Splunk 101 Flashcards

1
Q

What is Machine Data?

A

Machine data is automatically generated by programmable things, like factory machinery, smart cars, smart city systems, IoT devices, IT infrastructure, and the smartphones we carry.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does Splunk software do?

A

Splunk gathers, analyzes, filters, refines, and allows to search into big piles of machine data, to aid (mostly buisness) decision making.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Splunk?

A

Splunk is proprietary software that logs, stores, and analyzes enormous amounts of data quickly to derive insights from the patterns discovered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are 3 basic components of Splunk?

A

Forwarder: collects data at the source and forwards it to the indexers.
Indexers: stores and organizes data, and makes it searchable
Search Head: transforms data into desired end products, such as reports and alerts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a database?

A

A database is an organized collection of structured information, or data, typically stored electronically in a computer system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Give a few examples of databases

A

MySQL, SQL server, Oracle, Redis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a forwarder and what does it do?

A

A forwarder collects data at the source and forwards it on to the indexers for processing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is an indexer and what does it do?

A

An indexer parses, organizes and stores data, and maintains searchable copies of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a search head and what does it do?

A

A search head allows a user to retrieve data and transform it into usable insights using reports and alerts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How does data flow through Splunk?

A

From the source, it gets collected with the forwarder, sent to the indexers for parsing, processing and storage. The users then access the search head, which will communicate with the indexers to retrieve the data that the user is looking for.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a deployment server and what does it do?

A

A deployment server is a configuration manager that sends configurations (or settings that tell a server how to behave) to any cluster of servers. It can be used with all three main components: forwarders, indexers or search heads.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a deployment client?

A

A deployment client is any server that receives configurations from the deployment server. That could be a forwarder, a search head or an indexer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a serverclass?

A

A serverclass is a logical grouping of a group of deployment clients that are meant to receive a set of (the same) configurations. A serverclass can be grouped by location, by machine type, by component or any of that combined.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does serverclass relate to the deployment server?

A

A serverclass relates to a deployment server because a deployment server must have a targeted group of servers set up to receive its configurations. We do this by putting servers into serverclasses that will all receive the same set of config files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a purpose of configuration files in Splunk?

A

Configuration files program the behavior of a server by setting attributes. This is similar to going into “Preferences” of a new cellphone to configure your preferred settings, or changing the “Settings” within a computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name the 4 basic indexer and forwarder level configuration files, and what do they do?

A

Inputs.conf - tells Splunk which files to monitor within a server
Outputs.conf - tells Splunk where to send the data that it has collected
Indexes.conf - configures the indexes and instructs the indexers on how to retain the incoming data
Props.conf - stands for “properties”, and this configures the properties of the incoming data and the way it is parsed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How are serverclasses, deployment servers, deployment-apps and inputs.conf all connected?

A

You place an inputs.conf file within the deployment-apps directory WITHIN the deploymentserver, and this configuration file tells a server which directory to monitor.

On the deployment server, you then create a serverclass, where you place the inputs.conf. You then add the client(s) that need to receive this configuration. Once a client is added to a serverclass, it will receive whatever configurations are also placed within the serverclass.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How would you install any Splunk component that is not a universal forwarder?

A

Via Splunk enterprise installer package, so technically I would not install a Splunk component, but configurate the package to be given Splunk component.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the maximum number of concurrent users per search head?

A

12

20
Q

What is a data centre?

A

A data center is a facility used to house computer systems or servers and associated components, such as network communications and storage systems.

21
Q

What does “on-prem” mean?

A

On-premises software (also incorrectly referred to as on-premise, and alternatively abbreviated “on-prem”) is installed and runs on computers on the premises of the person or organization using the software, rather than at a remote facility such as a server farm or cloud.

22
Q

With what packages is Splunk installed?

A

Universal Forwarder Installer Package and Splunk Enterprise Installer Package

23
Q

Name a few popular network devices vendors

A

Huawei, Cisco, NVIDIA, Aruba, Dell

24
Q

What is a difference between front end users/clients and Splunk admins?

A

Front end users/clients are people who use Splunk who are not Splunk admins
Splunk admins are people with through and through knowledge about Splunk, and they manage it on front end, and back end level

25
Q

Name a few data types

A

JSON, XML, CSV, syslog

26
Q

Where do you place .conf files on deployment server?

A

[splunk home]/etc/deployment-apps/[app name]/local/[config file]

27
Q

At what level the data is being stored in Splunk?

A

Data is being stored at the indexer level.

28
Q

What do we call as an “agent” in Splunk environment?

A

The universal forwarder

29
Q

What does deployment server manages?

A

Deployment Server manages it’s clients, so other Splunk components/servers.

30
Q

How to make sure that a new changes to the configuration files are going to be saved?

A

We have to restart Splunk

31
Q

What is the maximum amount of data that can flow through Indexer daily?

A

250 gb

32
Q

How to know from monitorin stanza, if the data is being gathered on linux or windows server?

A

windows:
monitor://C:\app\log\data\catalina.out
linux:
monitor:///varl/log/secure

33
Q

Where are Splunk configuration files stored?

A

Splunk_home/etc/

34
Q

What does indexes.conf file do?

A

Specifies the name of the index, how to store the data that has been indexed and how long it needs to be stored

35
Q

What does props.conf do?

A

Tells Splunk how to parse and refine the data

36
Q

What does Inputs.conf do?

A
Tells Splunk what data to monitor and where
monitor://C:\app\log\data\catalina.out
disabled=0
sourcetype=syslog
index=security
37
Q

What does Outputs.conf do?

A

Tells Splunk where to send the data it has just collected
[tcpout:indexer_group]
disabled=false
server = [ipadress]:[port]

38
Q

What is a deployment-app?

A

It is a bundle of configuration files managed by deployment server

39
Q

Which Splunk component doesn’t have GUI?

A

The universal forwarder

40
Q

How to access search head of Splunk?

A

Through ip adress, a port, and credenstials

41
Q

What file would tell Splunk for how long to store the data for?

A

indexes.conf

42
Q

What do you see on the search head?

A

Graphs, charts, reports, dashboards, visualizations, etc…

43
Q

How does JSON data look like?

A

Check it out on google images

44
Q

How does CSV data look like?

A

Check it out on google images

Comma Seperated Values

45
Q

How does syslog data look like?

A

Check it out on google images

46
Q

How does XML data look like?

A

Check it out on google images