BigData / Splunk Interview Questions
1. What is Machine Data? How Splunk can use it?
Machine data, sometimes called machine-generated data, is the digital information that is automatically created by the activities and operations of networked devices, including computers, mobile phones, embedded systems, and connected wearable products. In a wider context, machine data can also i...
2. Main functions of Splunk.
Index data, Search & Investigate, Add knowledge to the data by categorization and enriching, Monitor & Alert, Report & Analyse.
3. What are the Splunk processing components?
There are 3 components. Indexer, Search Head, allows the users to use Splunk Search language. and Forwarder, are Splunk enterprise instances that consume data and forward to indexers for processing.
4. Does Indexer process the search requests?
Yes.
5. Which component provides data for indexing?
Forwarders.
6. What are Splunk roles?
Splunk roles determine what a user is able to see, do and interact with. There are 3 main splunk roles. Admin role is the most powerful, allows to install apps and create knowledge objects for all the users. Power role can create and share knowledge objects for users of an app and do realtime sea...
7. What are the default Apps available with Splunk Enterprise?
8. What is Splunk Index?
Indices are organized hierarchical directories in which data is categoried and stored.
9. Does Splunk use source_type to categorize the data for indexing?
Yes.
10. What is a transforming command?
Commands that create statistics and visualizations are called transforming commands.
11. What is the order of evaluation of Boolean operations?
Not, OR and AND. To control the evaluation use parentheses.
12. What is the knowledge object in Splunk?
Knowledge object is a user-defined entity that enriches the existing data in Splunk Enterprise. You can use knowledge objects to get specific information about your data. When you create a knowledge object, you can keep it private or you can share it with other users.
13. Are the field names case-sensitive in Splunk?
Yes but field values are NOT.
14. Mention few efficient ways for faster Splunk search.
Using time (limit : earliest and latest) to narrow down the amount of data to search. Use inclusion to search rather than exclusion, for example, using status = failed is better than status !=success.
15. Mention a few Splunk commands.
fields, specifies fields to be included/excluded in the result. table, specifies result in tabular format. rename, allows to rename fields. dedup, remove duplicate values in a field. and sort command, allows sorting by fields and we can also specify limit.
16. What are the top and rare commands in Splunk?
The top command is a transforming command that finds the most common values of a given field. index=sales sourcetype=vendor_sales | top Vendor limit=10 The rare command has the same options as the top command except that it shows the least common values of a field set.
17. Which roles can Create reports?
Admin, Power and User roles.
18. What are Data models in Splunk?
Data models are knowledge objects that provide the data structure that drives Pivots. These are created by Admin and Power role who has knowledge of Search language and solid understanding of the data.
19. Different search modes in Splunk.
Fast mode for performance, Verbose for completeness and more details, Smart mode for combination of performance and additional details.
20. What is Search Job Inspector in Splunk?
Search Job Inspector determines which phase of a search takes the most time. It dissects the behavior of searches to help understand costs. Any search job that has not expired can be inspected.
21. What is an Iplocation command in Splunk?
Iplocation command lookup and add location information to events.
22. What is Geostats command?
Geostats command aggregates geographical data for use on a map visualization. index=sales sourcetype=vendor_sales | geostats latfield=VendorLatitude longfield=VendorLongitude count by product_name
23. Name the types of search modes supported in Splunk.
Splunk supports 3 types of search modes. Fast mode, Smart mode, and Verbose mode.
