Splunk SH Clustering & App Building Flashcards

1
Q

What is Search Head Clustering?

A

A search head cluster is a group of Splunk Enterprise search heads that serve as a central resource for searching. You can access the same searches, dashboards, reports and so on, from any member of the cluster. In a cluster each search head has the same information, just as each indexer has the same indexes (in clusters) A search head cluster: - Minimum of THREE nodes - Share the same search artifacts - Share the same configurations - Allows more users to access the same data - If one search head goes down, searching and data high availability will continue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where does ES (enterprise security) typically reside?

A

At the search head server, which is not part of a cluster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How search heads within a cluster are often reffered as?

A

“core”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Horizontal Scaling?

A

Also known as Scaling out, which is adding more equivalently functional components in parallel to spread out a load. In splunk it means adding more specific components to the environment, so for example adding more search heads to SH cluster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does “scaling up” and “scaling out” means?

A

Scaling out is adding more equivalently functional components in parallel to spread out a load. This would be going from two load-balanced web server instances to three instances. Scaling up, in contrast, is making a component larger or faster to handle a greater load.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How to make a search head run faster?

A

Scale it up (add more CPU’s to the server)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why Use Search Head Clustering?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are search peers?

A

Search peers are indexers that the SH in SH cluster ran searches on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the captain (in splunk)?

A

The captain is in charge of managing search head activities, such as coordinating search jobs nad results distribution. The captain role can move between cluster members. It decides who does the job based of the current load. It pushes knowledge objects to indexes. It coordinates the replication of objects. It also ensures that all members of SH cluster have the same configurations.

If you create a report on one SH, the captain will replicate that report to every other search head within the cluster. The captain coordinates itself, as well as performs duties as regular search head.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a job in splunk?

A

job = search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the knowledge object in Splunk?

A

A user-defined entity that enriches the existing data in Splunk Enterprise. You can use knowledge objects to get specific information about your data. When you create a knowledge object, you can keep it private or you can share it with other users. (check google for more info as I still don’t understand what it is.)

Knowledge objects are the way Splunk gives form to the chaos of raw data. They are how you can create a multi-dimensional data structure that enables you to infer meaning and actionable insights from a steady stream of raw data.

Knowledge objects are a diverse set of classifications and constructs that make up Splunk’s data enrichment structure. They are how Splunk organizes meaning and stores it in a reusable form so you can share efforts and build upon the ideas of others. Fields, searches, and reports are all examples of knowledge objects.

The data is first stored in an indexer and then you can write search queries and perform various operations on the data. You can set up knowledge objects to make operations smarter & to bring intelligence to your systems. These knowledge objects will monitor your events & give notifications when certain conditions occur. These results can be collated and visualized by creating reports and timecharts. Summing it up, knowledge objects are at the heart of enriching your data and creating intelligence.

Knowledge objects are user-defined entities used for extracting knowledge from existing or run-time data in order to enrich data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are types of captains we have?

A
  • Static captain - we pick a server and we assigned the search head to the role of captain
  • Dynamic captain - the search heads in the cluster select the SH which is the least busy at the time, and assign the role of SH captain to that component
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the distributed environment?

A

DS managing SH, IDX, Forwarders without clustering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a load balancer?

A

A server that manages the workload between multiple machines and resides between the users and the cluster members. With a load balancer in place, users can access the set of search heads through a single interface, withoud needing to specify a particular one. Eg.: we have a user, and he wants to search something. The load balancer’s job is to decide, which of the search heads is the least busiest, and to direct user to that search head.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Deployer?

A

It Is a Splunk Enterprise instance whose sole purpose is to deploy configurations to SH nodes.

It stands outside of the cluster. Sometimes this componet can share an instance with a LM and a DS (but never another cluster node)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How to see which search head we are on? (assuming we’ve connected to it via Load balancer)

A

GUI —> Settings —> Server Settings —> General Settings

17
Q

Through which port Indexers send the search data to SH?

A
18
Q

What is the path to apps on the deployer?

A

$SPLUNK_HOME/etc/shcluster/apps

19
Q

What is the difference between an app and add-on?

A

Splunk Apps:

  • Has a web interface (UI)
  • Installed on the SH\s
  • Contains dashboards/visuals

Technical Add-Ons (TAs):

  • Does not have a GUI
  • Contains bundles of configurations for any purpose (inputs.conf, indexes.conf, outputs.conf etc.)
20
Q

What is a process of creating a custom TA for the use of configuration deployment?

A
  1. mkdir
  2. mkdir /default
  3. mkdir /local
  4. mkdir /metadata
21
Q

What .conf file every app must have?

A
22
Q

What are Guidelines for app creating?

A
23
Q

What are base apps?

A
24
Q

How we need to configure 3 main components?

A