Agreed A and B. Quoting two Splunk Reference URLs https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Distdeploylicenses#:~:text=License%20requirements,do%20not%20index%20external%20data.
"All Splunk Enterprise instances functioning as management components needs access to an Enterprise license. Management components include the deployment server, the indexer cluster manager node, the search head cluster deployer, and the monitoring console."
https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Aboutdeploymentserver
"The deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances."
AB not C - For some complex configuration requirements, however, you might need to edit serverclass.conf directly. Important: If you switch from forwarder management to direct editing of serverclass.conf, you might not be able to use forwarder management for any subsequent configuration. This is because the forwarder management interface can handle only a subset of the configurations possible through serverclass.conf.
A&B for sure,
C,D - is discussable, by design not applicable
C - is it possible use sys/local/*.conf, DS not overriding this confs with apps
D - what about run ps script Restart-Computer on win OS? so it is possible to restart host OS
Data Admin pg 97 A&B
Deployment Server is a built-in tool for managing configuration of Splunk instances
–Allows you to manage remote Splunk instances centrally–Requires an Enterprise License
–Handles the job of sending configurations (inputs.conf, outputs.conf, etc.) packaged as apps
–Can automatically restart remote Splunk instances
•Forwarder management is a graphical interface on top of deployment server
•Monitoring Console Forwarder dashboards help you monitor the deployment
•Best Practice: The Deployment Server should be a dedicated Splunk instance–In this class, you will use your test server as a deployment server
Tricky one, but I'd say that C is also correct: once an app is put under Deployment Management, the app's folder (the whole of it) will be overwritten each time the UF detects that there's a mismatch between it's own content and that from the DS. So yes: once used, Deployment Management is the only way to manage THOSE APPS in the forwarders. (apps that are not under Deployment Management can still be managed locally. And of course you can always disable Deployment Management on an app and go back to manual updates, if you so wish).
Only A and B are right
C is wrong. You can still use the CLI or edit the .conf files
D is wrong. No Splunk component can cause the underlying OS to reboot.
A & B. C is wrong because you can still use the CLI or edit the .conf files and D is a sneaky answer designed to catch you out; No Splunk component can cause the underlying OS to reboot.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Praf7
Highly Voted 3 years, 12 months agoucsdmiami2020
3 years, 1 month agotommot
Highly Voted 4 years, 2 months agoSasnycoN
2 years, 11 months agoEnidV
2 years, 1 month agobobixaka
Most Recent 1 year agobobixaka
1 year agotmmt
1 year, 8 months agomr56
1 year, 9 months agoPKV27
2 years, 6 months agoBlueRoselia
2 years, 8 months agoAlusine
2 years, 9 months agokurzer_
2 years, 7 months agoMntman77
1 year, 4 months agoHurshbabe
1 year, 1 month agoHurshbabe
1 year, 1 month agoApis
2 years, 10 months agoivaanovich
3 years, 2 months agotoney_mu
1 year, 8 months agockmunich
3 years, 3 months agoSasnycoN
2 years, 11 months agomjl79
3 years, 4 months agoSasnycoN
2 years, 11 months agogsplunker
3 years, 9 months agogatundu_
1 week agolollo1234
3 years, 6 months agoIDM
4 years agooksey
4 years, 2 months agoames
4 years, 2 months ago