SPLK-1003: Splunk Enterprise Certified AdminDemo

Forwarder input configurations are packaged and deployed as apps through the deployment server; the app contains the relevant input configuration files.

Separate Splunk indexes allow different data-retention settings, role-based access control that restricts which users can search particular data, and logical organization of stored data. The number of users is not a reason to create separate indexes.

Splunk Enterprise HTTP Event Collector accepts JSON event data at the services/collector endpoint. Splunk’s REST API reference identifies this endpoint as the one used to send events to HEC.

Splunk derives the system-wide concurrent historical-search limit from max_searches_per_cpu × number_of_cpus + base_max_searches. Scheduled searches consume a portion of that overall concurrency capacity, while ad-hoc searches use the same capacity. Adding CPUs therefore raises the number of simultaneous searches a single search head can admit.

A Splunk directory monitor recursively examines readable subdirectories and consumes discovered text files. New files are detected as they appear, and compressed files are supported rather than ignored by default.

Splunk custom roles can use search-term filters to restrict searches, define a search-jobs quota that limits concurrent searches, and control the indexes a role may search. Splunk does not provide a separate search-term whitelisting option for custom roles.

For multiple LDAP servers, Splunk lists LDAP strategies in the authSettings setting in authentication.conf and queries their servers in that listed order when locating a user. LDAP groups can be explicitly mapped to Splunk roles, SSL is optional, and native local Splunk users take precedence over identically named LDAP users.

The set deploy-poll command configures deployment-server polling for a deployment client. Custom Splunk configuration is stored under SPLUNK_HOME/etc/system/local; Splunk documents this configuration as deploymentclient.conf in that directory.

Indexed field extractions configured in props.conf are performed during Splunk’s parsing phase, before the data is indexed.

A deployment server distributes app content from its $SPLUNK_HOME/etc/deployment-apps/<app>/ directory. After modifying an app’s contents, running splunk reload deploy-server causes the deployment server to detect the update and redeploy it to the associated clients.

SHOULD_LINEMERGE = false prevents Splunk from performing line merging when each line is already a complete event, avoiding unnecessary event-processing work.

Search-time field extractions are applied while searches run, so their configuration belongs on the search-head tier. Splunk documentation directs that manual file-based search-time operation configurations be made on the search head.

Splunk supports adding data inputs through Splunk Web, through CLI commands, and by manually configuring inputs.conf. File and directory monitoring is also defined with monitor stanzas in inputs.conf; monitor.conf is not the applicable configuration file.

Single sign-on (SSO) can incorporate multi-factor authentication by requiring an additional verification factor as part of the centralized sign-in process. SAML, OpenID, and LDAP are federation, identity, or directory protocols rather than MFA methods by themselves.

A heavy forwarder parses incoming data into individual events before forwarding it, enabling event-level examination, tagging, and routing. Universal forwarders normally forward unparsed data with only minimal processing. Splunk: Types of forwarders

Splunk Enterprise preconfigures internal indexes, including _internal for its internal logs and processing metrics and _thefishbucket for file-monitoring ingestion state. _external is not a built-in index, and _licence is not the name of a default Splunk Enterprise index.

frozenTimePeriodInSecs sets the number of seconds after which indexed data rolls to frozen, thereby controlling time-based data retention. Without a coldToFrozenScript, data is deleted when it rolls to frozen.

Event processing takes place during the parsing phase, where incoming data is processed into individual events and associated event metadata is determined.

A UDP input does not provide reliable delivery or retransmission. During a Splunk restart, the listener is unavailable and UDP datagrams sent to it can be dropped, so data may be lost. The configuration does not enable a persistent queue.

Native Splunk accounts are read from $SPLUNK_HOME/etc/passwd. When moving to LDAP and disabling existing native accounts, Splunk directs administrators to replace that file with a blank passwd file (after moving the original), then restart Splunk Enterprise.

Splunk Enterprise integrates RADIUS through its scripted authentication API. A Python authentication script acts as the intermediary between Splunk Enterprise and an external RADIUS system, whereas LDAP and SAML are supported authentication schemes configured directly; AD FS can serve as a SAML identity provider.

Splunk rolls warm buckets to cold when the maximum configured number of warm buckets (maxWarmDBCount) is reached, selecting the oldest warm bucket to roll.

MAX_TIMESTAMP_LOOKAHEAD limits how many characters Splunk examines for a timestamp starting at the position established by TIME_PREFIX. With TIME_PREFIX = ^, parsing begins at the start of the event. The configured timestamp, including milliseconds and the numeric time-zone offset, is 29 characters long, so a lookahead of 30 is the appropriate available value.

Data Preview’s Set Source Type interface provides Event Breaks and Timestamp controls, refreshes the preview as settings change, and includes an Advanced tab for props.conf attribute/value configurations.