Module 5: Getting Data into Splunk Enterprise/Cloud Flashcards
What is a Splunk intermediate forwarder?
- Last hop on the on-prem network
- Need to UF credentials from Splunk Cloud
- Gather data and parse if necessary
- Send data across the internet to Splunk Cloud for indexing
What is a Splunk Universal Forwarder?
Specifically designed to run on production servers o Lightweight o Minimal CPU and mem usages o No web interface A separate install binary Use UF for defining Splunk inputs
What is a Splunk Heavy Forwarder?
Splunk Enterprise binary configured as a forwarder (outputs.conf)
o Requires forwarder license
o Does everything except indexing
o Creates more network traffic than UF
Accepts all input types and can parse raw data
Can be used as IF for other UF
o As a mid-tier component
o Aggregate data from UFs, parse, and route to Splunk cloud
o Can be a single point of failure
What are the forwarder best practices?
• UFs are the preferred method of getting data in to Splunk cloud
• Use a HF only when necessary
o Parsing data before going into cloud
o When apps are not allowed on Splunk cloud
• Recommend ratio of forwarders to indexers is 2 UFs to 1 indexer
What are sourcetypes?
- Splunk uses source types to categorise data
- Can be used while searching to filter data
- Defined in props.conf on the indexer or heavy-forwarder
- Automatically assigned by Splunk or explicitly assigned by the data administrator.
What are the three phases of indexing?
Input phase
Parsing phase
Indexing phase
What is the input phase?
o data is read from data sources such as files and network
o Metadata such as host, source, and sourcetype are applied
o Most configuration is in inputs.conf (some in props.conf)
o Operates on the entire data stream
What is the parsing phase?
o Data is broken in to events o Timestamp extracted. o Most configuration in props.cnf (some in transforms.conf) o Operates on individual events o Event level transformations
What is the indexing phase?
o Segment events that then can be searched
o Build index
o Licence meter runs before the data is writing to disk
o Raw data and index files are written to disk (in buckets)
The Indexing pipeline can be viewed from the ___.
monitoring console (monitoring console > indexing > performance > indexing performance:instance)
What is the parsing pipeline?
Responsible for character encoding and line breaking
What is the merging pipeline?
Responsible for timestamp extraction and merges multi-line events
What is the typing pipeline?
Responsible for punctuations extraction and regex replacement
What is the indexing pipeline?
Responsible for indexing.
What are three use cases for using a HF?
- Parse and route data before sending to indexers
- Firewall rule simplification, can allow just the heavy forwarder through the firewall as opposed to all UF
- Use addons such as DBconnect and HTTP event collector.
