stop splunk

A

splunk start
splunk stop
splunk restart

30
Q

Show the port that the splunkd listens on

A

splunk show splunkd-port

31
Q

Show the port that Splunk Web listens on

A

splunk show web-port

32
Q

Show the server name of the instance

A

splunk show servername

33
Q

Show the default host name used for all data inputs

A

splunk show default-hostname

34
Q

Universal Forwarders security best practice

A

Disable splunkd listener on port tcp/8089

Splunk Enterprise System Administration 9.0 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions