SPLK-1003 Getting Data IN And Forwarder Management — 20 Questions

Question 1

You need to ensure that a specific app deployed via Deployment Server overwrites local configurations on the client. What is the correct way to handle this?

Accepted Answer

Use the 'restartSplunkd = true' attribute in serverclass.conf.. App precedence is managed by directory hierarchy; app directory content is overwritten by local configuration in some cases, but specifically, you use the 'restart' or 'reload' attributes in serverclass.conf, and deployment server overrides are controlled by file precedence.

Answer

Use the 'override = true' flag in inputs.conf.

Answer

Use the 'priority' attribute in serverclass.conf.

Answer

Manually delete the local files.

Question 2

Which THREE items should be included in a deployment app package distributed by the Deployment Server?

Accepted Answer

inputs.conf. Apps typically contain configuration files, scripts, and potential lookup files.

Answer

indexes.conf

Answer

splunk-launch.conf

Question 3

What is the primary function of the Deployment Server?

Accepted Answer

Centralized management of configuration files. The Deployment Server acts as a central repository for managing configurations and apps across forwarders.

Answer

Indexing data

Answer

Parsing data

Answer

Performing searches

Question 4

To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?

Accepted Answer

[tcp://9997]. TCP and UDP inputs require the [tcp://] or [udp://] stanza in inputs.conf.

Answer

[script://./bin/my.py]

Answer

[monitor:///var/log/]

Answer

[winhost://]

Question 5

A Universal Forwarder is failing to send data to the Indexer. The indexer shows no incoming traffic. Where is the first place you should check for errors?

Accepted Answer

$SPLUNK_HOME/var/log/splunk/splunkd.log. The splunkd.log on the forwarder contains logs regarding connectivity and data sending issues.

Answer

The Splunk Web UI on the Indexer

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/indexes.conf

Question 6

You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?

Accepted Answer

Create two server classes and use machine class filters.. Serverclass.conf allows targeting clients using filters based on machine name or other attributes.

Answer

Use an Intermediate Forwarder for the 50 machines.

Answer

Modify the global serverclass.conf without a class.

Answer

Manually copy the app to the forwarders.

Question 7

You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?

Accepted Answer

props.conf and transforms.conf. Filtering data happens on the Heavy Forwarder within props.conf and transforms.conf.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 8

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts should reside within an app directory to ensure they are handled correctly by the deployment server and permissions.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/

Question 9

You are deploying a Universal Forwarder to a Windows server that must monitor local Event Logs and send them to an Indexer. Which component is required to handle the parsing of these logs before they are forwarded?

Accepted Answer

The Indexer. Universal Forwarders do not perform heavy parsing. They forward data as-is, and the Indexer handles the parsing.

Answer

The Deployment Server

Answer

An intermediate UF

Answer

A Heavy Forwarder

Question 10

Which capability is exclusive to a Heavy Forwarder compared to a Universal Forwarder?

Accepted Answer

Parsing data. Heavy Forwarders can perform full parsing, indexing, and routing of data.

Answer

Collecting local files

Answer

Connecting to a Deployment Server

Answer

Forwarding data

Question 11

Which protocol is the default used by Splunk Universal Forwarders to communicate with Indexers?

Accepted Answer

S2S (Splunk-to-Splunk). Splunk uses the Splunk-to-Splunk (S2S) protocol, typically over TCP/9997.

Answer

Syslog

Answer

HTTP

Answer

SNMP

Question 12

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 13

To ensure a Universal Forwarder is using the correct index, where is the 'index' attribute defined?

Accepted Answer

inputs.conf. The index for a data source is defined in inputs.conf.

Answer

props.conf

Answer

outputs.conf

Answer

server.conf

Question 14

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 15

When configuring a Deployment Client, what must be defined in deploymentclient.conf?

Accepted Answer

deploymentServer URI. The client must specify the URI and port of the Deployment Server.

Answer

The index location.

Answer

The list of indexers.

Answer

The password for the admin user.

Question 16

Which user interface feature allows you to view the connectivity status of all forwarders reporting to an Indexer?

Accepted Answer

Forwarder Management. The Forwarder Management dashboard provides a high-level view of connected forwarders.

Answer

License Manager

Answer

Data Inputs

Answer

Indexes

Question 17

If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?

Accepted Answer

log-local.cfg. log-local.cfg (or log.cfg) controls the granularity of internal Splunk logging.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 18

What is the consequence of having the same 'serverName' in server.conf for two different Universal Forwarders?

Accepted Answer

Splunk will merge data metrics for both forwarders in internal reports.. Splunk uses the serverName to uniquely identify internal logs; duplicate names cause conflicts in the monitoring console.

Answer

The Indexer will block both connections.

Answer

The forwarders will immediately stop sending data.

Answer

The second forwarder will fail to start.

Question 19

What is the purpose of the 'whitelist' and 'blacklist' attributes in a serverclass.conf file?

Accepted Answer

To filter which forwarders receive the app.. These attributes filter which clients receive specific deployment apps.

Answer

To prevent unauthorized users from accessing the UI.

Answer

To filter the types of logs collected.

Answer

To limit the network bandwidth usage.

Question 20

How do you restart the Splunk service on a Linux-based Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/bin/splunk restart. The standard command is 'splunk restart'.

Answer

service splunk stop

Answer

kill -9 $(pgrep splunk)

Answer

reboot