Splunk Interview Question?

[karthi2809]

Hi All,

I am new to splunk clustering environment and i have few questions when i attend interview.Any one please help me on this question

1.Can we delete index folder ?will we have permission to delete the index folder Splunk\var\lib\splunk\TestDB.

2.Can we copy the Index folder and paste it in someother index folder will be able to search the logs?

3.Where can we install DB connect app and other apps in Search head cluster OR Indexer Server cluster?

4.What is the process name when we extract logs from props and transform.conf file?

5.Upgrade Splunk cluster enironment with simple steps?

6.What is the process of search head captain will do ?

Thanks,

Karthigeyan R

[PickleRick]

To most of those questions answers can be found on Splunk documentation pages. Some of them require a bit of experience with the system. Both knowing the docs as well as experience sums up to product knowledge and abilities which are required to work with the product. Unless it's a very entry-level position where you should learn everything from scratch (but for such work you shouldn't get such questions in interview), you should know this before trying to administer Splunk environments. Otherwise you can do some very costly damage to your (potential) employer installation.

[isoutamo]

Hi
if you are looking any workplace, where you are needing knowledge about those answers? I strongly propose, that you start your learning path to Splunk Certified System Admin to understand enough, what splunk is and how it will work.
r. Ismo