Exam (elaborations)
SPLUNK ADMIN QUESTIONS AND ANSWERS
- Course
- Institution
SPLUNK ADMIN QUESTIONS AND ANSWERS
[Show more]
Content preview
SPLUNK ADMIN QUESTIONS AND ANSWERSSystem Admin vs. Data Admin
SYSTEM ADMIN responsibilities: - Answers--Install, configure, and manage Splunk
components
-Install and manage Splunk apps
-Manage Splunk licensing
-Manage Splunk indexes
-Manage Splunk users and authentication
-Manage Splunk configuration files
-Monitor MC and respond to system health alerts
System Admin vs. Data Admin
DATA ADMIN responsibilities: - Answers--Work with users requesting new data sources
-Document existing and newly ingested data sources
-Design and manage inputs UFs/HFs to capture data
-Manage parsing, event line breaking, timestamp extraction
-Move configuration through non-production testing as required
-Deploy changes to production
-*Manage Splunk configuration files
Enterprise Trial License - Answers--Downloads with product
-Features same as enterprise except for 500 MB per day limit
-Only valid for 60 days, after whcih one of the other 3 license types must be activated
-*Sales trial license* is a trial Enterprise license of varying size and duration
Enterprise License - Answers--Purchased from Splunk
-Full functionality for indexing, search head, deployment server, etc.
-Sets the daily indexing volume
-No enforcement license, allows users to keep searching even if you are in a license
violation period.
Free License - Answers--Disables alerts, authentication, clustering, distributed search,
summarization, and forwarding to non-Splunk servers
-Allows 500MB/day of indexing and forwarding to other Splunk instances
Forwarder License - Answers--Sets the server up as a heavy forwarder
-Applies to non-indexing forwarders
-Allows authentication, but no indexing
LICENSE WARNINGS and VIOLATIONS
If the indexing exceeds the the allocated daily quota in a pool...
, What happens next? - Answers-an alert is raised in Messages (pool warning) on any
page in Splunk Web
*The daily license quota resets at midnight*
LICENSE WARNINGS and VIOLATIONS
How many warnings on an enforced Enterprise license is a violation? - Answers-5, in a
rolling 30-day period
LICENSE WARNINGS and VIOLATIONS
How many warnings on a Free license is a violation? - Answers-3, in a rolling 30-day
period
LICENSE WARNINGS and VIOLATIONS
What happens to Splunk Enterprise 6.5.0 and later during the violation period? -
Answers-Splunk Enterprise 6.5.0 and later provides warnings but it does not disable
search during the violation period.
*Prior versions of Splunk would disable search*
What counts as Daily License quota? - Answers-All data from all sources that is indexed
-It is the data (full size) that flows through the parsing pipeline, per day
-It is not the amount of storage used by the indexes
What DOES NOT count against your Daily License quota? - Answers--Replicated data
(Index Clusters)
-Summary Indexes
-Splunk internal logs (_internal, _audit, etc. indexes)
-Structural components of an index (metadata, tsidx, etc.)
How does metrics data count against a license?
And where does it draw from? - Answers-Metrics data counts against a license at a
fixed 150 bytes per metric event
*Metrics data draws from the same license quota as event data*
When adding a license, Licenses are stored under... - Answers-
SPLUNK_HOME/etc/licenses
License Pooling
What is a Pool? - Answers-Pools allow licenses to be subdivided and assigned to a
group of indexers
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller GEEKA. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $11.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81989 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now