Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70

Home
Splunk
Splunk Enterprise Certified Admin
SPLK-1003
Splunk Enterprise Certified Admin Questions and Answers

Pass the Splunk Enterprise Certified Admin SPLK-1003 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam SPLK-1003 Premium Access

View all detail and faqs for the SPLK-1003 exam

Go to Exam

350 Students Passed

93% Average Score

97% Same Questions

Viewing page 1 out of 6 pages

Viewing questions 1-10 out of questions

Questions # 1:

Event processing occurs at which phase of the data pipeline?

Options:

Indexing

Parsing

Input

Answer

Explanation

According to the Splunk documentation1, event processing occurs at the parsing phase of the data pipeline. The parsing phase is where Splunk software processes incoming data into individual events, extracts timestamp information, assigns source types, and performs other tasks to make the data searchable1. The parsing phase can also apply field extractions, event type matching, and other transformations to the events2.

Questions # 2:

What is the default value ofLINE_BREAKER?

Options:

\r\n

([\r\n]+)

\r+\n+

(\r\n+)

Answer

Explanation

[Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Data/Configureeventlinebreaking, Line breaking, which uses the LINE_BREAKER setting to split the incoming stream of data into separate lines. By default, the LINE_BREAKER value is any sequence of newlines and carriage returns. In regular expression format, this is represented as the following string: ([\r\n]+). You don't normally need to adjust this setting, but in cases where it's necessary, you must configure it in the props.conf configuration file on the forwarder thatsends the data to Splunk Cloud Platform or a Splunk Enterprise indexer. The LINE_BREAKER setting expects a value in regular expression format., , , ]

Questions # 3:

What is required when adding a native user to Splunk? (select all that apply)

Options:

Password

Username

Full Name

Default app

Answer

A, B

Explanation

According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED

Questions # 4:

In which phase of the index time process does the license metering occur?

Options:

input phase

Parsing phase

Indexing phase

Licensing phase

Answer

Explanation

"When ingesting event data, the measured data volume is based on the new raw data that is placed into the indexing pipeline. Because the data is measured at the indexing pipeline, data that is filetered and dropped prior to indexing does not count against the license volume qota."

https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/HowSplunklicensingworks

Questions # 5:

What is the correct example to redact a plain-text password from raw events?

Options:

in props.conf:[identity]REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

in props.conf:[identity]SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

in transforms.conf:[identity]SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

in transforms.conf:[identity]REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

Answer

Explanation

The correct answer is B. in props.conf:

[identity]

SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

According to the Splunk documentation1, to redact sensitive data from raw events, you need to use the SEDCMD attribute in the props.conf file. The SEDCMD attribute applies a sed expression to the raw data before indexing. The sed expression can use the s command to replace a pattern with a substitution string. For example, the following sed expression replaces any occurrence of password= followed by any characters until a comma, whitespace, or slash with ####REACTED####:

s/password=([^,|/s]+)/ ####REACTED####/g

The g flag at the end means that the replacement is applied globally, not just to the first match.

Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them.

Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before.

Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file.

[References:1:Redact data from events - Splunk Documentation, , , , , , ]

Questions # 6:

Which of the following is an appropriate description of a deployment server in a non-cluster environment?

Options:

Allows management of local Splunk instances, requires Enterprise license, handles job of sending configurations packaged as apps. can automatically restart remote Splunk instances.

Allows management of remote Splunk instances, requires Enterprise license, handles job of sending configurations, can automatically restart remote Splunk instances.

Allows management of remote Splunk instances, requires no license, handles job of sending configurations, can automatically restart remote Splunk instances.

Allows management of remote Splunk instances, requires Enterprise license, handles job of sending configurations, can manually restart remote Splunk instances.

Answer

Explanation

[Reference:https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/StartSplunk, , https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Deploymentserverarchitecture, "A deployment client is a Splunk instance remotely configured by a deployment server"., , ]

Questions # 7:

After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

Options:

channelTTL

connectionTimeout

autoLBFrequency

secsInFailurelnterval

Answer

Explanation

[Reference:https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/Configureloadbalancing, , , ]

Questions # 8:

Which valid bucket types are searchable? (select all that apply)

Options:

Hot buckets

Cold buckets

Warm buckets

Frozen buckets

Answer

A, B, C

Explanation

Hot/warm/cold/thawed bucket types are searchable. Frozen isn't searchable because its either deleted at that state or archived.

Questions # 9:

Which Splunk component performs indexing and responds to search requests from the search head?

Options:

Forwarder

Search peer

License master

Search head cluster

Answer

Explanation

https://docs.splunk.com/Splexicon:Searchpeer

"A Splunk platform instance that responses to search requests from a search head. The term "Search peer" is usually synonymous with the indexer role in a distributed search topology..."

Questions # 10:

TheLINE_BREAKERattribute is configured in which configuration file?