SPLK-1003

For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?A . TrueB . FalseC . <regex string>D . Newline CharacterView AnswerAnswer: B

Which Splunk component performs indexing and responds to search requests from the search head?A . ForwarderB . Search peerC . License masterD . Search head clusterView AnswerAnswer: B

What conf file needs to be edited to set up distributed search groups?A . props.confB . search.confC . distsearch.confD . distibutedsearch.confView AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Distributedsearchgroups

What is the valid option for a [monitor] stanza in inputs.conf?A . enabledB . datasourceC . server_nameD . ignoreOlderThanView AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Monitorfilesanddirectorieswithinputs.conf

After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?A . index=mainB . index=testC . index=summaryD . index=_internalView AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Validateyourconfiguration

Which of the following is valid distribute search group? A) B) C) D) A . option AB . Option BC . Option CD . Option DView AnswerAnswer: D

Which of the following is an appropriate description of a deployment server in a non-cluster environment?A . Allows management of local Splunk instances, requires Enterprise license, handles job of sending configurations packaged as apps. can automatically restart remote Splunk instances.B . Allows management of remote Splunk instances, requires Enterprise license,...

Which of the following monitor inputs stanza headers would match all of the following files? /var/log/www1/secure.log /var/log/www/secure.l /var/log/www/logs/secure.logs /var/log/www2/secure.logA . [monitor:///var/log/.../secure.*B . [monitor:///var/log/www1/secure.*]C . [monitor:///var/log/www1/secure.log]D . [monitor:///var/log/www*/secure.*]View AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorfilesanddirectorieswithinputs.conf

Which option accurately describes the purpose of the HTTP Event Collector (HEC)?A . A token-based HTTP input that is secure and scalable and that requires the use of forwardersB . A token-based HTTP input that is secure and scalable and that does not require the use of forwarders.C . An...

Which of the following apply to how distributed search works? (select all that apply)A . The search head dispatches searches to the peersB . The search peers pull the data from the forwarders.C . Peers run searches in parallel and return their portion of results.D . The search head consolidates...