Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 121:

  Which artifact is required in the request header when creating an HTTP event?

  A. ackID
  B. Token
  C. Manifest
  D. Host name
  B. Token

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/FormateventsforHTT PEventCollector

  When creating an HTTP event, the request header must include a token that identifies the HTTP Event Collector (HEC) endpoint. The token is a 32-character hexadecimal string that is generated when the HEC endpoint is created. The token is used to authenticate the request and route the event data to the correct index. Therefore, option B is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About HTTP Event Collector - Splunk Documentation]

• Question 122:

  How can native authentication be disabled in Splunk?

  A. Remove the $SPLUNK_HOME/etc/passwd file
  B. Create an empty $SPLUNK_HOME/etc/passwd file
  C. Set SPLUNK_AUTHENTICATION=false in splunk-launch.conf
  D. Set nativeAuthentication=false in authentication.conf
  B. Create an empty $SPLUNK_HOME/etc/passwd file

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Secureyouradminaccount

• Question 123:

  Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

  A. Indexers
  B. Forwarder
  C. Search head
  D. Search peers
  C. Search head

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Howuserscancontroldistributedsearches "From the user standpoint, specifying and running a distributed search is essentially the same as running any other search. Behind the scenes, the search head distributes the query to its search peers, and consolidates the results when presenting them to the user."

• Question 124:

  Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

  A. splunk btool server list --debug
  B. splunk list forward-indexer
  C. splunk list forward-server
  D. splunk btool indexes list --debug
  C. splunk list forward-server

  ---

  Explanation/Reference:

  Reference:https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-configure-a- Splunk-Forwarder-on-Linux/m-p/72078 The CLI command to view the current forwarder to indexer configuration is splunk list forward-server. This command displays the hostnames and port numbers of the indexers that the forwarder sends data to. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Use CLI commands to manage your forwarders - Splunk Documentation]

• Question 125:

  You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list --debug. What will the output be?

  A. list of all the configurations on-disk that Splunk contains.
  B. A verbose list of all configurations as they were when splunkd started.
  C. A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located
  D. A list of the current running props, conf configurations along with a file path from which the configuration was made
  C. A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.1/Troubleshooting/Usebtooltotroublesh ootconfigurations "The btool command simulates the merging process using the on-disk conf files and creates a report showing the merged settings." "The report does not necessarily represent what's loaded in memory. If a conf file change is made that requires a service restart, the btool report shows the change even though that change isn't active."

• Question 126:

  What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

  A. REGEX, DEST. FORMAT
  B. REGEX.SRC_KEY, FORMAT
  C. REGEX, DEST_KEY, FORMAT
  D. REGEX, DEST_KEY FORMATTING
  C. REGEX, DEST_KEY, FORMAT

  ---

  Explanation/Reference:

  REGEX =

  *

  Enter a regular expression to operate on your data.

  FORMAT =

  *

  NOTE: This option is valid for both index-time and search-time field extraction. Index-time field extraction configuration require the FORMAT settings. The FORMAT settings is optional for search-time field extraction configurations.

  *

  This setting specifies the format of the event, including any field names or values you want to add.

  DEST_KEY =

  *

  NOTE: This setting is only valid for index-time field extractions.

  *

  Specifies where SPLUNK software stores the expanded FORMAT results in accordance with the REGEX match.

• Question 127:

  The Splunk administrator wants to ensure data is distributed evenly amongst the indexers.

  To do this, he runs the following search over the last 24 hours:

  index=*

  What field can the administrator check to see the data distribution?

  A. host
  B. index
  C. linecount
  D. splunk_server
  D. splunk_server

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Usedefaultfields splunk_server The splunk server field contains the name of the Splunk server containing the event. Useful in a distributed Splunk environment. Example: Restrict a search to the main index on a server named remote. splunk_server=remote index=main 404

• Question 128:

  In which Splunk configuration is the SEDCMD used?

  A. props, conf
  B. inputs.conf
  C. indexes.conf
  D. transforms.conf
  A. props, conf

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Forwarddatatothird-partysystemsd

  "You can specify a SEDCMD configuration in props.conf to address data that contains characters that the third-party server cannot process. "

• Question 129:

  Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?

  A. Linked roles
  B. Grantable roles
  C. Role federation
  D. Role inheritance
  D. Role inheritance

  ---

  Explanation/Reference:

  You can have a role inherit certain properties from one or more existing rolehttps://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Aboutusersandroles Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Aboutusersandroles

• Question 130:

  How is data handled by Splunk during the input phase of the data ingestion process?

  A. Data is treated as streams.
  B. Data is broken up into events.
  C. Data is initially written to disk.
  D. Data is measured by the license meter.
  A. Data is treated as streams.
  D. Data is measured by the license meter.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Deploy/Datapipeline