Splunk Interview Questions and Answers – Part I

In one of our recent posts, we had discussed about Splunk. We would recommend you to read the overview post before going thru this post.

Due to high demand for this skill in the market, we were requested by one of our reader to have a Q&A on the same. In this first part of this post, we are covering some of the important questions related to Splunk. More will be added soon in the next post.

Let’s get started…

1. What is Splunk ?

Splunk is a software platform that allows users to analyse machine-generated data (from hardware devices, networks, servers, IoT devices, etc.). Splunk is widely used for searching, visualising, monitoring, and reporting enterprise data. It processes and analyses machine data and converts it into powerful operational intelligence by offering real-time insights into the data through accurate visualisations.

2. Name the components of Splunk architecture.

The Splunk architecture is made of the following components:

• Search Head – It provides GUI for searching
• Indexer – It indexes the machine data
• Forwarder – It forwards logs to the Indexer
• Deployment server – It manages the Splunk components in a distributed environment and distributes configuration apps.

 

3. Name the common port numbers used by Splunk.

The common port numbers for Splunk are:

• Web Port: 8000
• Management Port: 8089
• Network port: 514
• Index Replication Port: 8080
• Indexing Port: 9997
• KV store: 8191

 

4. What are the different types of Splunk dashboards?

There are three different kinds of Splunk dashboards:

• Real-time dashboards
• Dynamic form-based dashboards
• Dashboards for scheduled reports

5. Name the types of search modes supported in Splunk.

Splunk supports three types of dashboards, namely:

• Fast mode
• Smart mode
• Verbose mode

 

6. Name the different kinds of Splunk Forwarders.

There are two types of Splunk Forwarders:

• Universal Forwarder (UF) – It is a lightweight Splunk agent installed on a non-Splunk system to gather data locally. UF cannot parse or index data.
• Heavyweight Forwarder (HWF) – It is a heavyweight Splunk agent with advanced functionalities, including parsing and indexing capabilities. It is used for filtering data.

 

7. What is the use of License Master in Splunk?

License master in Splunk is responsible for making sure that the right amount of data gets indexed. Splunk license is based on the data volume that comes to the platform within a 24hr window

8. What happens if the License Master is unreachable?

In case the license master is unreachable, then it is just not possible to search the data. However, the data coming in to the Indexer will not be affected. The data will continue to flow into your Splunk deployment, the Indexers will continue to index the data as usual however, you will get a warning message on top your Search head or web UI.

 

9. What is the purpose of Splunk DB Connect?

Splunk DB Connect is a generic SQL database plugin designed for Splunk. It enables users to integrate database information with Splunk queries and reports seamlessly.

 

10. What are some of the most important configuration files in Splunk?

The most crucial configuration files in Splunk are:

• props.conf
• indexes.conf
• input.conf
• output.conf
• transforms.conf

That’s it in this part. Please see the second part of the series for more questions. Our comments section is open for any questions/comments/feedback.