Splunk Interview Questions and Answers

Introduction

Searching, reporting, monitoring and visualizing now has become easy with Splunk- a software for your enterprise data.Your machine data is taken as input by Splunk to turn them into powerful operational intelligence through real-time insight to your data in the form of achart, reports, alerts etc. To reach higher in your career goals, you can take different certifications available and handle theexcess amount of data. Implementing Splunk can take your business to a next level but the question is do you possess the skills to be a Splunker? If yes then be prepared for the intense competition and tough interview questions. In this blog, let’ have a look at some of the most common Splunk interview questions. The questions covered in this blog post have been shortlisted after collecting inputs from many industry experts to help you ace your interview.

Splunk Interview Questions

1. What is Splunk? Why is Splunk used for analyzing machine data?
2. Explain how Splunk works
3. What are the components of Splunk?
4. Why use only Splunk? Why can’t I go for something that is open source?
5. Which Splunk Roles can share the same machine?
6. What are the unique benefits of getting data into a Splunk instance via Forwarders?
7. What is the use of License Master in Splunk?
8. What is Splunk DB connect?
9. Explain ‘license violation’ from Splunk viewpoint
10. What is a summary index in Splunk?
11. Briefly, explain the Splunk Architecture
12. What are the components of Splunk architecture?
13. What happens if the License Master is unreachable?
14. Give a few use cases of Knowledge Objects.
15. Why should we use Splunk Alert?What are the different options while setting up Alerts?
16. Explain Workflow Actions
17. What are Splunk buckets? Explain the bucket lifecycle.
18. Explain the function of Alert Manager?
19. Explain the difference between search head pooling and search head clustering?
20. What is the difference between stats and transaction commands?
21. How can you troubleshoot Splunk performance issues?
22. How do you reset Splunk Admin Password?
23. Explain Data Models and Pivot
24. Explain Search Factor (SF) & Replication Factor (RF)
25. Which commands are included in ‘filtering results’ category?
26. What is a lookup command? Differentiate between inputlookup& outputlookupcommands.
27. What is the difference between ‘eval’, ‘stats’, ‘charts’ and ‘timecharts’ command?
28. What are the different types of Data Inputs in Splunk?
29. How can we extract fields?
30. What is the difference between Search time and Index time field extractions?

Splunk interview questions and answers for Developer

Question: 1. What is Splunk? Why is Splunk used for analyzing machine data?

Answer: The platform of Splunk allows you to get visibility into machine data generated from different networks, servers, devices, and hardware. It can give insights into the application management, threat visibility, compliance, security, etc. so it is used to analyze machine data.

Question: 2. Explain how Splunk works

Answer: The data is collected from the forwarder from the source and forwarded to the indexer. The data is stored locally on a host machine or cloud. Then on the data stored in the indexer the search head searches, visualizes, analyzes and performs various other functions.

Question: 3. What are the components of Splunk?

Answer: The main components of Splunk are Forwarders, Indexers and Search Heads.Deployment Server(or Management Console Host) will come into the picture in case of a larger environment.

Deployment servers act like an antivirus policy server for setting up Exceptions and Groups so that you can map and create adifferent set of data collection policies each for either window based server or a Linux based server or a Solaris based server.

Question: 4. Why use only Splunk?

Answer: Splunk has a lot of competition in the market, for performing IT operations, for analyzing machine logs, providing security and doing business intelligence. But, there is no one single tool other than Splunk that can do all of these operations and that is where Splunk comes out of the box and makes a difference. Splunk helps in scaling up infrastructure and get professional help from a firm supporting the platform.

Question: 5. Which Splunk Roles can share the same machine?

Answer: Most of the riles can be shared on the same machine including Indexer, Search Head and licensed Master. However, in case of larger deployments, the preferred practice is to host each role on stand-alone hosts.

Question: 6. What are the unique benefits of getting data into a Splunk instance via Forwarders?

Answer: The benefits of getting data into Splunk via forwarders are bandwidth throttling, TCP connection and anencrypted SSL connection for transferring data from a forwarder to an indexer. The data forwarded to the indexer is also load balanced by default and even if one indexer is down due to network outage or maintenance purposes, that data can always be routed to another indexer instance in a very short time.

Question: 7. What is the use of License Master in Splunk?

Answer: In Splunk, license master ensures that perfect amount of data gets indexed. It is important to ensure that the environment stays within the limits of the purchased volume as Splunk license is based on the data volume that comes to the platform within a 24-hour window.the purchased volume

Question: 8. What is Splunk DB connect?

Answer: Splunk DB is a general SQL database plugin which enables adding database information with Splunk reports. It helps in providing scalable and reliable integration between relational databases and Splunk Enterprises.

Question: 9. Explain ‘license violation’ from Splunk viewpoint

Answer: A ‘license violation’ error appears if you surpass the data limit. This license warning stays upto 14 days. In a commercial license, there are 5 warnings within a period of 30 days window before which your Indexer’s search results and reports stop triggering

Question: 10. What is asummary index in Splunk?

Answer: The Summary index is the default summary index. If you decide to run many types of summary index reports you may need to create additional summary indexes.

Splunk Interview Questions and Answers for Architect

Question: 11. Briefly, explain the Splunk Architecture

Answer: Look at the below image which gives a consolidated view of the architecture of Splunk.

Question: 12. What are the components of Splunk architecture?

Answer: There are four components in the Splunk architecture. They are:

• Indexer: Indexes machine data
• Search head: Provides GUI for searching
• Deployment server: Manages the Splunk components in distributed environment
• Forwarder: Forwards logs to index

Question: 13. What happens if the License Master is unreachable?

Answer: If the license master is unreachable, then it’s not possible to search the data. The activities of incoming data into the indexer would be normal but you would receive a warning message saying that you have exceeded the indexing volume and so you either need to purchase a high capacity of license or reduce the amount of incoming data.

Question: 14. Give a few use cases of Knowledge Objects.

Answer: Knowledge objects can be used in many domains. Few examples are:

• Application Monitoring: Your applications can be monitored in real-time with configured alerts to notify when anapplication crashes.
• Physical Security: You can have thefullleverage of the data containing information about the volcanos, floods etc. to gain insights, if your firm deals with them.
• Network Security: With the usage of lockups from your knowledge objects, you can increase security in your systems by blacklisting certain IPs from getting into your network.
• Employee Management: If you want to monitor the activity of people who are serving their notice period, then you can create a list of those people and create a rule preventing them from copying data and using them outside.

Question: 15. Explain Search Factor (SF) & Replication Factor (RF)

Answer: Questions regarding Search Factor and Replication Factor are most likely asked when you are interviewing for the role of a Splunk Architect. SF & RF are terminologies related to Clustering techniques

• The search factor determines the number of searchable copies of data maintained by the indexer cluster. The default value of search factor is 2. However, the Replication Factor in case of Indexer cluster is the number of copies of data the cluster maintains and in case of a search head cluster, it is the minimum number of copies of each search artifact, the cluster maintains
• Search head cluster has only a Search Factor whereas an Indexer cluster has both a Search Factor and a Replication Factor

Question: 16. Explain Workflow Actions

Answer: You can start explaining Workflow actions by first telling why it should be used.You can create workflow actions which will automate certain tasks. For example:

• Workflow can be used to retrieve some data and send it to other fields.
• Double click can be performed to drill down the data into a particular list containing usernames and their IP addresses and you can perform further search into that list

Question: 17. What are Splunk buckets? Explain the bucket lifecycle.

Answer: A Splunk bucket is the directory that contains indexed data. Splunk buckets also have events of a certain period. Bucket lifecycle includes following stages:

• Hot – It contains recently indexed data and is open for writing. For each index, there are one or more hot buckets available
• Warm – In warm stage data is rolled from hot
• Cold – In Cold stage data is rolled from warm
• Frozen – Data is rolled from cold. The indexer deletes frozen data by default but users can also archive it.
• Thawed – Information is restored from an archive file. If you archive frozen data, you can later return it to the index by thawing it.

Question: 18. Explain the function of Alert Manager?

Answer: Alert manager enables you to view the link to have alook at the search results. It displays the list of most recently fired alerts, for example, alert instances.

Question: 19. Explain the difference between search head pooling and search head clustering?

Answer: Search head pooling connects server and shares load, configuration and client data. Search head clustering is a part of Splunk enterprise search.

Question: 20. What is the difference between stats and transaction commands?

Answer: The transaction command is useful in two areas. Two transactions are not identified by unique id anymore. In this case, the identifier is re-used to identify web sessions. Here, time span or pauses are used to divide data into transactions. In cases when an identifier is used again, a specific message may identify the beginning or end of a transaction. Usually, stats command is used in a distributed search environment as it performs better. If a unique id is an identifier, stats can be used.

Splunk Interview Questions and Answers for Admin

Question: 21. Why should we use Splunk Alert? What are the different options while setting up Alerts?

Answer: This is a common question aimed at candidates appearing for the role of a Splunk Administrator. When you want to notify an enormous condition in your system, time alerts can be used.

For example, send an email notification to the admin when there are more than three failed login attempts in a twenty-four hour period. Different options that are available while setting up alerts are:

• You can create a webhook so that you can write to hipchat or GitHub.
• You can add results, .csv or pdf or inline with the body of the message to make sure that the recipient understands where this alert has been fired.
• You can also create tickets and throttle alerts based on certain conditions like a machine name or an IP address.

Question: 22. How can you troubleshoot Splunk performance issues?

Answer: There are three ways of doing this.

• Check for errors in splunkd.log
• Check server performance issues
• Install Splunk on the Splunk app and check for errors and warnings in the dashboard

Question: 23. How do you reset the Splunk Admin Password?

Answer: To reset the admin password, log into the server on which Splunk is installed and rename the password file, and then restart Splunk. After doing this, you can log in using the default username: admin password: change me

Question: 24. Explain Data Models and Pivot

Answer: For creating a structured hierarchical model of your data Data Models are used. When you want to want to make use of that information without using complex search queries or you have a large amount of unstructured data, you can use Data Models.

On the other hand with pivots, you have the flexibility to create the front views of your results and then pick and choose the most appropriate filter for a better view of results.

Question: 25. Which commands are included in the ‘filtering results’ category?

Answer: There will be a lot of events coming to Splunk in a short time. Thus it is a little complicated task to search and filter data. But, thankfully there are commands like ‘search’, ‘where’, ‘sort’ and ‘rex’ that come to the rescue. That is why filtering commands are also among the most commonly asked Splunk interview questions.

Question: 26. What is a lookup command? Differentiate between input lookup & output lookup commands.

Answer: Lookup command is the topic into which most interview questions dive, with questions like: Can you enrich the data? How do you enrich the raw data with external lookup?

If you want to receive some fields from an external file, you can use Lookup commands. It is usually used to narrow the search results. An inputlookup basically takes an input as the name suggests.

Question: 27. What is the difference between ‘eval’, ‘stats’, ‘charts’, and ‘time charts’ commands?

Answer: Eval’ and ‘stats’ are among the most common as well as the most important commands within the Splunk SPL language and they are used interchangeably in the same way as ‘search’ and ‘where’ commands.

Stats	Chart	Timechart
Stats is a reporting command which is used to present data in a tabular format.	The chart displays the data in the form of a bar, line, or area graph. It also gives the capability of generating a pie chart.	A time chart allows you to look at bar and line graphs. However, pie charts are not possible.
In the Stats command, you can use multiple fields to build a table.	In Chart, it takes only 2 fields, each field on the X and Y axis respectively.	In Timechart, it takes only 1 field since the X-axis is fixed as the time field.

Question: 28. What are the different types of Data Inputs in Splunk?

Answer:

• Using files and directories as inputs.
• Configuring Network ports to receive inputs automatically and writing scripts such that the output of these scripts is pushed into Splunk is another common way
• But a seasoned Splunk administrator would be expected to add another option called Windows inputs. These Windows inputs are of 4 types: registry inputs monitor, printer monitor, network monitor, and active directory monitor

Question: 29. How can we extract fields?

Answer: You can extract fields from either event lists, sidebar or from the settings menu via the UI. The other way is to write your own regular expressions in props.conf configuration file.

Question: 30. What is the difference between Search time and Index time field extractions?

Answer: As the name suggests, Search time field extraction refers to the fields extracted while performing searches whereas, fields extracted when the data comes to the indexer are referred to as Index time field extraction.

Splunk training includes training in basic search, sharing and saving of results, creating tags and event types, generating reports, and chart creation hope this set of Splunk interview questions and answers will help you in preparing for your interview.