Splunk Enterprise Certified Admin SPLK-1003 Exam Questions

dumps2023-11-06T10:17:39+08:00

Looking for the latest Splunk Enterprise Certified Admin SPLK-1003 exam questions? Here, you can study the latest and real exam questions of Splunk certification SPLK-1003 exam. We all know that there are 56 questions in real SPLK-1003 exam, and you have 57 minutes to finish the test (you can expect an additional 3 minutes to review the exam agreement). Free Splunk Enterprise Certified Admin SPLK-1003 exam questions are available below.

Page 1 of 5

1. Which setting in indexes. conf allows data retention to be controlled by time?

maxDaysToKeep

moveToFrozenAfter

maxDataRetentionTime

frozenTimePeriodlnSecs

2. The universal forwarder has which capabilities when sending data? (select all that apply)

Sending alerts

Compressing data

Obfuscating/hiding data

Indexer acknowledgement

3. In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Blacklist

Whitelist

They cancel each other out.

Whichever is entered into the configuration first.

4. In which Splunk configuration is the SEDCMD used?

props, conf

inputs.conf

indexes.conf

transforms.conf

5. Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

CLI

Edit inputs. conf

Edit forwarder.conf

Forwarder Management

6. Which parent directory contains the configuration files in Splunk?

SSFLUNK_HOME/etc

SSPLUNK_HOME/var

SSPLUNK_HOME/conf

SSPLUNK_HOME/default

7. Which forwarder type can parse data prior to forwarding?

Universal forwarder

Heaviest forwarder

Hyper forwarder

Heavy forwarder

8. Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Indexers

Forwarder

Search head

Search peers

9. Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Deployer

Cluster master

Deployment server

Search head cluster master

10. Where should apps be located on the deployment server that the clients pull from?

$SFLUNK_KOME/etc/apps

$SPLUNK_HCME/etc/sear:ch

$SPLUNK_HCME/etc/master-apps

$SPLUNK HCME/etc/deployment-apps

Page 2 of 5

11. This file has been manually created on a universal forwarder

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new

Which file is now monitored?

/var/log/messages

/var/log/maillog

/var/log/maillog and /var/log/messages

none of the above

12. In which phase of the index time process does the license metering occur?

input phase

Parsing phase

Indexing phase

Licensing phase

13. You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list ―debug.

What will the output be?

list of all the configurations on-disk that Splunk contains.

A verbose list of all configurations as they were when splunkd started.

A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located

A list of the current running props, conf configurations along with a file path from which the configuration was made

14. When running the command shown below, what is the default path in which deployment server. conf is created?

splunk set deploy-poll deployServer:port

SFLUNK_HOME/etc/deployment

SPLUNK_HOME/etc/system/local

SPLUNK_HOME/etc/system/default

SPLUNK_KOME/etc/apps/deployment

15. The priority of layered Splunk configuration files depends on the file's:

Owner

Weight

Context

Creation time

16. When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Slash notation

Regular expression

Irregular expression

Wildcard-only expression

17. What is required when adding a native user to Splunk? (select all that apply)

Password

Username

Full Name

Default app

18. What are the minimum required settings when creating a network input in Splunk?

Protocol, port number

Protocol, port, location

Protocol, username, port

Protocol, I

port number

19. Which Splunk component requires a Forwarder license?

Search head

Heavy forwarder

Heaviest forwarder

Universal forwarder

20. Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

_TCP_ROUTING

_INDEXER_LIST

_INDEXER_GROUP

_INDEXER ROUTING

Page 3 of 5

21. To set up a Network input in Splunk, what needs to be specified'?

File path.

Username and password

Network protocol and port number.

Network protocol and MAC address.

22. Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

Universal forwarder

Parsing forwarder

Heavy forwarder

Advanced forwarder

23. Which of the following statements describe deployment management? (select all that apply)

Requires an Enterprise license

Is responsible for sending apps to forwarders.

Once used, is the only way to manage forwarders

Can automatically restart the host OS running the forwarder.

24. During search time, which directory of configuration files has the highest precedence?

$SFLUNK_KOME/etc/system/local

$SPLUNK_KCME/etc/system/default

$SPLUNK_HCME/etc/apps/app1/local

$SPLUNK HCME/etc/users/admin/local

25. Within props. conf, which stanzas are valid for data modification? (select all that apply)

Host

Server

Source

Sourcetype

26. Authentication Granted

6 Log into Splunk

27. Where can scripts for scripted inputs reside on the host file system? (select all that apply)

$SFLUNK_HOME/bin/scripts

$SPLUNK_HOME/etc/apps/bin

$SPLUNK_HOME/etc/system/bin

$SPLUNK_HOME/etc/apps/<your_app>/bin_

28. How does the Monitoring Console monitor forwarders?

By pulling internal logs from forwarders.

By using the forwarder monitoring add-on

With internal logs forwarded by forwarders.

With internal logs forwarded by deployment server.

29. What options are available when creating custom roles? (select all that apply)

Restrict search terms

Whitelist search terms

Limit the number of concurrent search jobs

Allow or restrict indexes that can be searched.

30. Which of the following are supported options when configuring optional network inputs?

Metadata override, sender filtering options, network input queues (quantum queues)

Metadata override, sender filtering options, network input queues (memory/persistent queues)

Filename override, sender filtering options, network output queues (memory/persistent queues)

Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Page 4 of 5

31. What is the default character encoding used by Splunk during the input phase?

UTF-8

UTF-16

EBCDIC

ISO 8859

32. Which of the following enables compression for universal forwarders in outputs. conf?

A)

Option A

Option B

Option C

Option D

33. User role inheritance allows what to be inherited from the parent role? (select all that apply)

Parents

Capabilities

Index access

Search history

34. Which of the following statements apply to directory inputs? {select all that apply)

All discovered text files are consumed.

Compressed files are ignored by default

Splunk recursively traverses through the directory structure.

When adding new log files to a monitored directory, the forwarder must be restarted to take them into account.

35. How would you configure your distsearch conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON

A)

option A

Option B

Option C

Option D

36. Which of the following is valid distribute search group?

A)

option A

Option B

Option C

Option D

37. Local user accounts created in Splunk store passwords in which file?

$ SFLUNK_HOME/etc/passwd

$ SFLUNK_HOME/etc/authentication

$ SPLUNK_HOME/etc/users/passwd.conf

$ SPLUNK HOME/etc/users/authentication.conf

38. For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

True

False

Newline Character

39. Which Splunk component does a search head primarily communicate with?

Indexer

Forwarder

Cluster master

Deployment server

40. Which layers are involved in Splunk configuration file layering? (select all that apply)

App context

User context

Global context

Forwarder context

Page 5 of 5

41. Which of the following are methods for adding inputs in Splunk? (select all that apply)

CLI

Splunk Web

Editing inputs. conf

Editing monitor. conf

42. Which of the following authentication types requires scripting in Splunk?

ADFS

LDAP

SAML

RADIUS

43. Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

A token-based HTTP input that is secure and scalable and that requires the use of forwarders

A token-based HTTP input that is secure and scalable and that does not require the use of forwarders.

An agent-based HTTP input that is secure and scalable and that does not require the use of forwarders.

A token-based HTTP input that is insecure and non-scalable and that does not require the use of forwarders.

44. What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

... is not supported in monitor stanzas

There is no difference, they are interchangable and match anything beyond directory boundaries.

* matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.

... matches anything in that specific directory path segment, whereas - recurses through subdirectories as well.

45. What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

License data

Metricsdata

Internal Splunk data

Internal Windows logs

Splunk Enterprise Certified Admin SPLK-1003 Exam Questions

Splunk Enterprise Certified Admin SPLK-1003 Exam Questions

Share this post

Leave a Reply Cancel reply

Related Posts