Which of the following statements describe deployment management? (Choose all that apply.)
Which of the following statements describe deployment management? (Choose all that apply.)
Deployment management in Splunk requires an Enterprise license, as it is used to centrally manage configurations and updates in a distributed environment. Additionally, deployment management is responsible for sending apps and configurations to forwarders, ensuring that all instances are up-to-date with the necessary parameters. Options that suggest it is the only way to manage forwarders or that it can restart the host OS are incorrect. Although the deployment server can restart Splunk forwarder instances remotely, it does not have the capability to restart the host operating system itself.
Option A & B
Agreed A and B. Quoting two Splunk Reference URLs https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Distdeploylicenses#:~:text=License%20requirements,do%20not%20index%20external%20data. "All Splunk Enterprise instances functioning as management components needs access to an Enterprise license. Management components include the deployment server, the indexer cluster manager node, the search head cluster deployer, and the monitoring console." https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Aboutdeploymentserver "The deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances."
C is wrong. we can still use CLI and direct editing even after enabling DS.
You can but they will be overwritten by the DS on the nest communication.
The CLI could be used even on DS.
Only A and B are right C is wrong. You can still use the CLI or edit the .conf files D is wrong. No Splunk component can cause the underlying OS to reboot.
About C - But even if you made any changes to the files via CLI they will be overwritten by the DS in the next communication.
A and B C is a trick as, it can restart the forwarder on the client NOT the client/HOST OS.
I would say A, B, D. https://docs.splunk.com/Splexicon:Deploymentserver
I would go for ABD
Guess A,B and D
NO! You cant restart fw os
A and B are correct
Tricky one, but I'd say that C is also correct: once an app is put under Deployment Management, the app's folder (the whole of it) will be overwritten each time the UF detects that there's a mismatch between it's own content and that from the DS. So yes: once used, Deployment Management is the only way to manage THOSE APPS in the forwarders. (apps that are not under Deployment Management can still be managed locally. And of course you can always disable Deployment Management on an app and go back to manual updates, if you so wish).
You cna disable the DS and still push apps or update apps
Data Admin pg 97 A&B Deployment Server is a built-in tool for managing configuration of Splunk instances –Allows you to manage remote Splunk instances centrally–Requires an Enterprise License –Handles the job of sending configurations (inputs.conf, outputs.conf, etc.) packaged as apps –Can automatically restart remote Splunk instances •Forwarder management is a graphical interface on top of deployment server •Monitoring Console Forwarder dashboards help you monitor the deployment •Best Practice: The Deployment Server should be a dedicated Splunk instance–In this class, you will use your test server as a deployment server
A&B for sure, C,D - is discussable, by design not applicable C - is it possible use sys/local/*.conf, DS not overriding this confs with apps D - what about run ps script Restart-Computer on win OS? so it is possible to restart host OS
A & B. C is wrong because you can still use the CLI or edit the .conf files and D is a sneaky answer designed to catch you out; No Splunk component can cause the underlying OS to reboot.
What will happen if you use CLi to edit the .conf files and in the next communication DS detects that there are changes?!
Its ABCD....page 68 of PDF. Can Automatically restart the remote splunk instances, manages forwarder configurations
Exactly what you said, "It can restart remote SPLUNK INSTANCES" but not the Host OS. D is wrong!
exactly!
Restarting as instance is equivalent to restarting the OS so D is right
never mind my answer, its wrong
AB not C - For some complex configuration requirements, however, you might need to edit serverclass.conf directly. Important: If you switch from forwarder management to direct editing of serverclass.conf, you might not be able to use forwarder management for any subsequent configuration. This is because the forwarder management interface can handle only a subset of the configurations possible through serverclass.conf.
Is A and B.
A and B are correct
A and B