Splunk Enterprise Certified Admin flashcards
Splunk Enterprise Certified Admin · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Universal Forwarder
- A lightweight Splunk component that collects and forwards data but does not index it; it uses minimal resources and sends events to an indexer or heavy forwarder.
- Heavy Forwarder
- A full Splunk instance that can receive, parse, filter, route, and forward data; it can also index data locally and run modular inputs.
- Search Head
- The Splunk component that handles user searches, dashboards, and alerts; it distributes searches to indexers and merges the returned results.
- Management Port 8089
- The default Splunk management port used for REST API calls, CLI communication, deployment server traffic, and communication between distributed Splunk components.
- License Master
- The Splunk instance that stores and enforces license entitlements and receives license usage reports from license slaves in a distributed deployment.
- License Pool
- A license management feature that allocates a portion of total licensed indexing volume to specific indexes or groups of indexes.
- License Usage
- Splunk measures licensed volume as the amount of raw uncompressed data indexed per day; the license master aggregates usage across all reporting nodes.
- btool
- A Splunk CLI utility that displays the merged configuration for a conf file and shows which file and line each setting comes from.
- props.conf
- A configuration file that sets sourcetype-level parsing rules such as line breaking, timestamp extraction, character set, and transform references.
- transforms.conf
- A configuration file that defines regex-based field extraction, source or event routing, and lookup definitions referenced by props.conf or other configs.
- outputs.conf
- A configuration file that defines forwarding destinations, such as tcpout groups and indexer lists, for a forwarder or Splunk instance.
- authorize.conf
- A configuration file that defines roles, their inherited roles, capabilities, and index access permissions for Splunk users.
- SAML Authentication
- A single sign-on method where Splunk trusts an identity provider; configuration requires metadata exchange and is stored in saml.conf.
- Role Inheritance
- A Splunk role can inherit capabilities and index permissions from one or more parent roles, combining their privileges for assigned users.
- Bucket Lifecycle
- Splunk buckets move from hot to warm to cold and finally to frozen; retention and size settings in indexes.conf control each transition.
- frozenTimePeriodInSecs
- An indexes.conf setting that defines how long an index retains data before buckets become frozen and are deleted or archived.
- splunk clean eventdata
- A CLI command that deletes indexed data from a specified index; it requires stopping Splunk and is irreversible.
- HTTP Event Collector
- A Splunk input that receives events over HTTP or HTTPS using tokens, commonly on port 8088, and is configured in inputs.conf.
- monitor stanza
- An inputs.conf stanza beginning with monitor:// that tells Splunk to watch a file or directory and index new data.
- crcSalt
- An inputs.conf monitor setting that adds a salt to the CRC calculation so Splunk treats a renamed or moved file as new data.
- oneshot input
- A Splunk CLI input mode that indexes a single file once for testing or ad hoc ingestion, rather than continuously monitoring it.
- Deployment Server
- A Splunk instance that manages forwarder configurations and app deployment by assigning server classes and pushing apps to deployment clients.
- serverclass.conf
- A deployment server configuration file that defines server classes, matching client filters, and the apps each class receives.
- distsearch.conf
- A search head configuration file that lists distributed search peers and controls how the search head communicates with indexers.
- Monitoring Console
- A Splunk app that provides health checks, performance dashboards, license usage, indexing, and search activity across a distributed deployment.
- splunk diag
- A CLI command that collects configuration, logs, and system information into a diagnostic file for troubleshooting or support.
- app.conf
- A configuration file in a Splunk app that defines app metadata such as label, version, author, and whether the app appears in the launcher.
- Add-on
- A Splunk app type that provides inputs, field extractions, or other technology-specific configurations, often without a user interface.
- metadata/default.meta
- A file in a Splunk app that controls app and object permissions, including whether roles can read or write the app.
- Replication Factor
- In indexer clustering, the number of copies of each bucket that the cluster maintains across peer nodes; it must be at least the search factor.
- Search Factor
- In indexer clustering, the number of searchable copies of each bucket maintained across peers; it cannot exceed the replication factor.
- Cluster Bundle
- A package of configuration files that the cluster master distributes to peer nodes; peers apply it to keep cluster settings consistent.