SPLUNK Interview Questions for freshers and experienced :-
1. What Is Splunk?
Splunk is Google for your machine data.It’s a software/Engine which can be used for searching, visualizing, Monitoring, reporting etc of your enterprise data. Splunk takes valuable machine data and turns it into powerful operational intelligence by providing real time insight to your data through charts,alerts,reports etc.
2. What would you use to edit contents of the file in Linux? Describe some of the important commands mode in vi editor?
Various editors in Linux file system- vi,jedit, ex line editor or nedit
Two important modes are as below – We can press ‘Esc’ to switch from one mode to another. However, we can press ‘i’ to enter insert mode-
- Command mode
- Insert mode
3. How do you log in to a remote Unix box using ssh?
ssh your_username@host_ip_address
4. How you will uncompressed the file? How to install Splunk/app using the Splunk Enterprise .tgz file
- tar -zxvf file_name.tar.gz
- tar xvzf splunk_package_name.tgz -C /opt
- default directory /opt/splunk
5. what does grep() stand for? how to find difference in two configuration files?
- General Regular Expression Parser.
- egrep -w ‘word1|word2’ /path/to/file
- diff -u File_name1.conf File_name2.conf
6. Talk about Splunk architecture and various stages
Data Input Stage: [accessed from the source and turns it into 64k blocks- metadata includes keys like hostname, source, source type, _time]
Data Storage Stage: [Parsing & Indexing]
Data Searching Stage: [data analysis using search head]
Universal forward > Heavy Forward (Optional) > Indexers > Search head
Deployment Server- [Use to distribute configuration file/Apps]
License master- [Use to keep track of our indexing utilizations]
7. Types Of Splunk Forwarder?
- Universal forwarder(UF) -Light weight Splunk instance- can’t parse or index data
- Heavy forwarder(HF) – full instance of Splunk with advance functionality of parsing & indexing
8. Precedence in Splunk and discuss some of the important conf files
- When 2 or more stanzas specify a behaviour that effects same item, then precedence is calculated based on stanza ASCI
- We can use priority key to specify highest/lowest priority etc
Important conf files
- props.conf
- indexes.conf
- inputs.conf
- transforms.conf
- server.conf
9. What is summary index in Splunk?
The Summary index is default summary which is used to store data as a result of scheduled searches over period of time. It helps to efficiently process large volume of data.
10. What are types of field extraction. How to mask a data in either of case
- Search time field extraction
- Index time field extraction
11. What do you mean by roles based access control?
It is very crucial to provide only appropriate roles to appropriate team. This will prevent unauthorized access to any app or data for that matter.
It is very important that we provide access very meticulously and limit their search capability by providing access to only those indexes which needs to be.
12. What is null queue
Null queue is an approach to trim out all the unwanted data.
13. Trouble shooting Splunk errors in splunk
- See if the process is running – ./splunk status
- IF running go and check log for any latest errors using below command- tail 20
- $SPLUNK_HOME/var/log/log/splunk/splunkd.log
- Splunk crash also happens because of low disk memory- sheck if tere is any crash*log files
- Check log,splunkd.log,metrics.log or web*log
- In order to check any conf file related concerns use btool – ./splunk btool props list –debug >/tmp/props.conf
- Search for errors and warning by typing- Index=_internal | log_level=error OR log_level=warn*
- Check for the search directory for recent search at – $SPLUNK_HOME/var/ran/splunk/dispatch
- Enable debug mode.Splunk software has a debug parameter (–debug) that can be used when starting splunk
- Check for log file OR use below search query – index=_introspection
14. What are the types of search modes supported in splunk?
- Fast mode
- Verbose mode
- Smart mode
15. What is difference between source & source type
Source – Identifies as source of data
Source type- in general it refers to data structure of events or format of data
Different sources may have same source type
Command to restart splunk web server
/opt/splunk/bin/splunk start splunkweb
16. How to use btool for splunk conf file approach
/opt/splunk/bin/splunk cmd btool input list
17. Create new app from templet
/opt/splunk/bin/splunk create app New_App -templet sample_App
18. Rollback your aplunk web configuration bundle to previous version
/opt/splunk/bin/splunk rollback cluster-bundle
19. To specify minimum disk usage in splunk
./splunk set minfreemb = 20000
./splunk restart
20. Command to change splunkweb port to 9000 via CLI
./splunk set web-port 9000
21. How to turn down a peer without affecting any other peer of cluster?
./splunk offline
22. How to show which deployment server in configured to pull data from?
./splunk show deploy-poll
23. CLI to validate bundles
./splunk validate cluster-bundle
24. How to see all the license pool active in our Splunk environment?
./splunk list license
25. Which command is used to the “filtering results” category- explain?
“search”, “where”. “Sort” and “rex”
26. What is join command and what are various flavours of join command.
- Join command is used to combine result of a subsearch with result of a search- One or more fields must be common to each results set
- Inner join- result of inner joint do not include event with NO MATCH
- Left/Outer join- It include events in the main search and matching having correct field values
..|join type=inner P_id [search source=table2] {}
27. Tell me the syntax of Case command
It’s a comparison & conditional function
Case (X,”Y”,…)
X- Boolean expression that are evaluated from first to last. The function defaults to NULL if non is true
..| eval description=case(statsu==20,”OK”,status==404,”NOT FOUND”
28. Which role can create data model
Admin & power user
29. Splunk latest version
Welcome to Splunk Enterprise 7.2 – Splunk Documentation
30. Which app ships with splunk enterprise
- Search & reporting
- Home App
31. How do we convert unix time into string and string back to unix time format
strftime(X,Y) : Unix to string as per format
strptime(X,Y) : String to UNIX
32. How do we find total number of host or source type reporting splunk instance. Report should consider host across the cluster
|metadata type=hosts index=* | convert ctime(firstTime) | convert ctime(lastTime) |convert ctime(recentTime)
33. What is Splunk? Why Splunk is used for analysing machine data?
Splunk is a platform for analysing machine data generated from various data sources such as network, server, IOT and so on. Splunk is used for analysing machine data for following reasons
- Business Intelligence
- Operational visibility
- Proactive monitoring
- Search and Investigation
34. Who are the competitors of Splunk in the market? Why is Splunk efficient?
Biggest competitors of Splunk are as follows
- Sumo logic
- ELK
- Loglogic
Splunk is efficient as it comes with many inbuilt features like visualization, analysis, apps, Splunk can also be deployed in cloud through Splunk cloud version. Other platforms requires plug in to get additional features.
35. What are the benefits of getting data using forwarders?
- Data is load balanced by default
- Bandwidth throttling
- Encrypted SSL connection
- TCP connection
36. What happens if License master is unreachable?
License Slave sets 72 hour timer and try to reach License Master, after which search is blocked in specific license slave until Master is reachable.
37. What is the command to get list of configuration files in Splunk?
Splunk cmd btool inputs list –debug
38. What is the command to stop and start Splunk service?
- ./splunk stop
- ./splunk start
39. What is index bucket? What are all stages of buckets?
Indexed data in Splunk is stored in directory called bucket. Each bucket has certain retention period after which data is rolled to next bucket. Various stages of buckets are
- Hot
- Warm
- Cold
- Frozen
- Thawed
40. What are important configuration files in Splunk?
- Props.conf
- inputs.conf
- outputs.conf
- transforms.conf
- indexes.conf
- deploymentclient.conf
- serverclass.conf
41. What is global file precedence in Splunk?
- System local directory – highest priority
- App local directory
- App default directory
- System default directory – lowest priority
42. What is difference between stats and timechart command?
Stats Timechart
Used to represent statistics data in tabular format Used to represent search result in graph
Can use multiple fields Uses _time as default field in x-axis
43. What is lookup command?
Lookup command is used to reference fields from an external csv file that matches fields in your event data.
44. What is the role of Deployment server?
Deployment server is a Splunk instance to deploy configuration to other Splunk instances from centralized location.
45. What are the default fields in Splunk?
- Host
- Source
- Sourcetype
- _time
- _raw
46. What is Search Factor (SF) and Replication Factor (RF) in Splunk?
Search factor determines number of searchable copies of data maintained by index cluster. Dafult search factor is 2.Replication factor is the number of copies of data cluster maintains. Search factor should be always less than or equal to Replication factor.
47. What is the difference between Splunk apps and add-ons?
Splunk apps contains built-in configurations, reports and dashboards, Splunk add-ons contains only built-in configurations and not visualization (reports or dashboards)
48. How can you exclude some events from being indexed in Splunk?
This can be done by using nullQueue in transforms.conf file.
For Example:
transforms.conf
[setnull]
REGEX =
DEST_KEY = queue
FOMAT = nullqueue
49. Where does Splunk default configuration file located?
It is located under $Splunkhome/etc/system/default
50. Discuss about the sequence in which splunk upgrade can be done in a clustered environment?
- Upgrade Cluster Master
- Upgrade Search Head Cluster
- Upgrade Indexer Cluster
- Upgrade Standalone Indexers
- Upgrade Deployment Server
51. How do we sync and deploy configurational files and updates across multiple deployment servers in a large multi layered clustered?
On one of the deployment server, use below commands-
$cd ~
$./DS_sync.sh
$/opt/splunk/bin/splunk reload deploy-server -class ServerClassName
52. What would you use to view contents of a large file? How to copy/remove file? How to look for help on a Linux?
- tail -10 File1 it would show last 10 rows
- copy file- cp file_name .
- Remove file command- rm -rf directory_name
- Manual/help command – man command_name