Splunk admin - Study guides, Class notes & Summaries

Architect Exam Questions Answers 100% correct What specific things should be included in a deployment plan? -Goals -User Roles -Current topology, physical and logging -Splunk deployment topology -Data source inventory -Data policy definition -splunk Apps -Educ./training plan -Deployment Schedule What are the 3 main stages in a Splunk Deployment Infrastructure planning Splunk deployment and data enrichment user planning and roll out What are some examples of Architect t...

Splunk Admin Exam Questions With Complete Solutions Which installer will you use to install the Search Head? a) Splunk Enterprise b) Splunk Universal Forwarder a) Splunk Enterprise When you install Splunk on a Windows OS, you also have to configure the boot-start. True or False False. You only need to do that on a Linux installation. Splunk must be manually started on *NIX until boot-start is enabled.

SPLUNK ADMIN QUESTIONS AND ANSWERS

Which layer allows users to submit queries using SPL, and consolidates and renders visualizations of the data for users? a) Searching b) Indexing/Parsing c) Inputs - Answer a) Searching Which of the following statements is false? a) For input, Splunk must be able to access data sources. b) It is best to run Splunk as a super-user, such as root on *NIX or administrator on Windows. c) The Splunk account needs to access scripts used for inputs and alerts. d) On Windows, you should use a d...

Splunk Admin Exam With Complete Solutions 100% Correct Latest Update...

Splunk Admin Exam/172 Questions with Verified Answers

SPLUNK ADMIN QUESTIONS AND ANSWERS

Indexes CORRECT ANSWER notable = notable events created by correlation searches gia_summary = for Sec Intel > User Intel > Access Anomalies dashboard, filled by "Access - Geographically Improbable Access - Summary Gen" threat_activity = threat gen search matches(every 5 min) Roles CORRECT ANSWER ES User = Real time searches/view dashboards ES Analyst = Owns notable events/event status change, Start investigations, delete investigation entries ES Admin = Configures, manages cor...

command for restarting just the splunk webserver CORRECT ANSWER splunk start splunkweb command for restarting just the splunk daemon CORRECT ANSWER splunk start splunkd command to check for running splunk processes on *nix CORRECT ANSWER ps aux | grep splunk run this as root to update your system boot configuration so that splunk starts when system boots CORRECT ANSWER $SPLUNK_HOME/bin/splunk enable boot-start run this as root to update your system boot configuration to stop splunk b...