Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 121:

  When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?

  A. Default app

  B. LDAP group

  C. Password

  D. Username

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/ConfigureLDAPwithSplunkWeb

• Question 122:

  Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

  A. splunk btool server list --debug

  B. splunk list forward-indexer

  C. splunk list forward-server

  D. splunk btool indexes list --debug

  Correct Answer: C

  Reference: https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-configure-a-Splunk-Forwarder-on-Linux/m-p/72078

• Question 123:

  Which artifact is required in the request header when creating an HTTP event?

  A. ackID

  B. Token

  C. Manifest

  D. Host name

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/FormateventsforHTTPEventCollector

• Question 124:

  All search-time field extractions should be specified on which Splunk component?

  A. Deployment server

  B. Universal forwarder

  C. Indexer

  D. Search head

  Correct Answer: C

  Reference: https://github.com/packetiq/SplunkArchitect/blob/master/README/props.conf.spec

• Question 125:

  In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

  A. Universal forwarders

  B. Splunk Cloud

  C. Linux package managers

  D. Windows using WMI

  Correct Answer: A

  Reference: https://community.splunk.com/t5/Deployment-Architecture/Push-apps-from-deployment-server-automatically-to-universal/m-p/328191

• Question 126:

  What is the command to reset the fishbucket for one source?

  A. rm -r ~/splunkforwarder/var/lib/splunk/fishbucket

  B. splunk clean eventdata -index _thefishbucket

  C. splunk cmd btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file --reset

  D. splunk btool fishbucket reset

  Correct Answer: C

  Reference: https://community.splunk.com/t5/Getting-Data-In/How-can-I-trigger-the-re-indexing-of-a-single-file/m-p/108568

• Question 127:

  Which setting allows the configuration of Splunk to allow events to span over more than one line?

  A. SHOULD_LINEMERGE = true

  B. BREAK_ONLY_BEFORE_DATE = true

  C. BREAK_ONLY_BEFORE =

  D. SHOULD_LINEMERGE = false

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configureeventlinebreaking

• Question 128:

  In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

  A. 21MB

  B. 28MB

  C. 14MB

  D. 7MB

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Protectagainstlossofin-flightdata

• Question 129:

  Which of the following are reasons to create separate indexes? (Choose all that apply.)

  A. Different retention times.

  B. Increase number of users.

  C. Restrict user permissions.

  D. File organization.

  Correct Answer: AD

  Reference: https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-have-multiple-indexes/m-p/12063

• Question 130:

  Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

  A. diskQueueSize

  B. durableQueueSize

  C. persistentQueueSize

  D. queueSize

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2111/Data/Usepersistentqueues