Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 151:

  When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

  A. On Universal Forwarder, $SPLUNK_HOME/etc/apps
  B. On Deployment Server, $SPLUNK_HOME/etc/apps
  C. On Deployment Server, $SPLUNK_HOME/etc/deployment-apps
  D. On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps
  C. On Deployment Server, $SPLUNK_HOME/etc/deployment-apps

  ---

  Explanation/Reference:

  The correct answer is C. On Deployment Server, $SPLUNK_HOME/etc/deployment-apps. A deployment server is a Splunk Enterprise instance that acts as a centralized configuration manager for any number of other instances, called

  "deployment clients".A deployment client can be a universal forwarder, a non-clustered indexer, or a search head1.

  A deployment app is a directory that contains any content that you want to download to a set of deployment clients.The content can include a Splunk Enterprise app, a set of Splunk Enterprise configurations, or other content, such as scripts,

  images, and supporting files2. You create a deployment app by creating a directory for it on the deployment server. The default location is $SPLUNK_HOME/etc/deployment-apps, but this is configurable through the repositoryLocation

  attribute in serverclass.conf. Underneath this location, each app must have its own subdirectory.The name of the subdirectory serves as the app name in the forwarder management interface2.

  The other options are incorrect because:

  A. On Universal Forwarder, $SPLUNK_HOME/etc/apps. This is the location where the deployment app resides after it is downloaded from the deployment server to the universal forwarder.It is not the location of the app before it is deployed2.

  B. On Deployment Server, $SPLUNK_HOME/etc/apps. This is the location where the apps that are specific to the deployment server itself reside.It is not the location where the deployment apps for the clients are stored2. D. On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps. This is not a valid location for any app on a universal forwarder.The universal forwarder does not act as a deployment server and does not store deployment apps3.

• Question 152:

  Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

  A. Upload option
  B. Forward option
  C. Monitor option
  D. Download option
  A. Upload option

• Question 153:

  Which of the following monitor inputs stanza headers would match all of the following files?

  /var/log/www1/secure.log

  /var/log/www/secure.l

  /var/log/www/logs/secure.logs

  /var/log/www2/secure.log

  A. [monitor:///var/log/.../secure.*
  B. [monitor:///var/log/www1/secure.*]
  C. [monitor:///var/log/www1/secure.log]
  D. [monitor:///var/log/www*/secure.*]
  C. [monitor:///var/log/www1/secure.log]

• Question 154:

  What is the correct example to redact a plain-text password from raw events?

  A. in props.conf: [identity] REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
  B. in props.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
  C. in transforms.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
  D. in transforms.conf: [identity] REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
  B. in props.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

  ---

  Explanation/Reference:

  The correct answer is B. in props.conf:

  [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g According to the Splunk documentation1, to redact sensitive data from raw events, you need to use the SEDCMD attribute in the props.conf file. The SEDCMD attribute applies a sed expression to the raw data before indexing. The sed expression can use the s command to replace a pattern with a substitution string. For example, the following sed expression replaces any occurrence of password= followed by any characters until a comma, whitespace, or slash with ####REACTED####: s/password=([^,|/s]+)/ ####REACTED####/g The g flag at the end means that the replacement is applied globally, not just to the first match. Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them. Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before. Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file. References:1:Redact data from events - Splunk Documentation

• Question 155:

  What conf file needs to be edited to set up distributed search groups?

  A. props.conf
  B. search.conf
  C. distsearch.conf
  D. distibutedsearch.conf
  C. distsearch.conf

  ---

  Explanation/Reference:

  "You can group your search peers to facilitate searching on a subset of them. Groups of search peers are known as "distributed search groups." You specify distributed search groups in the distsearch.conf file"

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Distributedsearchgroups

• Question 156:

  Which setting in indexes. conf allows data retention to be controlled by time?

  A. maxDaysToKeep
  B. moveToFrozenAfter
  C. maxDataRetentionTime
  D. frozenTimePeriodlnSecs
  D. frozenTimePeriodlnSecs

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

• Question 157:

  Where can scripts for scripted inputs reside on the host file system? (select all that apply)

  A. $SFLUNK_HOME/bin/scripts
  B. $SPLUNK_HOME/etc/apps/bin
  C. $SPLUNK_HOME/etc/system/bin
  D. $S?LUNK_HOME/etc/apps//bin_
  A. $SFLUNK_HOME/bin/scripts
  C. $SPLUNK_HOME/etc/system/bin
  D. $S?LUNK_HOME/etc/apps//bin_

  ---

  Explanation/Reference:

  "Where to place the scripts for scripted inputs. The script that you refer to in $SCRIPT can reside in only one of the following places on the host file system: $SPLUNK_HOME/etc/system/bin $SPLUNK_HOME/etc/apps//bin $SPLUNK_HOME/bin/scripts As a best practice, put your script in the bin/ directory that is nearest to the inputs.conf file that calls your script on the host file system."

• Question 158:

  Which Splunk component would one use to perform line breaking prior to indexing?

  A. Heavy Forwarder
  B. Universal Forwarder
  C. Search head
  D. This can only be done at the indexing layer.
  A. Heavy Forwarder

  ---

  Explanation/Reference:

  According to the Splunk documentation1, a heavy forwarder is a Splunk Enterprise instance that can parse and filter data before forwarding it to an indexer. A heavy forwarder can perform line breaking, which is the process of splitting incoming data into individual events based on a set of rules2. A heavy forwarder can also apply other transformations to the data, such as field extractions, event type matching, or masking sensitive data3.

• Question 159:

  Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

  A. props.conf
  B. inputs.conf
  C. outputs.conf
  D. collections.conf
  C. outputs.conf

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/Forwardsearchheaddata Per the provided Splunk reference URL by @hwangho, scroll to section Forward search head data, subsection titled, 2. Configure the search head as a forwarder. "Create an outputs.conf file on the search head that configures the search head for load-balanced forwarding across the set of search peers (indexers)."

  Reference: https://community.splunk.com/t5/Getting-Data-In/How-to-configure-search-head-to-forwardinternal-data-to-the/td-p/111658

• Question 160:

  In which phase do indexed extractions in props.conf occur?

  A. Inputs phase
  B. Parsing phase
  C. Indexing phase
  D. Searching phase
  B. Parsing phase

  ---

  Explanation/Reference:

  The following items in the phases below are listed in the order Splunk applies them (ie LINE_BREAKER occurs before TRUNCATE).

  Input phase inputs.conf props.conf CHARSET NO_BINARY_CHECK CHECK_METHOD CHECK_FOR_HEADER (deprecated) PREFIX_SOURCETYPE sourcetype wmi.conf regmon-filters.conf Structured parsing phase props.conf INDEXED_EXTRACTIONS, and all other structured data header extractions Parsing phase props.conf LINE_BREAKER, TRUNCATE, SHOULD_LINEMERGE, BREAK_ONLY_BEFORE_DATE, and all other line merging settings TIME_PREFIX, TIME_FORMAT, DATETIME_CONFIG (datetime.xml), TZ, and all other time extraction settings and rules TRANSFORMS which includes per-event queue filtering, per-event index assignment, per- event routing SEDCMD MORE_THAN, LESS_THAN transforms.conf stanzas referenced by a TRANSFORMS clause in props.conf LOOKAHEAD, DEST_KEY, WRITE_META, DEFAULT_VALUE, REPEAT_MATCH