What is Splunk?
Splunk is Google for your machine data.It’s a software/Engine which can be used for searching,visualizing,Monitoring,reporting etc of your enterprise data.Splunk takes valuable machine data and turns it into powerful operational intelligence by providing real? time insight to your data through charts,alerts,reports etc
Compare Splunk & Spark
| Criteria | Splunk | Spark |
| Deployment area | Collecting large amounts of machine generated data | Iterative applications & in-memory processing |
| Nature of tool | Proprietary | Open Source |
| Working mode | Streaming mode | Both streaming and batch mode |
What are common port numbers used by Splunk?
Below are common port numbers used by splunk,however you can change them if required
| Service | Port number Used |
| Splunk Web Port: | 8000 |
| Splunk Management Port: | 8089 |
| Splunk Indexing Port: | 9997 |
| Splunk Index Replication Port | 8080 |
| Splunk network port | 514 (Used to get data in from netwok port i.e. UDP data) |
| KV store | 8191 |
What are components of splunk/splunk architecture?
Below are components of splunk:
1) Search head – provides GUI for searching
2) Indexer – indexes machine data
3) Forwarder -Forwards logs to Indexer
4) Deployment server -Manges splunk components in distributed environment
Which is latest splunk version in use?
Splunk 6.3
What is splunk indexer?What are stages of splunk indexing?
The indexer is the Splunk Enterprise component that creates and manages indexes. The primary functions of an indexer are:
-Indexing incoming data.
-Searching the indexed data.
Picture
What is a splunk forwarder and What are types of splunk forwarder?
There are two types of splunk forwarder as below
a) universal forwarder(UF) -Splunk agent installed on non-Splunk system to gather data locally, can’t parse or index data
b) Heavy weight forwarder(HWF) – full instance of splunk with advance functionality.
– Generally works as a remote collector, intermediate forwarder, and possible data filter because they parse data, they are not recommended for production systems
what are most important configuration files of splunk OR can you tell name of few important configuration files in splunk?
props.conf
indexes.conf
inputs.conf
transforms.conf
server.conf
What are types of splunk licenses?
Enterprise license
Free license
Forwarder license
Beta license
Licenses for search heads (for distributed search)
Licenses for cluster members (for index replication)
What is splunk app?
splunk app is container/directory of configurations,searches,dashboards etc. in splunk
Where does splunk default configuration is stored?
$splunkhome/etc/system/default
What features are not available in splunkfree ?
splunk free lacks these features:
authentication and scheduled searches/alerting
distributed search
forwarding in TCP/HTTP (to non-splunk)
deployment management
what happens if the license master is unreachable?
license slave will start a 24-hour timer, after which search will be blocked on the license slave (though indexing continues). users Will not be able to search data in that slave until it can reach license master again
what is summary index insplunk?
The Summary index is the default summary index (the index thatSplunk Enterprise uses if you do not indicate another one).
If you plan to run a variety of summary index reports you may need to create additional summary indexes.
What is splunk DB connect?
Splunk DB Connect is a generic SQL database plugin for Splunk that allows you to easily integrate database information with Splunk queries and reports.
Can you write down a general regular expression for extracting ip address from logs?
There are multiple ways we can extract ip address from logs.Below are few examples.
Regular Expression for extracting ip address:
rex field=_raw “(?<ip_address>\d+\.\d+\.\d+\.\d+)”
OR
rex field=_raw “(?<ip_address>([0-9]{1,3}[\.]){3}[0-9]{1,3})”
What is difference between stats vs transaction command?
The transaction command is most useful in two specific cases :
- Unique id (from one or more fields) alone is not sufficient to discriminate between two transactions. This is the case
- when the identifier is reused, for example web sessions identified by cookie/client IP. In this case, time span or pauses are also used to segment the data into transactions.
- In other cases when an identifier is reused, say in DHCP logs, a particular message may identify the beginning or end of a transaction.
- When it is desirable to see the raw text of the events combined rather than analysis on the constituent fields of the events.
- In other cases, it’s usually better to use stats as the performance is higher, especially in a distributed search environment.
- Often there is a unique id and stats can be used.
How to troubleshoot splunk performance issues?
Answer to this question would be very wide but basically interviewer would be looking for following keywords in interview :
- Check splunkd.log for any errors
- Check server performance issues i.e. cpu/memory usage,disk i/o etc
- Install SOS (Splunk on splunk) app and check for warning and errors in dashboard
- check number of saved searches currently running and their system resources consumption
- install Firebug, which is a firefox extension. After it’s installed and enabled, log into splunk (using firefox), open firebug’s panels,
switch to the ‘Net’ panel (you will have to enable it).The Net panel will show you the HTTP requests and responses along with the time spent in each. This will give you a lot of information quickly over which requests are hanging splunk for a few seconds, and which are blameless. etc..
What are buckets? explain splunk bucket lifecycle?
Splunk places indexed data in directories, called as “buckets”. It is physically a directory containing events of a certain period.
A bucket moves through several stages as it ages :
- Hot – Contains newly indexed data. Open for writing. One or more hot buckets for each index.
- Warm – Data rolled from hot. There are many warm buckets.
- Cold – Data rolled from warm. There are many cold buckets.
- Frozen – Data rolled from cold. The indexer deletes frozen data by default, but you can also archive it. Archived data can later be thawed (Data in frozenbuckets is not searchable)
By default, your buckets are located in $SPLUNK_HOME/var/lib/splunk/defaultdb/db. You should see the hot-db there, and any warm buckets you have.By default, Splunk sets the bucket size to 10GB for 64bit systems and 750MB on 32bit systems.
What is the different between stats and eventstats commands?
Stats command generate summary statistics of all existing fields in your search results and save them as values in new fields.
Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the
aggregation is pertinent to that event.
eventstats computes the requested statistics like stats, but aggregates them to the original raw data.
Who are the biggest direct competitors to Splunk?
logstash, Loggly, Loglogic,sumo logic etc..
splunk licenses specify what?
how much data you can index per calendar day
how does splunk determine 1 day, from a licensing perspective?
midnight to midnight on the clock of the license master
how are forwarder licenses purchased ?
They are included with splunk, no need to purchase separately
What is command for restarting just the splunk webserver?
splunk start splunkweb
What is command for restarting just the splunk daemon?
splunk start splunkd
What is command to check for running splunk processes on unix/Linux ?
ps aux | grep splunk
What is Command to enable splunk to boot start?
$SPLUNK_HOME/bin/splunk enable boot-start
How to disable splunk boot start?
$SPLUNK_HOME/bin/splunk disable boot-start
What is sourcetype in splunk?
Sourcetype is splunk way of identifying data
Comments
Post a Comment