System admin

Which Splunk installation package is used to install the Search Head?

• Splunk Search Head installation package
  

• Splunk Enterprise installation package
  

• Splunk Heavy Forwarder installation package
  

• Splunk Universal Forwarder installation package

Answer explanation

The Splunk Enterprise installation package can be used to install most Splunk server components. The Universal Forwarder (UF) installation package is a lighter version of Splunk that is simply used to forward data to indexers. The other options are not existing packages.

Which of the following operating systems configures Splunk to boot-start automatically by default?

• Windows only
  

• Linux only
  

• Both Windows and Linux

• Neither Windows and Linux

Answer explanation

On Windows, Splunk is set to start automatically on boot. On Linux, you must manually run a version of the splunk enable boot-start command.

What is the default installation path for Splunk (also known asSPLUNK_HOME) on Linux?

• /opt/splunk
  

• /var/splunk
  

• /opt/splunk/etc/var/lib

• /opt/splunk_home

Answer explanation

On Linux, the default Splunk installation path (SPLUNK_HOME) is /opt/splunk. The default Splunk database path (SPLUNK_DB) where indexes are stored is /opt/splunk/etc/var/lib.

Which of the following port numbers is associated with the splunkd process by default?

• 8000

• 8088

• 8089

• 9997

Answer explanation

Port 8089 is used by splunkd by default.
Port 8000 is the default for Splunk Web, and port 9997 is often used as a Splunk listening port.

If the Monitoring Console must be installed on a system with another Splunk component, which of the following would be the most recommended location?

• On any Search Head
  

• On a License Manager
  

• On any Deployment Server

• On any Indexer

Answer explanation

It is recommended to install the MC on it’s own system. If collocated with another Splunk component, a License Manager or a smaller Deployment Servers (environments with < 50 clients) is most recommended. Avoid Search Heads and Indexers.

Which of the following is a cloud-connected service that leverages telemetry data to provide Splunk environment insights in real-time?

• Splunk Diag
  

• Rapid Diag
  

• Splunk Instrumentation

• Splunk Assist

Answer explanation

Starting with Splunk 9.0, the MC provides Splunk Assist, a cloud-connected service for Splunk Enterprise and Splunk Cloud that leverages telemetry data to generate insights in real time. Splunk Assist uses helper packages such as AppAssist, CertAssist and ConfigAssist.

Which of the following is not true about Splunk Diag tools?

• Splunk Diag must be run from a Search Head
  

• Splunk Diag is available on the command line
  

• Splunk Diag does not retrieve index data
  

• Rapid Diag can collect data from distributed Splunk instances

Answer explanation

Splunk Diag is available from any Splunk instance.

Which of the following is true about Metrics licensing?

• Events and metrics licensing is measured the same
  

• Events licensing is capped at 150 bytes per event
  

• Metrics licensing is 150 bytes per metric event
  

• Metrics data draws from the same license quota as event data

Answer explanation

Events are measured as the data (full size) that flows through the parsing pipeline per day. Metrics measurement is capped at 150 bytes per metric event. Both types of data input draw from the same license quota.

Which of the following Splunk components do not require an Enterprise license installed?

• Search Heads
  

• Indexers
  

• Heavy Forwarders
  

• Universal Forwarders

Answer explanation

Search Heads, Indexers, Heavy Forwarders, Deployment Server and other Splunk Enterprise instances require the Enterprise license even if they are not ingesting data. Universal Forwarders do not require an Enterprise license to be installed.

Which of the following statements about license alerts, warnings, and violations is true?

• Alerts not fixed in 24 hours turn into a Violation

• 30 Warnings turns into a Violation
  

• Alerts not fixed by midnight turn into a Warning

• Free licenses are immune to Warnings

Answer explanation

Indexing that exceeds the allocated daily quota in a pool is an alert. An alert not fixed by midnight turns into a warning. 5 or more warnings on an enforced Enterprise license (or 3 warnings on a Free license) in a rolling 30-day period is a violation.