SPLK-1003Preview

Where should apps be located on the deployment server that the clients pull from?

To set up a network input in Splunk, what needs to be specified?

Which of the following statements describe deployment management? (Choose all that apply.)

During search time, which directory of configuration files has the highest precedence?

What options are available when creating custom roles? (Choose all that apply.)

Which of the following statements apply to directory inputs? (Choose all that apply.)

Which of the following authentication types requires scripting in Splunk?

Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

In this sourcetype definition the MAX_TIMESTAMP_LOOKAHEAD is missing. Which value would fit best?
[sshd_syslog]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %z
LINE_BREAKER = ([\r\n]+)\d4-\d2-\d2 \d2:\d2:\d2

SHOULD_LINEMERGE = false -

TRUNCATE = 0 -
Event example:
2018-04-13 13:42:41.214 -0500 server sshd[26219]: Connection from 172.0.2.60 port 47366

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

How often does Splunk recheck the LDAP server?

Which of the following apply to how distributed search works? (Choose all that apply.)

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will the output be?

How does the Monitoring Console monitor forwarders?

Which of the following is a valid distributed search group?

Which of the following are supported options when configuring optional network inputs?

Which setting in indexes.conf allows data retention to be controlled by time?

This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog
A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog
Which file is now monitored?

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

In which Splunk configuration is the SEDCMD used?

Which parent directory contains the configuration files in Splunk?

Which forwarder type can parse data prior to forwarding?

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

In which phase of the index time process does the license metering occur?