https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341683#M423 <P>Hi Rocky31, </P> <P>Can you tell us more about your Splunk experience and what role you are applying for? It will help direct you to relevant info. Have you completed any Splunk training? When you say Splunk interview, are you applying for a Splunk admin role? What kind of industry?</P> <P>Otherwise Google is your best friend. Review the Splunk docs especially the Architecting and Admin manuals.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk">https://docs.splunk.com/Documentation/Splunk</A></P> <P>And googling Splunk and syslog will yield plenty of material.</P> <P>Starcher's syslog blog us one of my favs:<BR /> <A href="http://www.georgestarcher.com/splunk-success-with-syslog/">http://www.georgestarcher.com/splunk-success-with-syslog/</A></P> Sun, 23 Apr 2017 23:39:31 GMT mattymo 2017-04-23T23:39:31Z https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341682#M422 <P>Please help me out anyone, need these topics to learn.<BR /> Onboarding<BR /> syslog-ng<BR /> architecture <BR /> networking</P> Sun, 23 Apr 2017 23:17:05 GMT https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341682#M422 Rocky31 2017-04-23T23:17:05Z https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341683#M423 <P>Hi Rocky31, </P> <P>Can you tell us more about your Splunk experience and what role you are applying for? It will help direct you to relevant info. Have you completed any Splunk training? When you say Splunk interview, are you applying for a Splunk admin role? What kind of industry?</P> <P>Otherwise Google is your best friend. Review the Splunk docs especially the Architecting and Admin manuals.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk">https://docs.splunk.com/Documentation/Splunk</A></P> <P>And googling Splunk and syslog will yield plenty of material.</P> <P>Starcher's syslog blog us one of my favs:<BR /> <A href="http://www.georgestarcher.com/splunk-success-with-syslog/">http://www.georgestarcher.com/splunk-success-with-syslog/</A></P> Sun, 23 Apr 2017 23:39:31 GMT https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341683#M423 mattymo 2017-04-23T23:39:31Z https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341684#M424 <P>Based on what you have advised, I would recommend spinning up your own environment in aws or in a home lab that allows you to start building up those hands on hours. </P> <P>I would recommend starting something simple like a non clustered deployment, focusing on ingesting as many data sources as you can get your hands on, deploying forwarders and managing them with the deployment server, and deploying a forwarder with syslog-ng to catch syslog and filter it to it's own directories. There are many articles online on how to do this with syslog-ng or rsyslog. (<A href="https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk/">https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk/</A>)</P> <P>Perhaps work toward Something like this :</P> <P><IMG src="http://i.imgur.com/4LX4ipX.png" alt="alt text" /></P> <P>The once you have played with that for a while, then level it up to a single site cluster (unless you know for sure that the job doesn't run a cluster, in that case spend more time playing in your topology above):</P> <P><IMG src="http://i.imgur.com/rIr2rk4.png" alt="alt text" /></P> <P>In this topology, you will focus on the indexer cluster, the cluster master and how replication and search factor work</P> <P>Then if you are feeling adventurous go for the multisite with a search head cluster:</P> <P><IMG src="http://i.imgur.com/h8yDtmv.png" alt="alt text" /></P> <P>All these adventures are chronicled in detail in Splunk Docs in the Deploy and Admin guides. I'd be reading that and trying the main topics constantly till the interview. </P> <P><A href="https://docs.splunk.com/Documentation/Splunk">https://docs.splunk.com/Documentation/Splunk</A></P> <P>Spending time using the software is what will set you apart from others and give you confidence and experience to draw upon, so find a project you can really dig into as it will provide you with the experience that will impress. And don't neglect working with the data and the search language! The best Splunk admins are curious by nature and love to get to know their data. </P> Mon, 24 Apr 2017 00:29:45 GMT https://community.splunk.com/t5/Random/Need-some-topics-to-prepare-for-my-splunk-interview/m-p/341684#M424 mattymo 2017-04-24T00:29:45Z