Enterprise Certified AdminPractice Test

• Enterprise License
• Free License
• Forwarder License
• Trial License
• Dev/Test License

• License capabilities and limitations
• License stacking
• License pools

Splunk License Manager

Identify different Splunk license types and their features

• Daily indexing volume
• License warnings
• License violations
• Grace period
• Search blocking

• Violation thresholds
• Consequences of violations
• Monitoring license usage

License Usage Report

Understand what causes license violations and their impact

• $SPLUNK_HOME/etc/system
• $SPLUNK_HOME/etc/apps
• default directories
• local directories
• users directories

• Directory hierarchy
• Configuration file locations
• App directory structure

Describe the Splunk configuration directory structure

• Global context
• App context
• User context
• Configuration layering

• How configurations layer
• Context precedence
• Configuration merging

Understand how Splunk layers configurations

• Precedence order
• Attribute precedence
• Stanza precedence
• File precedence

• Which configuration wins
• Precedence rules
• Override behavior

Understand configuration file precedence

• btool command
• list option
• debug option
• check option

• btool syntax
• Debugging configurations
• Finding effective configurations

splunk btool

Use btool to examine and debug configuration settings

• Hot buckets
• Warm buckets
• Cold buckets
• Frozen buckets
• Thawed buckets
• Bucket lifecycle

• Bucket transitions
• Index directory structure
• Data aging

Describe the structure and lifecycle of Splunk indexes

• Hot bucket characteristics
• Warm bucket characteristics
• Cold bucket characteristics
• Bucket naming convention

• Bucket states
• Bucket transitions
• Searchable vs non-searchable

List and describe types of index buckets

• splunk fsck
• Data integrity checks
• Bucket repair
• Corruption detection

• Data integrity commands
• Identifying corruption
• Repair procedures

splunk fsck

Check and maintain index data integrity

• maxDataSize
• maxHotBuckets
• maxWarmDBCount
• frozenTimePeriodInSecs
• coldPath
• thawedPath
• homePath

• Index configuration parameters
• Storage settings
• Retention settings

Describe key indexes.conf configuration options

• Fishbucket purpose
• File tracking
• CRC checks
• Seek pointers

• How fishbucket prevents duplicates
• Resetting fishbucket
• Troubleshooting re-indexing

Describe the purpose and function of the fishbucket

• Time-based retention
• Size-based retention
• Frozen data
• Archive scripts

• Setting retention policies
• Calculating storage requirements
• Archiving strategies

Apply and manage data retention policies

• Admin role
• Power role
• User role
• Can_delete role
• Role inheritance
• Role capabilities

• Default roles and capabilities
• Role inheritance
• Security implications

Describe user roles and their capabilities in Splunk

• Custom role creation
• Capability assignment
• Search restrictions
• Index access

• Creating custom roles
• Assigning capabilities
• Setting restrictions

Create and configure custom roles

• Native authentication
• User creation
• Password policies
• Role assignment

• User creation process
• Authentication methods
• User management

Add and manage Splunk users

• LDAP configuration
• Bind DN
• User/Group mappings
• LDAP strategies
• SSL/TLS configuration

• LDAP setup steps
• Mapping configurations
• Troubleshooting LDAP

• LDAP
• Active Directory

Integrate Splunk with LDAP for authentication

• SAML authentication
• Scripted authentication
• ProxySSO
• Native authentication

• Authentication methods
• Use cases for each method
• Configuration requirements

List and describe other authentication options

• MFA setup
• TOTP configuration
• DUO integration
• MFA policies

• MFA configuration steps
• Supported MFA methods
• User enrollment

• DUO
• RSA

Describe steps to enable multifactor authentication

• Source
• Sourcetype
• Index
• Host
• Input settings

• Input metadata
• Default settings
• Override settings

Describe basic settings for data inputs

• Universal Forwarder
• Heavy Forwarder
• Light Forwarder (deprecated)
• Forwarder capabilities

• Forwarder types and uses
• Capability differences
• Deployment scenarios

List and describe Splunk forwarder types

• outputs.conf
• inputs.conf
• Forwarder configuration
• SSL configuration

• Forwarder setup
• Configuration files
• Connection settings

Configure forwarders for data collection

• splunk add monitor
• splunk add tcp
• splunk add udp
• CLI commands

• CLI syntax for inputs
• Monitor configuration
• Network input setup

Add inputs to Universal Forwarder using CLI

• Search head
• Search peers
• Knowledge bundle
• Search distribution
• Result aggregation

• Distributed search architecture
• Search flow
• Performance considerations

Describe how distributed search works in Splunk

• Search head responsibilities
• Search peer responsibilities
• Knowledge management
• Result merging

• Component roles
• Communication flow
• Task distribution

Explain roles of search head and search peers

• distsearch.conf
• Search peer configuration
• Authentication setup
• Server.conf settings

• Configuration steps
• Authentication requirements
• Troubleshooting connections

Configure distributed search groups

• Search head clustering
• Search head pooling (deprecated)
• Load balancing
• High availability

• Scaling options
• HA configurations
• Performance optimization

List search head scaling and HA options

• Input phase
• Parsing phase
• Indexing phase
• Data pipeline

• Processing phases
• Phase responsibilities
• Data flow

List the three phases of Splunk indexing process

• Files and directories
• Network inputs
• Scripted inputs
• Modular inputs
• HTTP Event Collector

• Input types
• Use cases
• Configuration methods

List available Splunk input options

• Installation process
• Initial configuration
• outputs.conf
• deploymentclient.conf

• Forwarder setup
• Configuration best practices
• Connection configuration

Configure forwarders for data collection

• Data cloning
• Load balancing
• Compression
• SSL encryption
• Filtering

• Advanced forwarder features
• Performance options
• Security options

Identify additional forwarder configuration options

• Centralized management
• Configuration distribution
• Scalability benefits
• Management overhead reduction

• Benefits of deployment server
• Use cases
• Architecture considerations

Explain the use and benefits of deployment management

• Deployment server role
• Deployment apps
• Server classes
• Deployment process

• Deployment server components
• How deployment works
• Limitations

Deployment Server

Describe Splunk Deployment Server functionality

• Deployment app structure
• App deployment
• Configuration management
• Reload triggers

• Creating deployment apps
• App distribution
• Update mechanisms

Manage forwarders using deployment apps

• deploymentclient.conf
• Phone home interval
• Client configuration
• Target URI

• Client configuration
• Connection settings
• Polling behavior

Configure deployment clients

• Server classes
• Whitelist/Blacklist
• Machine types
• Filter expressions

• Server class creation
• Client matching
• Filter logic

Configure server classes and client groups

• Deployment monitoring
• Phone home status
• Deployment errors
• DMC monitoring

• Monitoring deployment status
• Troubleshooting deployments
• Health checks

Distributed Management Console

Monitor forwarder management activities

• Monitor stanza
• File monitoring
• Directory monitoring
• Recursive monitoring
• Whitelist/Blacklist

• Monitor configuration
• File selection
• Input settings

Create file and directory monitor inputs

• followTail
• ignoreOlderThan
• crcSalt
• initCrcLength
• alwaysOpenFile

• Advanced monitor options
• Performance tuning
• Special use cases

Use optional settings for monitor inputs

• Remote monitoring
• Deployment apps
• Forwarder inputs
• Centralized configuration

• Remote deployment methods
• Configuration distribution
• Management strategies

Deploy monitor inputs to remote systems

• TCP input configuration
• UDP input configuration
• Port configuration
• Connection handling

• Network input setup
• Port management
• Protocol differences

Create TCP and UDP network inputs

• connection_host
• queueSize
• persistentQueueSize
• rawTcpDoneTimeout

• Advanced network settings
• Performance tuning
• Connection management

Describe optional settings for network inputs

• Script stanza
• Interval setting
• Script location
• Output handling

• Scripted input configuration
• Script requirements
• Scheduling

Create basic scripted inputs

• WMI configuration
• Remote Windows monitoring
• WQL queries
• Authentication requirements

• WMI setup
• Query configuration
• Credential management

WMI

Create WMI inputs for Windows monitoring

• HEC tokens
• REST endpoint
• JSON formatting
• Event batching
• Acknowledgments

• HEC configuration
• Token management
• Data formatting

HTTP Event Collector

Describe HTTP Event Collector functionality

• Character encoding
• Line breaking
• Timestamp recognition
• Default processing

• Input phase processing
• Default behaviors
• Processing order

Understand default input phase processing

• Sourcetype fine-tuning
• Character set encoding
• props.conf on forwarder
• Input processors

• Input configuration options
• Encoding settings
• Sourcetype overrides

Configure input phase options including sourcetype fine-tuning and character encoding

• Event breaking
• Timestamp extraction
• Event merging
• Header processing

• Parsing phase tasks
• Default behaviors
• Processing pipeline

Understand default parsing phase processing

• LINE_BREAKER
• SHOULD_LINEMERGE
• BREAK_ONLY_BEFORE
• MUST_BREAK_AFTER
• Event boundaries

• Line breaking configuration
• Multi-line events
• Performance optimization

Optimize and configure event line breaking

• TIME_PREFIX
• TIME_FORMAT
• TZ attribute
• Timestamp recognition
• Default timestamp

• Timestamp extraction
• Time zone handling
• Timestamp formats

Explain timestamp and timezone extraction/assignment

• Data Preview tool
• Event validation
• Testing configurations
• Preview settings

• Using Data Preview
• Validating parsing
• Testing configurations

Data Preview

Use Data Preview to validate event creation

• props.conf
• transforms.conf
• TRANSFORMS directive
• Processing order

• Transformation configuration
• Props and transforms relationship
• Invocation methods

Explain how data transformations are defined and invoked

• Use transformations to mask/delete data
• Override sourcetype or host based on event values
• Route events to specific indexes
• Prevent unwanted events from being indexed

• SEDCMD syntax
• Sed expressions
• Data anonymization
• Pattern replacement

• SEDCMD configuration
• Regex patterns
• Data modification

Use SEDCMD to modify raw data