Which Splunk component requires a Forwarder license?
ASearch head
BHeavy forwarder
CHeaviest forwarder
DUniversal forwarder
Where should apps be located on the deployment server that the clients pull from?
A$SPLUNK_HOME/etc/apps
B$SPLUNK_HOME/etc/search
C$SPLUNK_HOME/etc/master-apps
D$SPLUNK_HOME/etc/deployment-apps
To set up a network input in Splunk, what needs to be specified?
AFile path.
BUsername and password.
CNetwork protocol and port number.
DNetwork protocol and MAC address.
Which of the following statements describe deployment management? (Choose all that apply.)
ARequires an Enterprise license.
BIs responsible for sending apps to forwarders.
COnce used, is the only way to manage forwarders.
DCan automatically restart the host OS running the forwarder.
During search time, which directory of configuration files has the highest precedence?
A$SPLUNK_HOME/etc/system/local
B$SPLUNK_HOME/etc/system/default
C$SPLUNK_HOME/etc/apps/app1/local
D$SPLUNK_HOME/etc/users/admin/local
What options are available when creating custom roles? (Choose all that apply.)
ARestrict search terms.
BWhitelist search terms.
CLimit the number of concurrent search jobs.
DAllow or restrict indexes that can be searched.
Which of the following statements apply to directory inputs? (Choose all that apply.)
AAll discovered text files are consumed.
BCompressed files are ignored by default.
CSplunk recursively traverses through the directory structure.
DWhen adding new log files to a monitored directory, the forwarder must be restarted to take them into account.
Which of the following authentication types requires scripting in Splunk?
AADFS
BLDAP
CSAML
DRADIUS
Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?
AAny OS platform.
BLinux platform only.
CWindows platform only.
DNone of the above.
In this sourcetype definition the MAX_TIMESTAMP_LOOKAHEAD is missing. Which value would fit best?
[sshd_syslog]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %z
LINE_BREAKER = ([\r\n]+)\d4-\d2-\d2 \d2:\d2:\d2
SHOULD_LINEMERGE = false -
TRUNCATE = 0 -
Event example:
2018-04-13 13:42:41.214 -0500 server sshd[26219]: Connection from 172.0.2.60 port 47366
AMAX_TIMESTAMP_LOOKAHEAD = 5
BMAX_TIMESTAMP_LOOKAHEAD = 10
CMAX_TIMESTAMP_LOOKAHEAD = 20
DMAX_TIMESTAMP_LOOKAHEAD = 30
Which Splunk component consolidates the individual results and prepares reports in a distributed environment?
AIndexers
BForwarder
CSearch head
DSearch peers
How often does Splunk recheck the LDAP server?
AEvery 5 minutes.
BEach time a user logs in.
CEach time Splunk is restarted.
DVaries based on LDAP_refresh setting.
Which of the following apply to how distributed search works? (Choose all that apply.)
AThe search head dispatches searches to the peers.
BThe search peers pull the data from the forwarders.
CPeers run searches in parallel and return their portion of results.
DThe search head consolidates the individual results and prepares reports.
You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will the output be?
AA list of all the configurations on-disk that Splunk contains.
BA verbose list of all configurations as they were when splunkd started.
CA list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
DA list of the current running props.conf configurations along with a file path from which the configuration was made.
How does the Monitoring Console monitor forwarders?
ABy pulling internal logs from forwarders.
BBy using the forwarder monitoring add-on.
CWith internal logs forwarded by forwarders.
DWith internal logs forwarded by deployment server.
Which of the following is a valid distributed search group?
Which setting in indexes.conf allows data retention to be controlled by time?
AmaxDaysToKeep
BmoveToFrozenAfter
CmaxDataRetentionTime
DfrozenTimePeriodInSecs
This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog
A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog
Which file is now monitored?
A/var/log/messages
B/var/log/maillog
C/var/log/maillog and /var/log/messages
Dnone of the above
What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?
ADisk
BCPUs
CMemory
DNetwork interface cards
In which Splunk configuration is the SEDCMD used?
Aprops.conf
Binputs.conf
Cindexes.conf
Dtransforms.conf
Which parent directory contains the configuration files in Splunk?
A$SPLUNK_HOME/etc
B$SPLUNK_HOME/var
C$SPLUNK_HOME/conf
D$SPLUNK_HOME/default
Which forwarder type can parse data prior to forwarding?
AUniversal forwarder
BHeaviest forwarder
CHyper forwarder
DHeavy forwarder
Which Splunk component distributes apps and certain other configuration updates to search head cluster members?
ADeployer
BCluster master
CDeployment server
DSearch head cluster master
In which phase of the index time process does the license metering occur?