Free preview mode
Enjoy the free questions and consider upgrading to gain full access!
SPLK-1003
Free trial
Verified
Question 26
When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?
- A: Default app
- B: LDAP group
- C: Password
- D: Username
Question 27
Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?
- A: splunk btool server list --debug
- B: splunk list forward-indexer
- C: splunk list forward-server
- D: splunk btool indexes list --debug
Question 28
Which artifact is required in the request header when creating an HTTP event?
- A: ackID
- B: Token
- C: Manifest
- D: Host name
Question 29
All search-time field extractions should be specified on which Splunk component?
- A: Deployment server
- B: Universal forwarder
- C: Indexer
- D: Search head
Question 30
In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?
- A: Universal forwarders
- B: Splunk Cloud
- C: Linux package managers
- D: Windows using WMI
Question 31
What is the command to reset the fishbucket for one source?
- A: rm -r ~/splunkforwarder/var/lib/splunk/fishbucket
- B: splunk clean eventdata -index _thefishbucket
- C: splunk cmd btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file --reset
- D: splunk btool fishbucket reset
Question 32
Which setting allows the configuration of Splunk to allow events to span over more than one line?
- A: SHOULD_LINEMERGE = true
- B: BREAK_ONLY_BEFORE_DATE = true
- C: BREAK_ONLY_BEFORE =
- D: SHOULD_LINEMERGE = false
Question 33
In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?
- A: 21MB
- B: 28MB
- C: 14MB
- D: 7MB
Question 34
Which of the following are reasons to create separate indexes? (Choose all that apply.)
- A: Different retention times.
- B: Increase number of users.
- C: Restrict user permissions.
- D: File organization.
Question 35
You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will the output be?
- A: A list of all the configurations on-disk that Splunk contains.
- B: A verbose list of all configurations as they were when splunkd started.
- C: A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
- D: A list of the current running props.conf configurations along with a file path from which the configuration was made.
That’s the end of your free questions
You’ve reached the preview limit for SPLK-1003Consider upgrading to gain full access!
Free preview mode
Enjoy the free questions and consider upgrading to gain full access!