Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Splunk
Splunk Enterprise Certified Admin
SPLK-1003
Splunk Enterprise Certified Admin Questions and Answers

Pass the Splunk Enterprise Certified Admin SPLK-1003 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam SPLK-1003 Premium Access

View all detail and faqs for the SPLK-1003 exam

Go to Exam

645 Students Passed

90% Average Score

98% Same Questions

Viewing page 4 out of 7 pages

Viewing questions 31-40 out of questions

Questions # 31:

After how many warnings within a rolling 30-day period will a license violation occur with an enforced

Enterprise license?

Options:

Answer

Explanation

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Aboutlicenseviolations

"Enterprise Trial license. If you get five or more warnings in a rolling 30 days period, you are in violation of your license. Dev/Test license. If you generate five or more warnings in a rolling 30-day period, you are in violation of your license. Developer license. If you generate five or more warnings in a rolling 30-day period, you are in violation of your license. BUT for Free license. If you get three or more warnings in a rolling 30 days period, you are in violation of your license."

[Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Aboutlicenseviolations, , ]

Questions # 32:

When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

Options:

On Universal Forwarder, $SPLUNK_HOME/etc/apps

On Deployment Server, $SPLUNK_HOME/etc/apps

On Deployment Server, $SPLUNK_HOME/etc/deployment-apps

On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps

Answer

Explanation

The correct answer is C. On Deployment Server, $SPLUNK_HOME/etc/deployment-apps.

A deployment server is a Splunk Enterprise instance that acts as a centralized configuration manager for any number of other instances, called “deployment clients”. A deployment client can be a universal forwarder, a non-clustered indexer, or a search head1.

A deployment app is a directory that contains any content that you want to download to a set of deployment clients. The content can include a Splunk Enterprise app, a set of Splunk Enterprise configurations, or other content, such as scripts, images, and supporting files2.

You create a deployment app by creating a directory for it on the deployment server. The default location is $SPLUNK_HOME/etc/deployment-apps, but this is configurable through the repositoryLocation attribute in serverclass.conf. Underneath this location, each app must have its own subdirectory. The name of the subdirectory serves as the app name in the forwarder management interface2.

The other options are incorrect because:

A. On Universal Forwarder, $SPLUNK_HOME/etc/apps. This is the location where the deployment app resides after it is downloaded from the deployment server to the universal forwarder. It is not the location of the app before it is deployed2.

B. On Deployment Server, $SPLUNK_HOME/etc/apps. This is the location where the apps that are specific to the deployment server itself reside. It is not the location where the deployment apps for the clients are stored2.

D. On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps. This is not a valid location for any app on a universal forwarder. The universal forwarder does not act as a deployment server and does not store deployment apps3.

Questions # 33:

When using a directory monitor input, specific source type can be selectively overridden using which configuration file?

Options:

props.conf

sourcetypes.conf

transforms.conf

outputs.conf

Answer

Explanation

[Reference:https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Bypassautomaticsourcetypeassignment, , When using a directory monitor input, specific source types can be selectively overridden using props.conf. The props.conf file contains settings for parsing and indexing data, as well as search-time field extractions. The props.conf file can be used to assign or change source types for specific inputs using the sourcetype attribute. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Configure directory monitor inputs - Splunk Documentation], , ]

Questions # 34:

Which of the following statements accurately describes using SSL to secure the feed from a forwarder?

Options:

It does not encrypt the certificate password.

SSL automatically compresses the feed by default.

It requires that the forwarder be set to compressed=true.

It requires that the receiver be set to compression=true.

Answer

Explanation

[Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/, AboutsecuringyourSplunkconfigurationwithSSL, ]

Questions # 35:

For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

Options:

True

False

Newline Character

Answer

Explanation

https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking

Attribute : SHOULD_LINEMERGE = [true|false]

Description : When set to true, the Splunk platform combines several input lines into a single event, with configuration based on the settings described in the next section.

Questions # 36:

How do you remove missing forwarders from the Monitoring Console?

Options:

By restarting Splunk.

By rescanning active forwarders.

By reloading the deployment server.

By rebuilding the forwarder asset table.

Answer

Questions # 37:

In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Options:

To ensure that hot buckets are still open for writes and have not been forced to roll to a cold state

To ensure that configuration files have not been tampered with for auditing and/or legal purposes

To ensure that user passwords have not been tampered with for auditing and/or legal purposes.

To ensure that data has not been tampered with for auditing and/or legal purposes

Answer

Questions # 38:

Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

Options:

_TCP_ROUTING

_INDEXER_LIST

_INDEXER_GROUP

_INDEXER ROUTING

Answer

Explanation

https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding

Specifies a comma-separated list of tcpout group names. Use this setting to selectively forward your data to specific indexers by specifying the tcpout groups that the forwarder should use when forwarding the data. Define the tcpout group names in the outputs.conf file in [tcpout:] stanzas. The groups present in defaultGroup in [tcpout] stanza in the outputs.conf file.

Questions # 39:

Which of the following apply to how distributed search works? (select all that apply)

Options:

The search head dispatches searches to the peers

The search peers pull the data from the forwarders.

Peers run searches in parallel and return their portion of results.

The search head consolidates the individual results and prepares reports

Answer

A, C, D

Explanation

Users log on to the search head and run reports: – The search head dispatches searches to the peers – Peers run searches in parallel and return their portion of results – The search head consolidates the individual results and prepares reports

Questions # 40:

In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

Options:

services/ collector

services/ inputs ? raw

services/ data/ collector

data/ collector

Answer

Explanation

The answer to your question is C. services/data/collector. This is the endpoint URI used to collect data in a customer managed Splunk Enterprise environment.According to the Splunk documentation1, “The HTTP Event Collector REST API endpoint is /services/data/collector.You can use this endpoint to send events to HTTP Event Collector on a Splunk Enterprise or Splunk Cloud Platform deployment.” You can also use this endpoint to send events to a specific token or index1. For example, you can use the following curl command to send an event with the token 578254cc-05f5-46b5-957b-910d1400341a and the index main:

curl -k https://localhost:8088/services/data/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-957b-910d1400341a'-d'{"index":"main","event":"Hello, world!"}'

Viewing page 4 out of 7 pages

Viewing questions 31-40 out of questions