Splunk licensing is based …
on the amount of data indexed.
The daily license quote includes the full size of data flowing through the ___, but not the disk storage.
parsing pipeline
Replicated data, summary indexes, internal logs, and metadata ___ count towards license quota.
does not
What are the Splunk license options?
Enterprise Free Trial Splunk for industrial IoT license Forward Dev/test license
Enterprise
o Can be bought for any indexing volume
o Enables all Splunk features including clustering and distributed search
o No enforcement. Users can still search after license violation
o Licenses can be stacked
Free
o Includes 500mb/day indexing for life
o Disabled features include clustering, authentication, distributed search, alerting and deployment management
Trial
o Full Splunk features for 60 days
o After 60 says it automatically becomes free license
o Max 500mb a day
o Sales Trial license can be provided for customised license
Splunk for industrial IoT
o Not stackable
o Access to Splunk enterprise and a select premium Splunk apps
Forward
o Allows forwarding of unlimited data
o Cannot be used for indexing
o No need to purchase separately
o Universal forwards automatically apply forwarder license
o Heavy forwarder must be converted to Forwarder License group
Dev/Test
o For running Splunk in Non Prod environments
o Cannot be used in distributed environment
o Not stackable
o Can be used for Splunk App development
What are the license warnings and violations?
- Exceeding daily volume quota results in a warning
- 5 or more warnings in a 30 day rolling period is a violation
- Searching is not disabled in violation period
- Alert logged in Messages on any Splunk Web pages
How do you monitor for license warnings?
- Monitoring console
- Licensing page in Splunk web
- Usage report in Splunk Web
How do you handle license violations?
- Review heavy hitters (usage report) and adjust intake
- The daily limit resets at midnight
- Buy more licenses
How is a search performed?
- During indexing, Splunk indexers convert the machine data stream into searchable events which are stored in indexes
- Indexes contain compressed raw data (journal.gz) and time-series index files (TSIDX)
- Indexes store data in time-oriented buckets (hot, warm, cold and frozen)
- Indexers perform the search and return the results
- Search results and meta data are stored as search artifacts until the search job expires
How does Splunk retrieve data?
- Timeframe – identify data buckets based on time range
* Bloom filter – calculate bloom filter on base search and compare against buckets bloom filter
What is a bloom filter?
- Bloom filter is a bit array created by running search terms through set of hashing algorithms
- Splunk creates a bloom filter for each bucket
- When a search is run, Splunk calculates the bloom filter for the base search, and compares with the bucket bloom filter
- Only the matching buckets are opened
- Having as many filtering terms as possible in the base search improves search performance
What is a search artifact?
- Contains results and metadata
- Stored on $SPLUNK_HOME/var/run/dispatch
- Deleted when the search job expires
- Each job has its own directory
- Too many search artifacts can cause performance degradation
What is a distributed search?
Distributed search separates search management and presentation layer from indexing and search retrieval layer
How does a distributed search work?
- Search head receives users search request
- Search head dispatches searches to the search peers (indexers)
- Search peers run the search on behalf of search heads and return the results to the search head
- Search head merges the results from all the search peers
- Search head runs additional filtering and transformation commands (if applicable) and returns the results to the user
What are search peers?
- The indexers that participate in distributed search are called search peers
- Search peers must be added in search heads
- If the search head participates in indexer cluster, search peers are automatically added
- When a peer goes down, search head removes it from the peers list (default timeout 10 seconds)
What is a knowledge bundle?
- Archive of knowledge objects that search head sends to all search peers
- Includes knowledge objects such as event types, saved searches
- Peers need these knowledge objects to execute searches on behalf of search heads
- Contains a subset of $SPLUNK_HOME/etc/system|apps|users
Where is the location of a knowledge bundle?
- Search head – $SPLUNK_HOME/var/run (.bundle or .delta extension)
- Search peers – $SPLUNK_HOME/var/run/searchpeers
How does does a knowledge bundle get replicated?
- Entire knowledge bundle
* Delta – changes since last full bundle push
What are the four replication policies?
- Classic – search head directly replicates to all search peers
- Cascading – replicates to a subset of search peers which replicates to other search peers and so on
- Mounted – search head places knowledge bundle in shared storage (NOT recommended)
- Remote file storage – search head uploads knowledge bundle to a remote file system
-
Module 1: Splunk Cloud Overview10
-
Module 2: Index Management29
-
Module 3: User Authentication and Authorisation16
-
Module 4: Splunk Configuration Files11
-
Module 5: Getting Data into Splunk Enterprise/Cloud29
-
Module 6: Forwarder Management12
-
Module 7: Monitor Inputs4
-
Module 8: Network and Other Inputs7
-
Module 9: Fine-tuning Inputs3
-
Module 10: Parsing Phase and Data preview14
-
Module 11: Manipulating Raw Data3
-
Enterprise only content37
