Summer Special Sale Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 713PS592

SPLK-1003 Splunk Enterprise Certified Admin Questions and Answers

Questions 4

In this example, ifuseACKis set to true and themaxQueueSizeis set to 7MB, what is the size of the wait queue on this universal forwarder?

Options:

A.

21MB

B.

28MB

C.

14MB

D.

7MB

Buy Now
Questions 5

Which of the following are methods for adding inputs in Splunk? (select all that apply)

Options:

A.

CLI

B.

Splunk Web

C.

Editing inputs. conf

D.

Editing monitor. conf

Buy Now
Questions 6

Within props. conf, which stanzas are valid for data modification? (select all that apply)

Options:

A.

Host

B.

Server

C.

Source

D.

Sourcetype

Buy Now
Questions 7

Which Splunk configuration file is used to enable data integrity checking?

Options:

A.

props.conf

B.

global.conf

C.

indexes.conf

D.

data_integrity.conf

Buy Now
Questions 8

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Options:

A.

License data

B.

Metricsdata

C.

Internal Splunk data

D.

Internal Windows logs

Buy Now
Questions 9

To set up a Network input in Splunk, what needs to be specified'?

Options:

A.

File path.

B.

Username and password

C.

Network protocol and port number.

D.

Network protocol and MAC address.

Buy Now
Questions 10

After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

Options:

A.

index=main

B.

index=test

C.

index=summary

D.

index=_internal

Buy Now
Questions 11

Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

Options:

A.

props.conf

B.

inputs.conf

C.

rawdata.conf

D.

transforms.conf

Buy Now
Questions 12

Immediately after installation, what will a Universal Forwarder do first?

Options:

A.

Automatically detect any indexers in its subnet and begin routing data.

B.

Begin reading local files on its server.

C.

Begin generating internal Splunk logs.

D.

Send an email to the operator that the installation process has completed.

Buy Now
Questions 13

If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component

would the fishbucket need to be reset in order to reindex the data?

Options:

A.

Indexer

B.

Forwarder

C.

Search head

D.

Deployment server

Buy Now
Questions 14

Which of the following must be done to define user permissions when integrating Splunk with LDAP?

Options:

A.

Map Users

B.

Map Groups

C.

Map LDAP Inheritance

D.

Map LDAP to Active Directory

Buy Now
Questions 15

In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Options:

A.

To ensure that hot buckets are still open for writes and have not been forced to roll to a cold state

B.

To ensure that configuration files have not been tampered with for auditing and/or legal purposes

C.

To ensure that user passwords have not been tampered with for auditing and/or legal purposes.

D.

To ensure that data has not been tampered with for auditing and/or legal purposes

Buy Now
Questions 16

Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is

cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint

information for that file?

Options:

A.

_audit

B.

_checkpoint

C.

_introspection

D.

_thefishbucket

Buy Now
Questions 17

What type of Splunk license is pre-selected in a brand new Splunk installation?

Options:

A.

Free license

B.

Forwarder license

C.

Enterprise trial license

D.

Enterprise license

Buy Now
Questions 18

Which Splunk component(s) would break a stream of syslog inputs into individual events? (select all that apply)

Options:

A.

Universal Forwarder

B.

Search head

C.

Heavy Forwarder

D.

Indexer

Buy Now
Questions 19

How would you configure your distsearch conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON

A)

SPLK-1003 Question 19

B)

SPLK-1003 Question 19

C)

SPLK-1003 Question 19

D)

SPLK-1003 Question 19

Options:

A.

option A

B.

Option B

C.

Option C

D.

Option D

Buy Now
Questions 20

In this source definition the MAX_TIMESTAMP_LOOKHEAD is missing. Which value would fit best?

SPLK-1003 Question 20

Event example:

SPLK-1003 Question 20

Options:

A.

MAX_TIMESTAMP_L0CKAHEAD = 5

B.

MAX_TIMESTAMP_LOOKAHEAD - 10

C.

MAX_TIMESTAMF_LOOKHEAD = 20

D.

MAX TIMESTAMP LOOKAHEAD - 30

Buy Now
Questions 21

Which of the methods listed below supports muti-factor authentication?

Options:

A.

Lightweight Directory Access Protocol (LDAP)

B.

Security Assertion Markup Language (SAML)

C.

Single Sign-on (SSO)

D.

OpenlD

Buy Now
Questions 22

Where are license files stored?

Options:

A.

$SPLUNK_HOME/etc/secure

B.

$SPLUNK_HOME/etc/system

C.

$SPLUNK_HOME/etc/licenses

D.

$SPLUNK_HOME/etc/apps/licenses

Buy Now
Questions 23

What event-processing pipelines are used to process data for indexing? (select all that apply)

Options:

A.

Typing pipeline

B.

Parsing pipeline

C.

fifo pipeline

D.

Indexing pipeline

Buy Now
Questions 24

When does a warm bucket roll over to a cold bucket?

Options:

A.

When Splunk is restarted.

B.

When the maximum warm bucket age has been reached.

C.

When the maximum warm bucket size has been reached.

D.

When the maximum number of warm buckets is reached.

Buy Now
Questions 25

Which valid bucket types are searchable? (select all that apply)

Options:

A.

Hot buckets

B.

Cold buckets

C.

Warm buckets

D.

Frozen buckets

Buy Now
Questions 26

What is a role in Splunk? (select all that apply)

Options:

A.

A classification that determines what capabilities a user has.

B.

A classification that determines if a Splunk server can remotely control another Splunk server.

C.

A classification that determines what functions a Splunk server controls.

D.

A classification that determines what indexes a user can search.

Buy Now
Questions 27

Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?

Options:

A.

Tail Reader

B.

Upload

C.

MonitorNoHandIe

D.

Monitor

Buy Now
Questions 28

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the defaultprops.confbelow, whichSPLUNK_HOME/etc/users/buttercup/myTA/local/props.confstanza can be added to the user’s local context to disable the field aliases?

SPLK-1003 Question 28

SPLK-1003 Question 28

Options:

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Buy Now
Questions 29

A Splunk administrator has been tasked with developing a retention strategy to have frequently accessed data sets on SSD storage and to have older, less frequently accessed data on slower NAS storage. They have set a mount point for the NAS. Which parameter do they need to modify to set the path for the older, less frequently accessed data in indexes.conf?

Options:

A.

homepath

B.

thawedPath

C.

summaryHomePath

D.

colddeath

Buy Now
Questions 30

Which of the following is a benefit of distributed search?

Options:

A.

Peers run search in sequence.

B.

Peers run search in parallel.

C.

Resilience from indexer failure.

D.

Resilience from search head failure.

Buy Now
Questions 31

An index stores its data in buckets. Which default directories does Splunk use to store buckets? (Choose all that apply.)

Options:

A.

bucketdb

B.

frozendb

C.

colddb

D.

db

Buy Now
Questions 32

Which artifact is required in the request header when creating an HTTP event?

Options:

A.

ackID

B.

Token

C.

Manifest

D.

Host name

Buy Now
Questions 33

Which of the following Splunk components require a separate installation package?

Options:

A.

Deployment server

B.

License master

C.

Universal forwarder

D.

Heavy forwarder

Buy Now
Questions 34

Which pathway represents where a network input in Splunk might be found?

Options:

A.

$SPLUNK HOME/ etc/ apps/ ne two r k/ inputs.conf

B.

$SPLUNK HOME/ etc/ apps/ $appName/ local / inputs.conf

C.

$SPLUNK HOME/ system/ local /udp.conf

D.

$SPLUNK HOME/ var/lib/ splunk/$inputName/homePath/

Buy Now
Questions 35

For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

Options:

A.

True

B.

False

C.

D.

Newline Character

Buy Now
Questions 36

When using license pools, volume allocations apply to which Splunk components?

Options:

A.

Indexers

B.

Indexes

C.

Heavy Forwarders

D.

Search Heads

Buy Now
Questions 37

Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Options:

A.

A token-based HTTP input that is secure and scalable and that requires the use of forwarders

B.

A token-based HTTP input that is secure and scalable and that does not require the use of forwarders.

C.

An agent-based HTTP input that is secure and scalable and that does not require the use of forwarders.

D.

A token-based HTTP input that is insecure and non-scalable and that does not require the use of forwarders.

Buy Now
Questions 38

Syslog files are being monitored on a Heavy Forwarder.

Where would the appropriate TRANSFORMS setting be deployed to reroute logs based on the event message?

Options:

A.

Heavy Forwarder

B.

Indexer

C.

Search head

D.

Deployment server

Buy Now
Questions 39

Which of the following are supported options when configuring optional network inputs?

Options:

A.

Metadata override, sender filtering options, network input queues (quantum queues)

B.

Metadata override, sender filtering options, network input queues (memory/persistent queues)

C.

Filename override, sender filtering options, network output queues (memory/persistent queues)

D.

Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Buy Now
Questions 40

Which of the following statements describes how distributed search works?

Options:

A.

Forwarders pull data from the search peers.

B.

Search heads store a portion of the searchable data.

C.

The search head dispatches searches to the search peers.

D.

Search results are replicated within the indexer cluster.

Buy Now
Questions 41

In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

Options:

A.

services/ collector

B.

services/ inputs ? raw

C.

services/ data/ collector

D.

data/ collector

Buy Now
Questions 42

After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

Options:

A.

channelTTL

B.

connectionTimeout

C.

autoLBFrequency

D.

secsInFailurelnterval

Buy Now
Questions 43

Which setting allows the configuration of Splunk to allow events to span over more than one line?

Options:

A.

SHOULD_LINEMERGE = true

B.

BREAK_ONLY_BEFORE_DATE = true

C.

BREAK_ONLY_BEFORE =

D.

SHOULD_LINEMERGE = false

Buy Now
Questions 44

When working with an indexer cluster, what changes with the global precedence when comparing to a standalone deployment?

Options:

A.

Nothing changes.

B.

The peer-apps local directory becomes the highest priority.

C.

The app local directories move to second in the priority list.

D.

The system default directory' becomes the highest priority.

Buy Now
Questions 45

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Options:

A.

inputs.conf

B.

monitor.conf

C.

outputs.conf

D.

forwarder.conf

Buy Now
Questions 46

What is the name of the object that stores events inside of an index?

Options:

A.

Container

B.

Bucket

C.

Data layer

D.

Indexer

Buy Now
Questions 47

When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Options:

A.

Enable indexer acknowledgment.

B.

Enable forwarder acknowledgment.

C.

splunk check-integrity -index

D.

index=_internal component=ACK | stats count by host

Buy Now
Questions 48

Which feature of Splunk’s role configuration can be used to aggregate multiple roles intended for groups of

users?

Options:

A.

Linked roles

B.

Grantable roles

C.

Role federation

D.

Role inheritance

Buy Now
Questions 49

In a distributed environment, which Splunk component is used to distribute apps and configurations to the

other Splunk instances?

Options:

A.

Indexer

B.

Deployer

C.

Forwarder

D.

Deployment server

Buy Now
Exam Code: SPLK-1003
Exam Name: Splunk Enterprise Certified Admin
Last Update: Jun 13, 2024
Questions: 182

PDF + Testing Engine

$66.4  $165.99

Testing Engine

$46  $114.99
buy now SPLK-1003 testing engine

PDF (Q&A)

$42  $104.99
buy now SPLK-1003 pdf