Question 1

What are the 3 main processing components of Splunk?

Accepted Answer

Forwarders Indexers Search Heads

Question 2

Raw data in an index is stored in a ________ form.

Accepted Answer

compressed

Question 3

Forwarders are typically installed on _____________.

Accepted Answer

Machines where the data originates

Question 4

The ___________ handle search management while ___________ perform the searches.

Accepted Answer

1. search heads 2. indexers

Question 5

A group of indexers configured to replicate each other\'s data is called a ________.

Accepted Answer

Index Cluster

Question 6

__________ is often the biggest bottle neck in the Splunk indexing pipeline.

Accepted Answer

Disk I/O

Question 7

Search heads do not require as much ______ as indexers but require more _________.

Accepted Answer

1. disk space 2. CPU power

Question 8

Adding more machines no matter the hardware will make your deployment perform better.

Accepted Answer

False

Question 9

Splunk indexers and Search Heads on virtual machines should have ____ of the vCPU reserved to them.

Accepted Answer

100%

Question 10

Keeping ____ synchronized across your deployment, makes sure events are returned in the proper order.

Accepted Answer

time

Question 11

What command is used to start the Splunk Enterprise server?

Accepted Answer

./splunk start

Question 12

This command can be used to make Splunk start each time the server is booted.

Accepted Answer

./splunk enable boot-start

Question 13

When logging into Splunk Enterprise for the first time, a username of ______ and a password of are used.

Accepted Answer

1. admin 2. changeme

Question 14

The _______ folder inside the Splunk Enterprise installation directory contains licenses and configuration files.

Accepted Answer

etc

Question 15

Splunk Enterprise commands are executed from the ________ directory.

Accepted Answer

bin

Question 16

The following are Splunk Enterprise processing tiers.

Accepted Answer

Data input Indexing Search Management

Question 17

Event separation happens during the ________ segment of the data pipeline.

Accepted Answer

parsing

Question 18

Events are written to disk during the _______ segment of the data pipeline.

Accepted Answer

Indexing

Question 19

The functions of the data pipeline vary drastically depending on the deployment.

Accepted Answer

False

Question 20

Splunk Enterprise licenses specify how much data you can index per __________.

Accepted Answer

day

Question 21

Any editing done to .conf files should be done in the ________ directory.

Accepted Answer

local

Question 22

The ________ index is used when an index is not specified at input time.

Accepted Answer

main

Question 23

Having multiple indexes allows:

Accepted Answer

Faster searches Access limiting Multiple retention policies

Question 24

As data is input into Splunk Enterprise, it is first placed into a ________ bucket.

Accepted Answer

hot

Question 25

Some differences between hot and warm buckets are:

Accepted Answer

Hot buckets are writable, warm buckets are not. Hot buckets are searched first. The naming convention.

Question 26

When a bucket is frozen, by default it is moved to a different location before deleting.

Accepted Answer

False

Question 27

The timezone setting in a user\'s account will effect the timestamp shown in events.

Accepted Answer

True

Question 28

_______________ define what users can do in Splunk.

Accepted Answer

Roles

Question 29

Only the ________ role can use the Delete Command by default.

Accepted Answer

can_delete

Question 30

The ______ role has the most capabilities of the predefined splunk roles.

Accepted Answer

admin

Question 31

When mixing authentication sources, scripted authentication will always take precedence.

Accepted Answer

False

Question 32

In most production environments, _______ will be used as your main source of data input.

Accepted Answer

forwarders

Question 33

Splunk uses ____________ to categorize the type of data being indexed.

Accepted Answer

sourcetypes

Question 34

The server that data is forwarded to is called the ______________.

Accepted Answer

receiver

Question 35

Indexing on a Heavy Forwarder does not affect your license.

Accepted Answer

False

Question 36

The following can be used to build apps for Splunk:

Accepted Answer

Simple XML Splunk JavaScript SDKs

Question 37

When migrating from a single instance deployment to a distributed environment, you will want to use the existing instance as an _______.

Accepted Answer

indexer

Question 38

An indexer in a distributed search environment is called a __________.

Accepted Answer

search peer

Question 39

It is a best practice to ____________ forwarders across all indexers in a search peer group.

Accepted Answer

load balance

Question 40

The management port is required when adding a search peer to a search head.

Accepted Answer

True

Question 41

DMC stands for

Accepted Answer

Distributed Management Console

Question 42

In most Splunk deployments, _________ serve as the primary way data is supplied for indexing.

Accepted Answer

forwarders

Question 43

Search strings are sent from the

Accepted Answer

Search head

Question 44

Forwarders are typically installed on __________

Accepted Answer

Machines where the data originates

Question 45

A server acting as a ___________ require the same hardware as a single deployment server.

Accepted Answer

Indexer

Question 46

Splunk Enterprise can be installed virtual environments.

Accepted Answer

True

Question 47

In a windows environment, a local system user will have access to:

Accepted Answer

all data on the local system

Question 48

Search requests are processed by the ____________.

Accepted Answer

Indexer

Question 49

____________ is the system process that handles indexing, searching, forwarding and the web interface for Splunk Enterprise.

Accepted Answer

Splunkd

Question 50

Splunk Enterprise should always be run as root in a *NIX environment.

Accepted Answer

False

Question 51

It is suggested that you have a single deployment instance available for _________.

Accepted Answer

testing and development

Question 52

A total of ____ cores are recommended per search head.

Accepted Answer

16

Question 53

Forwarders should never be installed on Windows servers.

Accepted Answer

False

Question 54

SplunkWeb is accessed on port _______ by default.

Accepted Answer

8000

Question 55

Properties in the _______ file allow you to configure how data is transformed as it is processed.

Accepted Answer

not later

Question 56

The segment of the data pipeline that stores user\'s knowledge objects is the __________ segment.

Accepted Answer

not indexing not data ainput not parsing

Question 57

This component is NOT installed from the Splunk Enterprise Package.

Accepted Answer

Universal Forwarder

Question 58

Splunk Enterprise deployment typically has ___ processing tiers.

Accepted Answer

3

Question 59

The segment of the data pipeline that stores user\'s knowledge objects is the _______ segment.

Accepted Answer

not parsing not data input

Question 60

The licensing meter takes placed at data ______ time.

Accepted Answer

indexing

Question 61

Any editing done to .conf files should be done in the _____ directory.

Accepted Answer

local

Question 62

The default management port for Splunkd is:

Accepted Answer

8089

Question 63

Search Heads require more _____ than indexers.

Accepted Answer

CPU Power

Question 64

What are some of the components installed from the Splunk Enterprise Package?

Accepted Answer

not indexer search head universal forwarder

Splunk Infrastructure Overview 6.4 (eLearning) – Flashcards

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards