Which forwarder is recommended by Splunk to use in a production environment?
#1
Answer: D✅ Correct❌ Incorrect
Which of the following Splunk components require a separate installation package?
#2
Answer: C✅ Correct❌ Incorrect
Which data pipeline phase is the last opportunity for defining event boundaries?
#3
Answer: C✅ Correct❌ Incorrect
What type of Splunk license is pre-selected in a brand new Splunk installation?
#4
Answer: D✅ Correct❌ Incorrect
What event-processing pipelines are used to process data for indexing?
#5
Answer: AB✅ Correct❌ Incorrect
When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?
#6
Answer: A✅ Correct❌ Incorrect
Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?
#7
Answer: C✅ Correct❌ Incorrect
Which artifact is required in the request header when creating an HTTP event?
#8
Answer: B✅ Correct❌ Incorrect
All search-time field extractions should be specified on which Splunk component?
#9
Answer: D✅ Correct❌ Incorrect
In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?
#10
Answer: A✅ Correct❌ Incorrect
Which setting in indexes.conf allows data retention to be controlled by time?
#11
Answer: D✅ Correct❌ Incorrect
Where should apps be located on the deployment server that the clients pull from?
#12
Answer: D✅ Correct❌ Incorrect
Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
#13
Answer: D✅ Correct❌ Incorrect
Which of the following accurately describes HTTP Event Collector indexer acknowledgement?
#14
Answer: A✅ Correct❌ Incorrect
What action is required to enable forwarder management in Splunk Web?
#15
Answer: D✅ Correct❌ Incorrect
Which of the following indexes come pre-configured with Splunk Enterprise?
#16
Answer: B✅ Correct❌ Incorrect
How often does Splunk recheck the LDAP server?
#17
Answer: B✅ Correct❌ Incorrect
Where are license files stored?
#18
Answer: C✅ Correct❌ Incorrect
In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?
#19
Answer: D✅ Correct❌ Incorrect
Which Splunk component performs indexing and responds to search requests from the search head?
#20
Answer: B✅ Correct❌ Incorrect
When should the Data Preview feature be used?
#21
Answer: C✅ Correct❌ Incorrect
A Splunk administrator has been tasked with developing a retention strategy to have frequently accessed data sets on SSD storage and to have older, less frequently accessed data on slower NAS storage. They have set a mount point for the NAS. Which parameter do they need to modify to set the path for the older, less frequently accessed data in indexes.conf?
#22
Answer: B✅ Correct❌ Incorrect
When working with an indexer cluster, what changes with the global precedence when comparing to a standalone deployment?
#23
Answer: B✅ Correct❌ Incorrect
A user is assigned two roles with the following search filters. What is the user’s applied search filter?
#24
Answer: B✅ Correct❌ Incorrect
A company moves to a distributed architecture to meet the growing demand for the use of Splunk. What parameter can be configured to enable automatic load balancing in the Universal Forwarder to send data to the indexers?
#25
Answer: C✅ Correct❌ Incorrect
In inputs.conf, which stanza would mean Splunk was only reading one local file?
#26
Answer: B✅ Correct❌ Incorrect
What will the following inputs.conf stanza do?
[script://myscript.sh]
interval=0
#27
Answer: C✅ Correct❌ Incorrect
Load balancing on a Universal Forwarder is not scaling correctly. The forwarder’s outputs.conf and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue?
#28
Answer: BD✅ Correct❌ Incorrect
Which file will be matched for the following monitor stanza in inputs.conf?
[monitor:///var/log/*/bar/.../*.txt]
#29
Answer: A✅ Correct❌ Incorrect
A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X,Y). During a search executed on search head X, indexer A crashes. What is Splunk’s response?
