NEW QUESTION 1
Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

• A. Indexers
• B. Forwarder
• C. Search head
• D. Search peers

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Advancedindexingstrategy

NEW QUESTION 2
You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list –-debug. What will the output be?

• A. A list of all the configurations on-disk that Splunk contains.
• B. A verbose list of all configurations as they were when splunkd started.
• C. A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
• D. A list of the current running props.conf configurations along with a file path from which the configuration was made.

Answer: D

Explanation:
Reference: https://answers.splunk.com/answers/494219/need-help-with-what-should-be-a-simple-precedence.html

NEW QUESTION 3
Which setting in indexes.conf allows data retention to be controlled by time?

• A. maxDaysToKeep
• B. moveToFrozenAfter
• C. maxDataRetentionTime
• D. frozenTimePeriodInSecs

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/SmartStoredataretention

NEW QUESTION 4
User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

• A. Parents
• B. Capabilities
• C. Index access
• D. Search history

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_capabilities

NEW QUESTION 5
Which Splunk component does a search head primarily communicate with?

• A. Indexer
• B. Forwarder
• C. Cluster master
• D. Deployment server

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/InheritedDeployment/Deploymenttopology

NEW QUESTION 6
Which of the following statements describe deployment management? (Select all that apply.)

• A. Requires an Enterprise license.
• B. Is responsible for sending apps to forwarders.
• C. Once used, is the only way to manage forwarders.
• D. Can automatically restart the host OS running the forwarder.

Answer: A

NEW QUESTION 7
Where should apps be located on the deployment server that the clients pull from?

• A. $SPLUNK_HOME/etc/apps
• B. $SPLUNK_HOME/etc/search
• C. $SPLUNK_HOME/etc/master-apps
• D. $SPLUNK_HOME/etc/deployment-apps

Answer: A

Explanation:
Reference: https://answers.splunk.com/answers/371099/how-to-configure-deployment-apps-to-push-to-client.html

NEW QUESTION 8
Within props.conf, which stanzas are valid for data modification? (Select all that apply.)

• A. Host
• B. Server
• C. Source
• D. Sourcetype

Answer: CD

Explanation:
Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for-udp-514-data-sources.html

NEW QUESTION 9
For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE
to what value?

• A. True
• B. False
• C. <regex string>
• D. Newline Character

Answer: B

Explanation:
Reference: https://answers.splunk.com/answers/704533/what-are-the-best-practices-for-defining-source-ty.html

NEW QUESTION 10
This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages]
sourcetype=syslog
index=syslog
A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog] sourcetype=maillog index=syslog
Which file is now monitored?

• A. /var/log/messages
• B. /var/log/maillog
• C. /var/log/maillog and /var/log/messages
• D. none of the above

Answer: C

NEW QUESTION 11
What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

• A. License data
• B. Metrics data
• C. Internal Splunk data
• D. Internal Windows logs

Answer: B

Explanation:
Reference: https://answers.splunk.com/answers/581441/how-is-the-splunk-license-measured.html

NEW QUESTION 12
Which valid bucket types are searchable? (Select all that apply.)

• A. Hot buckets
• B. Cold buckets
• C. Warm buckets
• D. Frozen buckets

Answer: ABC

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/HowSplunkstoresindexes

NEW QUESTION 13
What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

• A. Disk
• B. CPUs
• C. Memory
• D. Network interface cards

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture

NEW QUESTION 14
What are the minimum required settings when creating a network input in Splunk?

• A. Protocol, port number
• B. Protocol, port, location
• C. Protocol, username, port
• D. Protocol, IP, port number

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector

NEW QUESTION 15
The universal forwarder has which capabilities when sending data? (Select all that apply.)

• A. Sending alerts
• B. Compressing data
• C. Obfuscating/hiding data
• D. Indexer acknowledgement

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders

NEW QUESTION 16
Which of the following indexes come pre-configured with Splunk Enterprise? (Select all that apply.)

• A. _licence
• B. _internal
• C. _external
• D. _thefishbucket

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Howindexingworks

NEW QUESTION 17
Where can scripts for scripted inputs reside on the host file system? (Select all that apply.)

• A. $SPLUNK_HOME/bin/scripts
• B. $SPLUNK_HOME/etc/apps/bin
• C. $SPLUNK_HOME/etc/system/bin
• D. $SPLUNK_HOME/etc/apps/<your_app>/bin

Answer: ACD

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Getdatafromscriptedinputs#Where_to_place_the_scripts_for_scripted_inputs

NEW QUESTION 18
Which of the following enables compression for universal forwarders in outputs.conf?

• A. [udpout:mysplunk_indexer11] compression=true
• B. [tcpout] defaultGroup=my_indexers compressed=true
• C. /opt/splunkforwarder/bin/splunk enable compression
• D. [tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Outputsconf

NEW QUESTION 19
Which Splunk component performs indexing and responds to search requests from the search head?

• A. Forwarder
• B. Search peer
• C. License master
• D. Search head cluster

Answer: B

Explanation:
Reference: https://www.edureka.co/blog/splunk-architecture/

NEW QUESTION 20
What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

• A. REGEX, DEST, FORMAT
• B. REGEX, SRC_KEY, FORMAT
• C. REGEX, DEST_KEY, FORMAT
• D. REGEX, DEST_KEY, FORMATTING

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf

NEW QUESTION 21
......