SPLK-1005 Practice Exam — 60 Free Splunk Questions

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

60Practice Questions

3Study Modes

Free

TopicSort

Question 1

Manipulating Raw Data

A user has been asked to mask some sensitive data without tampering with the structure of the file /var/log/purchases/transactions.log that has the following format:
2020-01-01 00:01:20 User=bob SuperSecretNumber=123456789012 Operation=purchase
2020-01-01 16:15:32 User=alice SuperSecretNumber=123456789012 Operation=purchase
Which of the stanzas below will achieve this?

A
B
C
D

Question 2

Forwarder Management

Question 3

Working with Splunk Cloud Support

Question 4

Manipulating Raw Data

Question 5

Forwarder Management

Question 6

User Authentication and Authorization

Question 7

Monitor Inputs

Question 8

Monitor Inputs

Question 9

Installing and Managing Apps

Question 10

Manipulating Raw Data

Question 11

Getting Data in Cloud

Question 12

Monitor Inputs

Question 13

Splunk Configuration Files

Question 14

Parsing Phase and Data Preview

Question 15

Monitor Inputs

Question 16

Splunk Cloud Overview

Question 17

Monitor Inputs

Question 18

Fine-tuning Inputs

Question 19

Splunk Configuration Files

Question 20

Monitor Inputs

Question 21

Monitor Inputs

Question 22

Network and Other Inputs

Question 23

Manipulating Raw Data

Question 24

Manipulating Raw Data

That's the end of the Preview

This exam has 60 community-verified practice questions. Create a free account to access all questions, comments, and explanations.

Topics covered:

Splunk Cloud OverviewIndex ManagementUser Authentication and AuthorizationSplunk Configuration FilesGetting Data in CloudForwarder ManagementMonitor InputsNetwork and Other InputsFine-tuning InputsParsing Phase and Data PreviewManipulating Raw DataInstalling and Managing AppsWorking with Splunk Cloud Support

Log In / Sign Up

Page 1 of 3 • Questions 1-25 of 60

1 2 3

→

Know a question that should be here? Contribute to this exam

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

A This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.
B The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app.
C The configuration changes can be made using CLI, directly in configuration files, or via a deployment app.
D It is only possible to make this change directly in configuration files or via a deployment app.

In case of a Change Request, which of the following should submit a support case for Splunk Support?

A The party requesting the change.
B Certified Splunk Cloud administrator.
C Splunk infrastructure owner.
D Any person with the appropriate entitlement.

Which of the following statements is true about data transformations using SEDCMD?

A Can only be used to mask or truncate raw data.
B Configured in props.conf and transforms.conf.
C Can be used to manipulate the sourcetype per event.
D Operates on a REGEX pattern match of the source, sourcetype, or host of an event.

Which of the following is the default bandwidth limit in the Splunk Universal Forwarder credentials package?

A 0 KBps
B 256 KBps
C 512 KBps
D 1024 KBps

Question 6

User Authentication and Authorization

Question 7

Monitor Inputs

Question 8

Monitor Inputs

Question 9

Installing and Managing Apps

Question 10

Manipulating Raw Data

Question 11

Getting Data in Cloud

Question 12

Monitor Inputs

Question 13

Splunk Configuration Files

Question 14

Parsing Phase and Data Preview

Question 15

Monitor Inputs

Question 16

Splunk Cloud Overview

Question 17

Monitor Inputs

Question 18

Fine-tuning Inputs

Question 19

Splunk Configuration Files

Question 20

Monitor Inputs

Question 21

Monitor Inputs

Question 22

Network and Other Inputs

Question 23

Manipulating Raw Data

Question 24

Manipulating Raw Data

By default, which of the following capabilities are granted to the sc_admin role?

A indexes_edit, edit_token_http, admin_all_objects, delete_by_keyword
B indexes_edit, fsh_manage, acs_conf, list_indexerdiscovery
C indexes_edit, fsh_manage, admin_all_objects, can_delete
D indexes_edit, edit_token_http, admin_all_objects, edit_limits_conf

Which of the following takes place during the input phase?

A Splunk annotates data with only 3 metadata keys: host, source, and sourcetype.
B Splunk sets the character encoding of the data.
C Splunk looks at the contents of the data to apply the correct source.
D Splunk breaks data into individual lines.

What syntax is required in inputs.conf to ingest data from files or directories?

A A monitor stanza, sourcetype, and index is required to ingest data.
B A monitor stanza, sourcetype, index, and host is required to ingest data.
C A monitor stanza and sourcetype is required to ingest data.
D Only the monitor stanza is required to ingest data.

Which file or folder below is not a required part of a deployment app?

A app.conf (in default or local)
B local.meta
C metadata folder
D props.conf

Where does the regex-replacement processor run?

A Merging pipeline
B Typing pipeline
C Index pipeline
D Parsing pipeline

How are HTTP Event Collector (HEC) tokens configured in a managed Splunk Cloud environment?

A Any token will be accepted by HEC, the data may just end up in the wrong index.
B A token is generated when configuring a HEC input, which should be provided to the application developers.
C Obtain a token from the organization’s application developers and apply it in Settings > Data Inputs > HTTP Event Collector > New Token.
D Open a support case for each new data input and a token will be provided.

Li was asked to create a Splunk configuration to monitor syslog files stored on Linux servers at their organization. This configuration will be pushed out to multiple systems via a Splunk app using the on-prem deployment server.
The system administrators have provided Li with a directory listing for the logging locations on three syslog hosts, which are representative of the file structure for all systems collecting this data. An example from each system is shown below:

Host: syslog01 -
File path: /var/log/network/syslog01/linux_secure/syslog.log

Host: syslog02 -
File path: /var/log/network/syslog02/linux_secure/syslog.log

Host: us-syslog-01 -
File path: /var/log/network/us-syslog-01/linux_secure/syslog.log.2020090801
Which monitor:// stanza could Li use in their app to ensure all three of these files are ingested into Splunk?

A [monitor:///var/log/network/syslog*/linux_secure/*]
B [monitor:///var/log/network/syslog/linux_secure/syslog.log]
C [monitor:///var/log/network/syslog/linux_secure/syslog.log.*]
D [monitor:///var/log/network/syslog/linux_secure/syslog.log*]

When monitoring directories that contain mixed file types, which setting should be omitted from inputs.conf and instead be overridden in props.conf?

A sourcetype
B host
C source
D index

The following Apache access log is being ingested into Splunk via a monitor input:

Question Image

How does Splunk determine the time zone for this event?

A The value of the TZ attribute in props.conf for the access_combined sourcetype.
B The value of the TZ attribute in props.conf for the my.webserver.example host.
C The time zone of the Heavy/Intermediate Forwarder with the monitor input.
D The time zone indicator in the raw event data.

Which of the following are valid settings for file and directory monitor inputs?

A host, index, source_length, _TCP_Routing, host_segment
B host, index, sourcetype, _TCP_Routing, host_regex, host_segment
C host, index, directory, host_regex, host_segment
D host, index, sourcetype, _UDP_Routing, host_regex, host_segment

Which of the following are features of a managed Splunk Cloud environment?

A Availability of premium apps, no IP address whitelisting or blacklisting, deployed in US East AWS region.
B 20GB daily maximum data ingestion, no SSO integration, no availability of premium apps.
C Availability of premium apps, SSO integration, IP address whitelisting and blacklisting.
D Availability of premium apps, SSO integration, maximum concurrent search limit of 20.

What does the followTail attribute do in inputs.conf?

A Pauses a file monitor if the queue is full.
B Only creates a tail checkpoint of the monitored file.
C Ingests a file starting with new content and then reading older events.
D Prevents pre-existing content in a file from being ingested.

A monitor has been created in inputs.conf for a directory that contains a mix of file types.
How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

A On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.
B On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.
C On the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files.
D On the forwarder collecting the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files.

Which of the following files is used for both search-time and index-time configuration?

A inputs.conf
B props.conf
C macros.conf
D savedsearch.conf

What Splunk command will allow an administrator to view the runtime configuration instructions for a monitored file in inputs.conf on the forwarders?

A ./splunk _internal call /services/data/inputs/filemonitor
B ./splunk show config inputs.conf
C ./splunk _internal rest /services/data/inputs/monitor
D ./splunk show config inputs

What is the correct syntax to monitor /apache/foo/logs, /apache/bar/logs, and /apache/bar/1/logs?

A (monitor:///apache/*/logs]
B (monitor:///apache/foo/logs, /apache/bar/logs, /apache/bar/1/logs]
C [monitor:///apache/.../logs]
D [monitor:///apache/foo/logs, /apache/bar/logs, and /apache/bar/1/logs]

When monitoring network inputs, there will be times when the forwarder is unable to send data to the indexers. Splunk uses a memory queue and a disk queue.
Which setting is used for the disk queue?

A queueSize
B maxQueueSize
C diskQueueSize
D persistentQueueSize

At what point in the indexing pipeline set is SEDCMD applied to data?

Question Image

A In the aggregator queue
B In the parsing queue
C In the exec pipeline
D In the typing pipeline

In what scenarios would transforms.conf be used?

A Per-Event Index Routing, Applying Event Types, SEDCMD operations
B Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing
C Per-Event Host Name, Per-Event Index Routing, SEDCMD operations
D Per-Event Sourcetype, Per-Event Index Routing, Applying Event Types

Join Us Among the Stars

SPLK-1005Preview

About the SPLK-1005 Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24