Pass Splunk Core Certified User Certification Exams in First Attempt Easily

Splunk Core Certified User Certification Practice Test Questions, Splunk Core Certified User Exam Practice Test Questions

Want to prepare by using Splunk Core Certified User certification exam practice test questions efficiently. 100% actual Splunk Core Certified User practice test questions and answers, study guide and training course from Exam-Labs provide a complete solution to pass. Splunk Core Certified User exam practice test questions and answers in VCE Format make it convenient to experience the actual test before you take the real exam. Pass with Splunk Core Certified User certification practice test questions and answers with Exam-Labs VCE files.

Installing Splunk

3. Download and Install Splunk on Linux

Welcome back. Let's install Spllunk on Linux. So first of all, we need to login to the Splunk portal at splunk.com, click on the free Splunk button, sign in with our Splunk account, and then it will bring us to this page where we simply click on Splunk Enterprise and choose the package that we want. And of course we want Linux for this video. Download the package in whatever format you want. I prefer to use the TGZ. So let's download that. Here's a little trick: let's go ahead and actually cancel the download because all we need is this command line, w get string." So let's click on that, select the entire command, copy it, and then paste it over into our Linux machine. And there's our "get string" pasted into our Linux machine, which happens to be running Ubuntu Linux. Before this will run, we need to have sudo privileges. So we can simply type sudo space right before the command, and it will ask us for our password, and it will download the tarball or the TGZ file for Splunk, and it's done. Let's make sure it's there with a command called LS, and we can see that it has downloaded; it's in red there. Before we untar it, let's actually copy it over to the opt directory, which is where Splunk likes to live. And we'll do that with this command: sudo CP, the name of the file. Now let's move to the /opt directory and make sure our file is there. So CDSpace can opt to change to that directory, and we'll see if the file is there with LS. There it is. Now let's untangle it. And in the Windows world, that would be like unzipping it. And this will create all of the directories that Splunk needs to run properly. So with this command we will untar it, and as you can see, it goes through and unpacks everything and creates all the directories that Splunk needs. Let's do an LS and we'll see that there's now a Splunk directory; it's in blueish purple there. So let's switch over to the spunk directory, and let's make sure all the directories that we expect are there. So there's been an Etsy included library, so everything that we expect to be there is there, which is good, but Splunk is not currently running; it's just been installed. So let's switch to the bin directory, and we'll do this command: startsplanc sudo forward slash splank start. Make sure you do this switch to accept the licence before pressing Enter or returning here. That way you won't have to read the entire Terms of Service before you accept the license. Now it's going to ask for a password for the admin account. So just make one up or use whatever you want. And now it says Splunk is running. So we can verify that by going to the IP address of our Linux machine, 8000. So we'll open up our browser again, go to the IP And there it is, our installation of Splunk on Linux. Let's log in. Make sure everything works. And there we go. I really thank you for joining in this video. I look forward to seeing you in the next video.

4. Download and Install Splunk on Windows

Welcome back. Let's install SPlanc on Windows. And yes, I know I'm using Microsoft Edge here, but that's because this is a clean Windows Ten installation. So we'll simply go to Splunk.com and log in with our account and click on Splunk Enterprise. This time, select the Windows tab, select the appropriate version for your version of Windows, and click Download. And we will run the file, and it will run the Windows blunt installer. And I like to go here and click on "Customize Options" just to make sure it's doing everything I want. So it's going to install it on Program FileSplunk, which is fine, and choose the user ID that you want it to run as. Now if you're in a corporation where you're using domain credentials, be sure to select "Domain Account," especially if you have a service account set up specifically for Splunk. But for this lab, I'm just going to use local systems. Click Next, and it's going to ask for a password. Okay, create a Start menu shortcut, and then click Install. I like to leave that box checked that says "Launch browser with Splunk Enterprise." So click Finish, and as you can see in the URL, it says Local Host 8000. That's because we're on the same box. But if you wanted to access it over a web browser outside of this box, you would just enter the IP address or the host name of the box and then 8000. So let's log in, and there we go. Splunk is installed on Windows. I really appreciate you joining me in this video and look forward to seeing you next time.

Getting data In

1. Getting Data In

Welcome to this segment on how Splank consumes data. We also want to answer the question: What kind of data can Splunk consume? Well, the answer is that the sky is really the limit. Some of the more obscure types of unstructured data might require some human intervention. But once you teach Splunk how to deal with that data, the next time it encounters it, it is very easy to handle, and it knows exactly how to do so. Splunk can consume all of the regular types of data that you would expect and look at the internet of things. So we can consume data from toasters and things like that. But more importantly, self-driving cars, sensors on our bodies, like fitness sensors, and all kinds of things Of course, block can consume regularlog configurations, scripts, tickets, alerts, virtual and physical servers, communications devices, and almost anything else. And how do we get data there? Well, we can upload files, we can monitor files, and we can forward Syslog data directly to a Splunk index or search head. We can use SNMP traps; we can use scripted inputs from APIs. Perhaps the most important way that Splunk gets data is through universal and heavy forwarders. And we'll talk about universal and heavy forwarders and install and configure them in the next two segments. But for now, let's go through uploading and monitoring. Here are our three options. We have upload monitoring; forwarding and uploading are pretty straightforward. We just upload a document in the demo; we'll do a CSV document. Monitoring is equally as simple. We just click on the monitor. The "forward" option allows us to see which forwarders are calling home to our Splunk index or search head. It also allows us to setup a Splunk distribution server. And we can also manage forwarders remotely through this forwarding panel. But that will be covered later in the course. We'll talk more about setting up a distributed environment. Any type of data that comes in gets assigned some default metadata by Splunk. Unless you specify otherwise, the metadata is source host, source type, and index index, which defaults to the default source type. Splunk attempts to automatically determine the source type, whether it's CSV or Syslog or something like that. Host defaults to the machine name that sparked the text, and source defaults to the path of the input file. So let's see how uploading and monitoring work in Splunk. Back on our Splunk search head, I'm going to first download the homework data CSV file. And back in Splunk, I'm going to go to Settings, add data, and first of all, I'm going to upload and select a file. And there's our homework ta, and firsIt should upload pretty quickly. Next set the source type, and Splunk will automatically determine that it is a CSV. If the source type is unclear to Splunk, you can manually set it here. Make sure everything is good. This is a CSV that I created, so it's pretty clean. Now we'll select input settings, specifically the hostfield value, which is set to my machine name by default. But let's manually define a hostname, and we'll call it homework. And the index defaults to default, and that's fine. We'll review everything and click done, and we'll start searching. And let's make sure that our homework data is uploaded and searchable. So here's one generator to search for us. Source equals that file name; host equals homework; and source type equals CSV. You don't actually need all that, you just need one of them to bring up our homework data. And here's the homework data with the fields that Splunk automatically detects and lists here, as well as interesting fields. And since it's a CSV file, the fields are very clear because, as we know, a field is a key-value pair. So key value "host" equals "homework," and that's a key value pair. and spunky this in smart mode. We'll talk about modes a little later and choose a monitor. Now we need to tell Splunk what we are intending to monitor. Let's choose files and directories, and we'll browse. And as you can see, we can actually browse the file system. So let's browse down in Windows Diagnostics, which might have a lot of data, and we'll browse. We'll monitor that entire directory, the Windows Diagnostics index. And now it's going to ask us for the same source information that we gave when we uploaded a file. So, let's call the host field value Windows, and the index is fine as is. We'll review the data, submit it, and then start searching. And we have 24 events. This is a brand new virtual machine, so it hasn't been alive long enough to collect a tonne of events. but we've just monitored this path. We've assigned it a particular host name. So all we need to do is type host equals Windows" and it will bring up the same data. And again, we're in smart mode. So Splunk is trying to detect all the fields that might be useful to us. And remember, next up we're going to talk about moving forward. So stay tuned for that. I look forward to seeing you then.

2. Universal Forwarders

Welcome to the segment on forwarders. There are two main types of forwarders in Splunk, universal forwarders and heavy forwarders. In this segment, I'm going to focus mainly on universal forwarders. And in the next segment, we'll talk about heavy forwarders. Universal forwarders are the most popular. They're the easiest to install, and you can install them on the local machine. And they can also be configured using a deployment server. If you have a distributed environment set up in Splunk, the default ports that universal forwarders talk on are 8089 for management and 9997 for indexing. Heavy forwarders are simply a complete installation of the Splunk Enterprise software. But you apply for a forwarder license. Heavy forwarders do much of the heavy lifting at the source, including parsing data. And heavy forwarders can be configured at the source but are often configured through a deployment server. Forwarders will not work unless you configure receiving. I can't tell you how many times I've forgotten about configuring receiving when setting up Splunk instances. Simply go to Settings Forwarding and Receiving and then add new, and we'll show you how to do this in the demo. So, here is how my lab is set up. I have a Windows forwarder, a Newbuntu forwarder, and a Splunk search head. my two windows. Machines are windows. Ten enterprise. And when we go through our demo, I'll make sure to let you know which machine is which and what exactly we are doing. On the right, I have my Windows Ten Splunk search, the one that we've been using throughout the class. On my left I have a Windows 10 machine that will be used as a universal forwarder and then a heavy forwarder. And here in the middle, in my terminal, I have my Ubuntu machine on which we will install forwarders. So first of all, let's open up our Splunk Web. As you can see, we have no data coming in because we haven't yet forwarded any data, uploaded any data, or told Long to monitor any data. Click on "Data Summary." Nothing is coming in. So what we want to do is forward data to this machine. And the first thing I want to do is find out what the IP address of this machine is, since I don't have DNS set up on this virtual machine network. 170, 216, 182, 150, and I'll just put that on the screen there and let's configure receiving. So we'll go to Settings > Forwarding and Receiving. And under configure receiving, we'll choose addnew, and it says, "Listen; this port is the default port number." So we will go with that. You can make it whatever port—well, whatever ephemeral port—you want, as long as you remember what it is. Okay, it is enabled. Now let's install a Windows Universal Forwarder on this machine. And honestly, the easiest way to find it is to search Splunk Universal Forwarder, and it's usually the first link, and we'll choose the forwarder that's right for our operating system. In this case, it's Windows. But as you can see, we have all these other options here. So I'm going to download the 64-bit MSI installer, and it will make me log in with my Splunk account. We'll save the downloaded file and, just to show you where it is, it will probably be in your downloads folder. And there it is. Go ahead and run the installer. Of course, you have to accept the licence agreement. Now I like to choose this customised option, and I'll show you why. I don't really care where a forwarder installs. I don't really care right now about SSL stuff. We can leave the local system running the forwarder service for now. And here is why I like to customise options: I want to make sure that all of these boxes are checked. And if you don't have a need for some of these items, then you should not take the box because then you're just creating pollution and noise. And here's where we type in the IP address of our Splunk, in this case our Splunk search if we have a distributed environment, the Splunk indexer, and the port for deployment is 8089, and this is going to be the same, but the port number will be 9997, and we'll proceed with the installation on some versions of Windows 10 or Windows Server 2012 or 2016. I have seen a universal forwarder install hang at this point. If that happens to you, the workaround that I found is to use Task Manager to stop the Windows installer, reboot the Windows machine, and run the installer again, but this time leave the deployment server and the forwarding server information blank. Then the installer will run, but the settings that you put in the first time you ran the installer will persist, and we can verify that our settings are correct by looking at the config files. So we'll browse the file system, go to C:Program FilesSplunkUniversal Forwarder Etsy System Local, and we're interested in this outputs.com file, which I just opened with Notepad, and here we are. We have the correct server and the correct port. So that's all we're really concerned with. And let's make sure that our universal forwarder service is running by going to Services MSC, and we'll scroll down until we get to Splunk, and it is running. Let's go back to our Splunk search head, and let's see if we are getting any data now. Search and Reporting app, and it still says "waiting for data." If we click on Data Summary, we don't have any data coming in. The first thing we want to check for troubleshooting is that those two ports are open on the Windows Firewall. So click on Start and search for Windows Firewall. And the first thing we can do is simply turn it off. If this is not a production environment, this is fine to do. If it is a production environment, I recommend you skip this step, and we definitely aren't going to leave it off. I just want to see if we can make some data come in and refresh the search head. And now we have six events. The earliest event was a month ago. The latest event was ten minutes ago. Let's see where our data is coming from. And it's coming from the Desktop 360 A4D machine. So let's see if that's our machine here. Okay, great. Yes, it is. So we do have data coming in from our Universal Forwarder on Windows. Let's now install a Universal Forwarder on our Linux machine. First thing I'm going to do is search for Splunk universal forwarder again, and that's how I'm going to choose the Linux version. And again, you can choose whichever file type you like to work with and that works with your flavour of Linux. I like the tarball, so I'm going to click "Download Now," and then I'm going to cancel the download because all I want is this commandline, "get string." Click here to select the entire command. I'm going to simply copy that and then type in Ubuntu pseudo-paste the wgetget string, and it will download the Splunk universal forwarder. Let's make sure that happens. There it is. Let's now paste that into opt. That's where Splunk likes to live. And there you have it, an option. Now untar it, and it will create a directory called Splunk forwarder. So let's browse to that.And there are traditional Splunk directories. We have the Splunk forwarder set up like this. We want to enable boot start. So whenever this Ubuntu machine reboots, we want to have the Splunk Forwarder Daemon start automatically. So let's go to the bin directory, and in the bin directory, we'll simply type sudo splunk enable bootstrap start Ubuntu. And if you do not accept the licence switch, you have to scroll through this huge end-user licence agreement. But of course I have the magic of video editing, so I will just skip this part and finally accept the licence agreement. And now, still in the bin directory, we want to do pseudo Splunk.We're going to add the address of the Splan search head. We'll simply say "add forward server" and our IP address for the server with the default port number, and we'll see if it actually accepts that pseudo-Splunk forward server. And there it is. It is configured, but inactive. Because in Linux, we have to explicitly tell it which data to monitor and send on to the Splunk search head. And to do that, we use the command add, add, monitor, and then the path to the directory or file that you want Splunk to monitor and send on to the Splunk search head. So I'm just going to do it for right now with VAR logs, and we'll see if the forward server now becomes active. And no, it is not active yet because we have to restart the slot service Now we'll list the forward servers. And look at that. It is an active forward server now. And let's go to our search engine and see if that data is coming in. So we'll go back home after searching and reporting a few seconds ago for the latest event. That's good news. Let's click on "Data Summary." And now we have everything from the Ubuntu server syslogd UTC and 2016. And remember, as part of our troubleshooting, we turned the firewall off on this machine. So let's turn it back on. But let's make sure we have the appropriate ports open. We'll search for firewall, go to Advanced Settings, go to Inbound Rules, and we'll click on "New Rule" and we'll choose Port. We'll leave that to TCP. Does anybody remember the two Splunk ports that we need to open here? Good job, 997-8089. Next, allow all the networks. We'll call it Splunk. There it is. And let's make sure our firewall is on. Okay, everything's on. Let's refresh the search heading. And we have data coming in from a few seconds ago. and it's all there. Just as we expect in this module, we successfully installed a universal forwarder on Windows and Linux. I really thank you for joining me in this segment and for following along. And I'll see you in the next segment when we install heavy forwarders.

3. Heavy Forwarders

Welcome to our segment on heavy forwarders. In the previous segment, we talked about light forwarders. Now we want to talk about heavy forwarders. And why are heavy forwarders important? because we can do heavy lifting at the source. We can index and parse data, we can load balance, and we can define specific data routing rules. You can clearly see how this could be extremely useful in a highly distributed environment. Do not be turned off by the terminology of a heavy forwarder. It's really just a regular installation of Small, the same installation you would use for an indexer or search head. The only difference is that after you finish installing it, you go to Settings LicensingChange License Group and select the "Forwarder License" radio button. Once you install a heavy forwarder, it's pretty easy to set up. You just simply go to settings under "Forwarding and Receiving" and add new items under "Forwarding Data." Once you click Add New, you'll come to this screen where it asks for either a DNS name or an IP, plus the port of the indexer or search head to which you want to forward. If you want Sponge to automatically load balance the data among multiple indexers, you can simply list multiple indexers here, separated by commas. You can also save a copy of the data locally. If you go to Forwarding Defaults, it will ask you if you want to store a local copy of the forwarded events. There, you can choose yes or no there.You can probably think of some use cases in which you would want to store a local copy of the events and some in which you would not. If this particular machine is pretty lightweight and doesn't have a lot of storage, you may not want to store a copy of forwarded events on the machine locally. So let's talk about some basic differences between universal and heavy forwarders. Universal forwarders, remember, are the light agent. There's event parsing available at the source in some cases, but no event routing available on universal forwarders. Heavy forwarders are a full Splunk enterprise installation, and we can parse and route data at the source with heavy forwarders. Let's take a look at how to install and configure a heavy forwarder in a Windows and Linux environment. And by the way, when we do the Windows environment, the reason I'm not doing Mac environments is because it's exactly the same as the Windows environment, except you'll download a DMG file instead of an MSI file. As always, we have our three stars of the show. Here we have our Splunk search head, our Windows Splunk forwarder, and in the terminal we have our Ubuntu server that we can set up as a forwarder. So first of all, let's log into our search engine. I've actually uninstalled the light forwarders on these other machines, so there won't be data coming in until we actually install the heavy forwarders. So for fun, let's start with Linux. And again, we want to open a browser on any machine and get that WGET string, just like we did to install Splunk Enterprise in the first place. So we'll simply go to Splunk.com, click on the free Splunk button, choose Splunk Enterprise, and we're going to choose Linux. And again, I like to use the TGZ. I'm going to click Download now, but remember, I'm not actually downloading it. Of course it's going to make us log in, and we'll cancel the download because we just want this WGET string. Click here to select the entire string, and once again we will make sure it's there. There's our old forwarder tarball that we downloaded, and there's our Splunk Enterprise instance that we just barely downloaded that does not have the word forwarder in it. So let's copy that again for "opt." Remember, on Linux, that's where Splunk likes to live. So pseudo-CP, and then we'll navigate to opt, make sure it's there, and it is, and then we'll simply untar. All right, it created that Splunk directory for us. And remember, we're going to go to Binand. We're going to tell Splunk to start. And to do that, we'll simply go "pseudo-Splunk start" and let's do the "accept licence switch" so that we don't have to read that horribly long end user licence agreement. Now it says the smart Web interface is available here. However, because I do not have DNS configured, we will have to access it via IP address. So let's see what that is. And it's 172, 16, 182, 142 Let me bring up a browser. And there it is. Let's log in for the first time, admin, and change me; change the password; skip all of this. Remember, on a heavy forwarder, the first thing we do is go to Settings Licensingchange License Group forward our licence save, and it will force us to restart the spawn server. That's fine. Login again. Now we want to go to settings > forwarding and receive > configure forwarding. Our host machine's IP address is one7216, 182, 157. Okay, everything's enabled and looks good. Now, no data is being forwarded on this heavy forwarder because we have to explicitly monitor, upload a file, or in some way add data to this forwarder. So let's click on "Add Data," let's choose "Monitor," and let's say there's a specific directory on this Linux machine that we want to monitor, and then forward on to our search heading. files and directories. Let's browse. As you notice, this is now a Linuxfile system, and let's do the same thing we did with our universal forwarder. Let's go to VAR, and we'll just monitor that whole directory. Let's make the host metadata value "Ubuntu heavy" so that we can identify it more easily in our search hit review done.And let's add one more directory just to make sure, just in case there is nothing actually in that VAR directory. So monitor files and directories. And let's monitor this system and kernel directory. That could be important. And it could also have a lot of data, which we're interested in. Click Next. Let's start with server heavy and sys And notice something here. We got all of these licencing errors when we tried to search directly on a heavy forwarder. Because remember, on a heavy forwarder with a forwarding license, you cannot search. You have to use the Splunk Searchheader indexer to which it is forwarding. So let's go back to our Splank search header. Let's refresh it. And the latest event Now this is good news. Click on "Data Summary." There it is. Ubuntu heavyweight and Ubuntu heavyweight. Sys Oh, this one has a lot more o let's go baOkay, so now let's put that away for just a minute and we'll install a heavy forwarder on our Windows machine again. We're just going to go to Splunk.com, click on the green "Free Splunk" button, and download Splunk Enterprise. And for this, we want the MSI. It will make us log in, of course. And we'll save that, and we'll simply go to our downloads folder, and there it is. We'll run the installer. Okay, once the installation is complete, we'll leave that box checked and launch the browser with Splunk Enterprise. And since the rest of this is going to be pretty much exactly like the Linux installation and setup, I'm going to speed up the process. I'm going to put the steps I'm going through on the left side of your screen there. So, the first step is to add the forwarding license, restart, log in again, and set up forwarding in the exact same way and monitor or upload some data. And we're finished installing a heavy forwarder on Linux and Windows. And, just to reiterate, installing a heavy forwarder on Mac is essentially the same as installing one on Windows. I really appreciate you joining me in this segment, and I'm really excited to see you in the next segment.

So when looking for preparing, you need Splunk Core Certified User certification practice test questions and answers, study guide and complete training course to study. Open in Avanset VCE Player & study in real exam environment. However, Splunk Core Certified User exam practice test questions in VCE format are updated and checked by experts so that you can download Splunk Core Certified User certification exam practice test questions and answers files in VCE format.