Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 131:

  A new forwarder has been installed with a manually created deploymentclient.conf.

  What is the next step to enable the communication between the forwarder and the deployment server?

  A. Restart Splunk on the deployment server.

  B. Enable the deployment client in Splunk Web under Forwarder Management.

  C. Restart Splunk on the deployment client.

  D. Wait for up to the time set in the phoneHomeIntervalInSecs setting.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/Configuretheuniversalforwarder

• Question 132:

  When using a directory monitor input, specific source type can be selectively overridden using which configuration file?

  A. props.conf

  B. sourcetypes.conf

  C. transforms.conf

  D. outputs.conf

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Bypassautomaticsourcetypeassignment

• Question 133:

  When using license pools, volume allocations apply to which Splunk components?

  A. Indexers

  B. Indexes

  C. Heavy Forwarders

  D. Search Heads

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Groups,stacks,pools,andotherterminology

• Question 134:

  An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/ etc/ users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

• Question 135:

  Which forwarder is recommended by Splunk to use in a production environment?

  A. Heavy forwarder

  B. SSL forwarder

  C. Lightweight forwarder

  D. Universal forwarder

  Correct Answer: D

  Reference: https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/18009

• Question 136:

  Which of the following Splunk components require a separate installation package?

  A. Deployment server

  B. License master

  C. Universal forwarder

  D. Heavy forwarder

  Correct Answer: C

  Reference: https://github.com/packetiq/SplunkArchitect/blob/master/Install-and-Configure-Splunk-Enterprise-Components.md

• Question 137:

  Which data pipeline phase is the last opportunity for defining event boundaries?

  A. Input phase

  B. Indexing phase

  C. Parsing phase

  D. Search phase

  Correct Answer: C

  Reference https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Configurationparametersandthedatapipeline

• Question 138:

  Which of the following is a valid distributed search group?

  A. [distributedSearch:Paris] default = false servers = server1, server2

  B. [searchGroup:Paris] default = false servers = server1:8089, server2:8089

  C. [searchGroup:Paris] default = false servers = server1:9997, server2:9997

  D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089

  Correct Answer: D