SPLK-1003

Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)A . HostB . ServerC . SourceD . SourcetypeView AnswerAnswer: CD Explanation: Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for­udp-514-data-sources.html

In case of a conflict between a whitelist and a blacklist input setting, which one is used?A . BlacklistB . WhitelistC . They cancel each other out.D . Whichever is entered into the configuration first.View AnswerAnswer: A Explanation: Reference: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=8&ved=2ahUKEwj0r6Lso6bkAhUqxYUKHbWlDz4QFjAHegQIAxAC&url=http%3A%2F%2Fsplunk.training%2Fshowpdf.asp%3Fdata%3D789BB6B10C1B4376B548D711B4377F3F4B511B437805A8EC11B437742EA8F11B43779B6FA211B4376EA657C11B4376FC19B311B4377E2407E11B43730AF97411B4377F3F4B511B437742EA8F11B43779B6FA211B43771F822111B437731365811B43730AF97411B437789BB6B11B4376B548D711B4377F3F4B511B437805A8EC11B437742EA8F11B43779B6FA211B4376EA657C11B4376FC19B311B4377E2407E11B43732E61E211B4377F3F4B511B437742EA8F11B43779B6FA211B43771F822111B437731365811B43746D0DC011B4377549EC611B4377BED81011B437789BB6B11B4376D8B14511B437731365811B4376B548D711B4377F3F4B511B4376FC19B311B43732E61E211B4376D8B14511B4377AD23D911B437789BB6B11B43730AF97411B4373989B2C11B437386E6F511B437386E6F511B4373DF6C0811B43737532BE11B4373BC039A11B437351CA5011B43737532BE11B43730AF97411B4375BD6DD511B43730AF97411B437564E8C211B43730AF97411B437%257C2318D1%257C11649A&usg=AOvVaw2e9s­JweivuCkqTb4-Y9uW

In which phase of the index time process does the license metering occur?A . Input phaseB . Parsing phaseC . Indexing phaseD . Licensing phaseView AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)A . HostB . ServerC . SourceD . SourcetypeView AnswerAnswer: CD Explanation: Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for­udp-514-data-sources.html

The universal forwarder has which capabilities when sending data? (Choose all that apply.)A . Sending alertsB . Compressing dataC . Obfuscating/hiding dataD . Indexer acknowledgementView AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders

Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)A . HostB . ServerC . SourceD . SourcetypeView AnswerAnswer: CD Explanation: Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for­udp-514-data-sources.html

What options are available when creating custom roles? (Choose all that apply.)A . Restrict search terms.B . Whitelist search terms.C . Limit the number of concurrent search jobs.D . Allow or restrict indexes that can be searched.View AnswerAnswer: AD Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Aboutusersandroles

How does the Monitoring Console monitor forwarders?A . By pulling internal logs from forwarders.B . By using the forwarder monitoring add-on.C . With internal logs forwarded by forwarders.D . With internal logs forwarded by deployment server.View AnswerAnswer: A

Which Splunk component requires a Forwarder license?A . Search headB . Heavy forwarderC . Heaviest forwarderD . Universal forwarderView AnswerAnswer: B Explanation: Reference: https://answers.splunk.com/answers/70017/heavy-forwarder-costs-and-licenses.html

Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)A . HostB . ServerC . SourceD . SourcetypeView AnswerAnswer: CD Explanation: Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for­udp-514-data-sources.html