Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 1:

  Which of the following statements apply to directory inputs? {select all that apply)

  A. All discovered text files are consumed.
  B. Compressed files are ignored by default
  C. Splunk recursively traverses through the directory structure.
  D. When adding new log files to a monitored directory, the forwarder must be restarted to take them into account.
  A. All discovered text files are consumed.
  C. Splunk recursively traverses through the directory structure.

• Question 2:

  What event-processing pipelines are used to process data for indexing? (select all that apply)

  A. Typing pipeline
  B. Parsing pipeline
  C. fifo pipeline
  D. Indexing pipeline
  B. Parsing pipeline
  D. Indexing pipeline

• Question 3:

  Which of the following are required when defining an index in indexes. conf? (select all that apply)

  A. coldPath
  B. homePath
  C. frozenPath
  D. thawedPath
  A. coldPath
  B. homePath
  D. thawedPath

  ---

  Explanation/Reference:

  homePath = $SPLUNK_DB/hatchdb/db coldPath = $SPLUNK_DB/hatchdb/colddb thawedPath = $SPLUNK_DB/hatchdb/thaweddb

• Question 4:

  The following stanza is active in indexes.conf:

  [cat_facts]

  maxHotSpanSecs = 3600

  frozenTimePeriodInSecs = 2630000

  maxTota1DataSizeMB = 650000

  All other related indexes.conf settings are default values.

  If the event timestamp was 3739283 seconds ago, will it be searchable?

  A. Yes, only if the bucket is still hot.
  B. No, because the index will have exceeded its maximum size.
  C. Yes, only if the index size is also below 650000 MB.
  D. No, because the event time is greater than the retention time.
  D. No, because the event time is greater than the retention time.

  ---

  Explanation/Reference:

  The correct answer is D. No, because the event time is greater than the retention time. According to the Splunk documentation1, the frozenTimePeriodInSecs setting in indexes.conf determines how long Splunk software retains indexed data before deleting it or archiving it to a remote storage. The default value is 188697600 seconds, which is equivalent to six years. The setting can be overridden on a per-index basis. In this case, the cat_facts index has a frozenTimePeriodInSecs setting of 2630000 seconds, which is equivalent to about 30 days. This means that any event that is older than 30 days from the current time will be removed from the index and will not be searchable. The event timestamp was 3739283 seconds ago, which is equivalent to about 43 days. This means that the event is older than the retention time of the cat_facts index and will not be searchable. The other settings in the stanza, such as maxHotSpanSecs and maxTota1DataSizeMB, do not affect the retention time of the events. They only affect the size and duration of the buckets that store the events. References:1:Set a retirement and archiving policy - Splunk Documentation

• Question 5:

  After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

  A. 90 days
  B. 60 days
  C. 7 days
  D. 14 days
  B. 60 days

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/MoreaboutSplunkFree

  https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/TypesofSplunklicenses

• Question 6:

  An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data

  is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the

  index?

  A. Buy a bigger Splunk license.
  B. Add 2.5 TB each day for the next 5 days.
  C. Add all 10 TB in a single 24 hour period.
  D. Add 200 GB of historical data each day for 50 days.
  C. Add all 10 TB in a single 24 hour period.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Aboutlicenseviolations "An Enterprise license stack with a license volume of 100 GB of data per day or more does not currently violate."

• Question 7:

  After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

  A. index=main
  B. index=test
  C. index=summary
  D. index=_internal
  D. index=_internal

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Validateyourconfiguration

• Question 8:

  Which valid bucket types are searchable? (select all that apply)

  A. Hot buckets
  B. Cold buckets
  C. Warm buckets
  D. Frozen buckets
  A. Hot buckets
  B. Cold buckets
  C. Warm buckets

  ---

  Explanation/Reference:

  Hot/warm/cold/thawed bucket types are searchable. Frozen isn't searchable because its either deleted at that state or archived.

• Question 9:

  Which forwarder is recommended by Splunk to use in a production environment?

  A. Heavy forwarder
  B. SSL forwarder
  C. Lightweight forwarder
  D. Universal forwarder
  D. Universal forwarder

  ---

  Explanation/Reference:

  Reference:https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/18009

  The forwarder that is recommended by Splunk to use in a production environment is the universal forwarder. The universal forwarder is a lightweight Splunk agent that forwards data to indexers or other forwarders. The universal forwarder has a small footprint and consumes minimal system resources. It also supports secure and reliable data forwarding with encryption and acknowledgement features. Therefore, option D is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About forwarding and receiving data - Splunk Documentation]

• Question 10:

  Where should apps be located on the deployment server that the clients pull from?

  A. $SFLUNK_KOME/etc/apps
  B. $SPLUNK_HCME/etc/sear:ch
  C. $SPLUNK_HCME/etc/master-apps
  D. $SPLUNK HCME/etc/deployment-apps
  D. $SPLUNK HCME/etc/deployment-apps

  ---

  Explanation/Reference:

  After an app is downloaded, it resides under $SPLUNK_HOME/etc/apps on the deployment clients. But it resided in the $SPLUNK_HOME/etc/deployment-apps location in the deployment server.