Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 181:

  What event-processing pipelines are used to process data for indexing? (select all that apply)

  A. fifo pipeline
  B. Indexing pipeline
  C. Parsing pipeline
  D. Typing pipeline
  B. Indexing pipeline
  C. Parsing pipeline

  ---

  Explanation/Reference:

  The indexing pipeline and the parsing pipeline are the two pipelines that are responsible for transforming the raw data into events and preparing them for indexing. The indexing pipeline applies index-time settings, such as timestamp extraction, line breaking, host extraction, and source type recognition. The parsing pipeline applies parsing settings, such as field extraction, event segmentation, and event annotation.

• Question 182:

  Which of the following accurately describes HTTP Event Collector indexer acknowledgement?

  A. It requires a separate channel provided by the client.
  B. It is configured the same as indexer acknowledgement used to protect in-flight data.
  C. It can be enabled at the global setting level.
  D. It stores status information on the Splunk server.
  A. It requires a separate channel provided by the client.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/AboutHECIDXAck

  -Section: About channels and sending data

  Sending events to HEC with indexer acknowledgment active is similar to sending them with the setting off. There is one crucial difference: when you have indexer acknowledgment turned on, you must specify a channel when you send

  events. The concept of a channel was introduced in HEC primarily to prevent a fast client from impeding the performance of a slow client. When you assign one channel per client, because channels are treated equally on Splunk Enterprise,

  one client can't affect another. You must include a matching channel identifier both when sending data to HEC in an HTTP request and when requesting acknowledgment that events contained in the request have been indexed. If you don't,

  you will receive the error message, "Data channel is missing." Each request that includes a token for which indexer acknowledgment has been enabled must include a channel identifier, as shown in the following example cURL statement,

  where represents the event data portion of the request