Question: What is SOS?
SOS stands for Splunk on Splunk. It is a Splunk app that provides graphical view of
your
Splunk environment performance and issues.
It has following purposes:
Diagnostic tool to analyze and troubleshoot problems
Examine Splunk environment performance
Solve indexing performance issues
Observe scheduler activities and issues
See the details of scheduler and user driven search activity
Search, view and compare configuration files of Splunk
Question: What Is Splunk Indexer And Explain Its Stages?
The indexer is a Splunk Enterprise component that creates and manages indexes. The
main functions of an indexer are:
Indexing incoming data
Searching indexed data Splunk indexer has following stages:
Input : Splunk Enterprise acquires the raw data from various input sources and
breaks it
into 64K blocks and assign them some metadata keys. These keys include host, source
and source type of the data. Parsing : Also known as event processing, during this
stage,
the Enterprise analyzes and transforms the data, breaks data into streams,
identifies,
parses and sets timestamps, performs metadata annotation and transformation of
data.
Indexing : In this phase, the parsed events are written on the disk index including
both
compressed data and the associated index files. Searching : The ‘Search’ function
plays a
56/71
major role during this phase as it handles all searching aspects (interactive,
scheduled
searches, reports, dashboards, alerts) on the indexed data and stores saved
searches,
events, field extractions and views
Question: State The Difference Between Stats and Eventstats
Commands?
Stats – This command produces summary statistics of all existing fields in your
search
results and store them as values in new fields. Eventstats – It is same as stats
command
except that aggregation results are added in order to every event and only if the
aggregation is applicable to that event. It computes the requested statistics
similar to stats
but aggregates them to the original raw data.
log4J DevOps Interview Questions
Question: What is log4j?
log4j is a reliable, fast and flexible logging framework (APIs) written in Java,
which is
distributed under the Apache Software License.
log4j has been ported to the C, C++, C#, Perl, Python, Ruby, and Eiffel languages.
log4j is highly configurable through external configuration files at runtime. It
views the
logging process in terms of levels of priorities and offers mechanisms to direct
logging
information to a great variety of destinations.
Question: What Are The Features Of Log4j
Log4j is widely used framework and here are features of log4j
It is thread-safe.It is optimized for speed
It is based on a named logger hierarchy.
It supports multiple output appenders per logger.
It supports internationalization.
It is not restricted to a predefined set of facilities.
Logging behavior can be set at runtime using a configuration file.
It is designed to handle Java Exceptions from the start.
It uses multiple levels, namely ALL, TRACE, DEBUG, INFO, WARN, ERROR and
FATAL.
The format of the log output can be easily changed by extending the Layout class.
The target of the log output as well as the writing strategy can be altered by
implementations of the Appender interface.
It is fail-stop. However, although it certainly strives to ensure delivery, log4j
does not
57/71
guarantee that each log statement will be delivered to its destination.
Question: What are the components of log4j?
log4j has three main components
loggers: Responsible for capturing logging information.
appenders: Responsible for publishing logging information to various preferred
destinations.
layouts: Responsible for formatting logging information in different styles.
Question: How do you initialize and use Log4J ?
public class LoggerTest { static Logger log = Logger.getLogger
(LoggerTest.class.getName()); public void my logerMethod()
{ if(log.isDebugEnabled())
log.debug("This is test message" + var2); ) } }Question: What is SOS?
SOS stands for Splunk on Splunk. It is a Splunk app that provides graphical view of
your
Splunk environment performance and issues.
It has following purposes:
Diagnostic tool to analyze and troubleshoot problems
Examine Splunk environment performance
Solve indexing performance issues
Observe scheduler activities and issues
See the details of scheduler and user driven search activity
Search, view and compare configuration files of Splunk
Question: What Is Splunk Indexer And Explain Its Stages?
The indexer is a Splunk Enterprise component that creates and manages indexes. The
main functions of an indexer are:
Indexing incoming data
Searching indexed data Splunk indexer has following stages:
Input : Splunk Enterprise acquires the raw data from various input sources and
breaks it
into 64K blocks and assign them some metadata keys. These keys include host, source
and source type of the data. Parsing : Also known as event processing, during this
stage,
the Enterprise analyzes and transforms the data, breaks data into streams,
identifies,
parses and sets timestamps, performs metadata annotation and transformation of
data.
Indexing : In this phase, the parsed events are written on the disk index including
both
compressed data and the associated index files. Searching : The ‘Search’ function
plays a
56/71
major role during this phase as it handles all searching aspects (interactive,
scheduled
searches, reports, dashboards, alerts) on the indexed data and stores saved
searches,
events, field extractions and views
Question: State The Difference Between Stats and Eventstats
Commands?
Stats – This command produces summary statistics of all existing fields in your
search
results and store them as values in new fields. Eventstats – It is same as stats
command
except that aggregation results are added in order to every event and only if the
aggregation is applicable to that event. It computes the requested statistics
similar to stats
but aggregates them to the original raw data.
log4J DevOps Interview Questions
Question: What is log4j?
log4j is a reliable, fast and flexible logging framework (APIs) written in Java,
which is
distributed under the Apache Software License.
log4j has been ported to the C, C++, C#, Perl, Python, Ruby, and Eiffel languages.
log4j is highly configurable through external configuration files at runtime. It
views the
logging process in terms of levels of priorities and offers mechanisms to direct
logging
information to a great variety of destinations.
Question: What Are The Features Of Log4j
Log4j is widely used framework and here are features of log4j
It is thread-safe.It is optimized for speed
It is based on a named logger hierarchy.
It supports multiple output appenders per logger.
It supports internationalization.
It is not restricted to a predefined set of facilities.
Logging behavior can be set at runtime using a configuration file.
It is designed to handle Java Exceptions from the start.
It uses multiple levels, namely ALL, TRACE, DEBUG, INFO, WARN, ERROR and
FATAL.
The format of the log output can be easily changed by extending the Layout class.
The target of the log output as well as the writing strategy can be altered by
implementations of the Appender interface.
It is fail-stop. However, although it certainly strives to ensure delivery, log4j
does not
57/71
guarantee that each log statement will be delivered to its destination.
Question: What are the components of log4j?
log4j has three main components
loggers: Responsible for capturing logging information.
appenders: Responsible for publishing logging information to various preferred
destinations.
layouts: Responsible for formatting logging information in different styles.
Question: How do you initialize and use Log4J ?
public class LoggerTest { static Logger log = Logger.getLogger
(LoggerTest.class.getName()); public void my logerMethod()
{ if(log.isDebugEnabled())
log.debug("This is test message" + var2); ) } }Question: What is SOS?
SOS stands for Splunk on Splunk. It is a Splunk app that provides graphical view of
your
Splunk environment performance and issues.
It has following purposes:
Diagnostic tool to analyze and troubleshoot problems
Examine Splunk environment performance
Solve indexing performance issues
Observe scheduler activities and issues
See the details of scheduler and user driven search activity
Search, view and compare configuration files of Splunk
Question: What Is Splunk Indexer And Explain Its Stages?
The indexer is a Splunk Enterprise component that creates and manages indexes. The
main functions of an indexer are:
Indexing incoming data
Searching indexed data Splunk indexer has following stages:
Input : Splunk Enterprise acquires the raw data from various input sources and
breaks it
into 64K blocks and assign them some metadata keys. These keys include host, source
and source type of the data. Parsing : Also known as event processing, during this
stage,
the Enterprise analyzes and transforms the data, breaks data into streams,
identifies,
parses and sets timestamps, performs metadata annotation and transformation of
data.
Indexing : In this phase, the parsed events are written on the disk index including
both
compressed data and the associated index files. Searching : The ‘Search’ function
plays a
56/71
major role during this phase as it handles all searching aspects (interactive,
scheduled
searches, reports, dashboards, alerts) on the indexed data and stores saved
searches,
events, field extractions and views
Question: State The Difference Between Stats and Eventstats
Commands?
Stats – This command produces summary statistics of all existing fields in your
search
results and store them as values in new fields. Eventstats – It is same as stats
command
except that aggregation results are added in order to every event and only if the
aggregation is applicable to that event. It computes the requested statistics
similar to stats
but aggregates them to the original raw data.
log4J DevOps Interview Questions
Question: What is log4j?
log4j is a reliable, fast and flexible logging framework (APIs) written in Java,
which is
distributed under the Apache Software License.
log4j has been ported to the C, C++, C#, Perl, Python, Ruby, and Eiffel languages.
log4j is highly configurable through external configuration files at runtime. It
views the
logging process in terms of levels of priorities and offers mechanisms to direct
logging
information to a great variety of destinations.
Question: What Are The Features Of Log4j
Log4j is widely used framework and here are features of log4j
It is thread-safe.It is optimized for speed
It is based on a named logger hierarchy.
It supports multiple output appenders per logger.
It supports internationalization.
It is not restricted to a predefined set of facilities.
Logging behavior can be set at runtime using a configuration file.
It is designed to handle Java Exceptions from the start.
It uses multiple levels, namely ALL, TRACE, DEBUG, INFO, WARN, ERROR and
FATAL.
The format of the log output can be easily changed by extending the Layout class.
The target of the log output as well as the writing strategy can be altered by
implementations of the Appender interface.
It is fail-stop. However, although it certainly strives to ensure delivery, log4j
does not
57/71
guarantee that each log statement will be delivered to its destination.
Question: What are the components of log4j?
log4j has three main components
loggers: Responsible for capturing logging information.
appenders: Responsible for publishing logging information to various preferred
destinations.
layouts: Responsible for formatting logging information in different styles.
Question: How do you initialize and use Log4J ?
public class LoggerTest { static Logger log = Logger.getLogger
(LoggerTest.class.getName()); public void my logerMethod()
{ if(log.isDebugEnabled())
log.debug("This is test message" + var2); ) } }
