Splunk Core Certified User Flashcards
what are considered hosts by splunk ?
computers, sensors, virtual machines, web servers, network devices, databases
hosts usually generate a variety of data including
fault
configuration
accounting
performance
security
system logs
application logs
metrics
tickets
where can splunk index data from ?
- can index from any source
what are the processing components of splunk ?
indexers
forwarders
search heads
what are the management components of splunk ?
- Deployment servers
- indexer cluster manager
- search head cluster deployment
- license manager
- monitoring console
what can a search head do once connected ?
- search
- analyze
- visualize
- reports
- alerts
- dashboard
- knowledge
what are some details about splunk forwarders ?
forwarders are generally installed on host machines to collect source data and send to splunk
forwarders are the primary way to send data to splunk for indexing
what are the two types of splunk forwarders ?
-Universal forwarder
Heavy forwarders
- configured from full splunk enterprise installation
- can parse and filter before forwarding
what is a splunk component that resides on machines originating data ?
forwarder
what is the difference between universal and heavy forwarders
heavy forwarders can parse data
how does splunk data flow initially ?
data from hosts —> Indexer —-> indexes on disk
what is an indexer in splunk ?
An indexer or search peer is a Splunk enterprise instance that processes and writes data into repositories as events
what is processing in regards to splunk?
- transform data into events
- assign metadata
- identify or create timestamps
- data repositories are known as indexes
- repositories containing files with index data are called buckets
what is thawed data in splunk ?
thawed data in splunk is when you are bringing data out of the archive
what is an Indexer cluster ?
- an indexer cluster is when you group indexers together to provide data replication
- cluster manager - coordinates replication activities and manages the cluster
what is a splunk component that transforms raw data into events?
indexer and heavy forwarders are the splunk components that transform raw data into events
what are some of the details regarding search heads
- allows users to write search queries SPL to search the indexed data
- distributes search requests to the indexers and merges the result back to the user
Can create fields and other knowledge objects such as
- reports
- alerts
- visualizations
- dashboards
what are some details regarding the search head cluster ?
- groups of search heads with identical configuration
- search requests from users are balanced across the SH groups
- Managed by a cluster captain
- cluster deployer, distributes apps and other configuration to cluster members
what are some details of the configuration deployment server?
- distributes content, configuration, apps to other groups of splunk instances
- distributed content is known as deployment apps
- used mostly to distribute apps to splunk forwarders
what is the forwarder manager for Splunk ?
provides a way to configure deployment servers and monitor updates
what is the license manager in Splunk ?
Hosts licenses and assigns license volume to other splunk components in a distributed deployment
License meter runs during indexing
License types
- Volume based
- Infrastructure based
- Access to splunk features
what is the monitoring console in Splunk ?
Used to view topology and performance information.
what are the three main out of the box roles in Splunk ?
User
Power
Admin
what are some of the default app examples ?
home app
search app
what is the default port for Splunk web ?
port 8000
what are some splunk default app examples ?
home app
search and reporting app
what are splunk apps ?
splunk apps are custom solutions that allow you to extend the functionality of the splunk platform
what can splunk apps do for us ?
What can Splunk Apps do for us ?
Separate workspaces for different use cases to co exist on a single instance.
- Alerts
- Reports
- Dashboards
Custom configurations to ingest data
Collections of
- Data inputs
- UI Elements
- Knowledge Objects
how do we access splunk apps ?
you can access Splunk apps on Splunk-base
what is SPL ?
SPL is Splunk processing language
what can be changed using the account settings and preferences ?
preferences - time zone
Full name
Email
Password
change the theme
what is the splunk search and reporting app ?
default app that provides an interface to search, analyze and visualize data in splunk
what is the search bar used for in splunk ?
the search bar is where you specify search criteria
what is the app navigation bar in Splunk?
shows views in the current applicationand the different apps avaliable
what is the time range picker in splunk ?
allows us to specify the time period to search
Default value is 24 hours
what are the three different types of search modes in splunk ?
Fast (better performance less info)
Smart (less performance but more info then fast mode)
Verbose (slowest performance but the most information)
what is search history in splunk ?
See a history of your searches
You can select to re-run a search
what are the different ways you can view counts of events in Splunk ?
Hosts
Sources
Source types
what is a quick way to understand data in your deployment?
the data summary type
what are the fields presented under the data summary tab ?
host
source
source type
what are the three out of the box users in splunk ?
user
power
admin
what is the user role in splunk ?
Limited access to Settings
Create private knowledge objects
Assign to basic users
what is the power role in splunk ?
Limited access to settings
Create and publish share knowledge objects
Assign to power users
what is the admin role in splunk ?
Access to all settings
Has the most capabilities
Assign to splunk admins
which roles have minimum and maximum permissions
minimum permissions is the user role
Maximum permissions is the admin role
Which Splunk component transforms raw data into events and distributes the result to an index?
Indexer
Which component of splunk is primarily responsible for saving data ?
Indexer
The three basic components of splunk are ?
Forwarder, indexer, Search head
What is Splunk ?
Splunk is a software platform to search, analyze and visualize the machine generated data
Which component of Splunk let us write SPL query to find the required data?
Search head
What Splunk Components can perform log filtering/parsing ?
Heavy forwarders
What is true about user account settings and preferences?
Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar
A collection of items contains things such as data inputs, UI elements and knowledge objects is known as what ?
An app
explain what Splunk apps are ?
It is a collection of different Splunk config files like data inputs, UI and Knowledge objects
What is the default app for Splunk Enterprise ?
Search and reporting
How many main roles do you have in Splunk ?
3
What is the default web port used by Splunk?
8000
what are some of the ways we get data in Splunk ?
Get data from Files and Directories
Get data from network sources
Get data from Windows sources
Get data from other sources
what are some of the ways we can get data from files and directories in splunk ?
Monitor files and directories
Upload static files
what are some of the ways we can get data from network sources ?
Data that comes over a network port
Both TCP and UDP protocols supported
what are some of the ways we can get data from windows sources in splunk ?
Windows Event logs
Windows registry
Windows Management Instrumentation
Active Directory
Performance monitoring
what are some of the other sources we can get data from in Splunk ?
APIs
Databases
Metrics
FIFO queues
what are some of the ways we can ingest data into Splunk ?
Use existing Apps and Add-ons
Use forwarders to get data
use HTTP event collector HEC
for custom data use
what are some of the ways we can ingest data into Splunk using existing apps and Add ons
- Splunk add-on for windows
- Splunk add-ons for AWS
- Splunk DB connect
- Splunk stream
what is the way we can use forwarders to get data ?
Install forwarders on the sources generating data
Use heavy forwarder when more processing is required before ingestion
what are ways we can use the splunk HEC to ingest data into splunk?
Use HEC to get data from the HTTP or HTTPS protocol
what is the splunk index time process ?
data is handled at the splunk data source and forwarded using the universal forwarder or heavy forwarder
then the data sources are open and read
configurations are applied to entire streams
data is sent out for indexing
what are the three phases of the splunk index time process ?
The first phase of the Splunk index time process is the input phase
The second phase of this process is the parsing phase
The third phase of this is the indexing phase
explain the parsing phase of the splunk index time process ?
Handled at
- Indexer
- Heavy forwarder
Data broken into events
Extract default metadata fields
- Host
- Source
- Sourcetype
- Index
Identify or create timestamps
Identify line termination
explain the indexing phase of the splunk index time process ?
Handled at
- Indexer
- Run License meter
- Build index data structures
- Write data to disk
what are the different ways of configuring data inputs in splunk ?
Splunk web
CLI
Configuration files edit inputs.conf
Apps and add-ons from Splunkbase
what are the three ways we can add data inputs using splunk web ?
uploads
monitor
forward
explain the upload function in splunk web
Upload local files from your computer
Only gets indexed once
what is the monitor function in splunk web
Monitor files and directories, network ports
Data located on splunk enterprise instance
Useful for testing
explain the forward function in Splunk web
Frequently used in production environments
Get data from remote machines over receiving port
Remote machines have the forwarder installed to forward data
what is the default splunk installation directory in windows ?
C:\Program Files\Splunk
what is the default splunk installation directory for linux ?
/opt/splunk/
what is the default MAC os splunk installation directory ?
/Applications/Splunk
Data source being open and read applies to?
The input phase
Select the correct option that applies to index time processing
Input, parsing, indexing
The splunk index time process can be broken down into how many phases
3
Where does licensing meter happen ?
Indexer
Which statement is true about heavy forwarders ?
Parsing, masking, forwarding
We use keywords and phrases to retrieve matched events from the index:
When searching for keywords splunk is searching the keyword against raw events in the _raw filed
The _raw field contains the entire events
To search matching phrases, use double-quotes example “user ubuntu”
what do we use wildcards for in Splunk ?
Use wildcards to match characters in string values for events in your index
what is best practice for using wildcards ?
As best practice, use wildcards at the end of the term.
in which situations do we want to avoid using wildcards ?
Avoid using at the beginning of a string example *fail
If you put a wildcard at the front it will scan every event
Can cause performance issues
should we use wildcards in the middle of a string ?
Don’t use in the middle of a string
Might cause inconsistent results especially in string containing punctuation
where should wildcards be used when searching in Splunk ?
To have better searches we should always place our wildcards at the end
The * character can be used as a wildcard
what do we use Boolean operators for ?
Use boolean operators AND, OR, NOT to combine search terms
Boolean operators must be in uppercase
The AND operator is implied between terms
Example search for failed password is the same as failed AND password
Example user NOT administrator – search events that contain the word user and does not contain the word administrator
what is the point of boolean operators ?
they are used to combine search terms
what do we have to remember when using boolean operators ?
boolean operators are always in upper case
what does the search assistant help us with in Splunk ?
The search assistant helps with writing searches by providing selections to complete strings
It helps matching searches based on recent search history
Shows list of commands after first pipe