Winter 50% Special Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 28285018

SPLK-3003 Splunk Core Certified Consultant Questions and Answers

Questions 4

Which of the following server roles should be configured for a host which indexes its internal logs locally?

Options:

A.

Cluster master

B.

Indexer

C.

Monitoring Console (MC)

D.

Search head

Buy Now
Questions 5

An index receives approximately 50GB of data per day per indexer at an even and consistent rate. The customer would like to keep this data searchable for a minimum of 30 days. In addition, they have hourly scheduled searches that process a week’s worth of data and are quite sensitive to search performance.

Given ideal conditions (no restarts, nor drops/bursts in data volume), and following PS best practices, which of the following sets of indexes.conf settings can be leveraged to meet the requirements?

Options:

A.

frozenTimePeriodInSecs, maxDataSize, maxVolumeDataSizeMB, maxHotBuckets

B.

maxDataSize, maxTotalDataSizeMB, maxHotBuckets, maxGlobalDataSizeMB

C.

maxDataSize, frozenTimePeriodInSecs, maxVolumeDataSizeMB

D.

frozenTimePeriodInSecs, maxWarmDBCount, homePath.maxDataSizeMB, maxHotSpanSecs

Buy Now
Questions 6

A new single-site three indexer cluster is being stood up with replication_factor:2, search_factor:2. At which step would the Indexer Cluster be classed as ‘Indexing Ready’ and be able to ingest new data?

Step 1: Install and configure Cluster Master (CM)/Master Node with base clustering stanza settings, restarting CM.

Step 2: Configure a base app in etc/master-apps on the CM to enable a splunktcp input on port 9997 and deploy index creation configurations.

Step 3: Install and configure Indexer 1 so that once restarted, it contacts the CM, download the latest config bundle.

Step 4: Indexer 1 restarts and has successfully joined the cluster.

Step 5: Install and configure Indexer 2 so that once restarted, it contacts the CM, downloads the latest config bundle

Step 6: Indexer 2 restarts and has successfully joined the cluster.

Step 7: Install and configure Indexer 3 so that once restarted, it contacts the CM, downloads the latest config bundle.

Step 8: Indexer 3 restarts and has successfully joined the cluster.

Options:

A.

Step 2

B.

Step 4

C.

Step 6

D.

Step 8

Buy Now
Questions 7

Which of the following server.conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

Options:

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Buy Now
Questions 8

When utilizing a subsearch within a Splunk SPL search query, which of the following statements is accurate?

Options:

A.

Subsearches have to be initiated with the | subsearch command.

B.

Subsearches can only be utilized with | inputlookup command.

C.

Subsearches have a default result output limit of 10000.

D.

There are no specific limitations when using subsearches.

Buy Now
Questions 9

A customer’s deployment server is overwhelmed with forwarder connections after adding an additional 1000 clients. The default phone home interval is set to 60 seconds. To reduce the number of connection failures to the DS what is recommended?

Options:

A.

Create a tiered deployment server topology.

B.

Reduce the phone home interval to 6 seconds.

C.

Leave the phone home interval at 60 seconds.

D.

Increase the phone home interval to 600 seconds.

Buy Now
Questions 10

A customer is using both internal Splunk authentication and LDAP for user management.

If a username exists in both $SPLUNK_HOME/etc/passwd and LDAP, which of the following statements is accurate?

Options:

A.

The internal Splunk authentication will take precedence.

B.

Authentication will only succeed if the password is the same in both systems.

C.

The LDAP user account will take precedence.

D.

Splunk will error as it does not support overlapping usernames

Buy Now
Questions 11

The customer has an indexer cluster supporting a wide variety of search needs, including scheduled search, data model acceleration, and summary indexing. Here is an excerpt from the cluster mater’s server.conf:

Which strategy represents the minimum and least disruptive change necessary to protect the searchability of the indexer cluster in case of indexer failure?

Options:

A.

Enable maintenance mode on the CM to prevent excessive fix-up and bring the failed indexer back online.

B.

Leave replication_factor=2, increase search_factor=2 and enable summary_replication.

C.

Convert the cluster to multi-site and modify the server.conf to be site_replication_factor=2, site_search_factor=2.

D.

Increase replication_factor=3, search_factor=2 to protect the data, and allow there to always be a searchable copy.

Buy Now
Questions 12

Which statement is true about subsearches?

Options:

A.

Subsearches are faster than other types of searches.

B.

Subsearches work best for joining two large result sets.

C.

Subsearches run at the same time as their outer search.

D.

Subsearches work best for small result sets.

Buy Now
Exam Code: SPLK-3003
Exam Name: Splunk Core Certified Consultant
Last Update: Apr 23, 2021
Questions: 85

PDF + Testing Engine

$124.5  $249

Testing Engine

$112.5  $225

PDF (Q&A)

$99.5  $199