Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 11:

  Which layers are involved in Splunk configuration file layering? (select all that apply)

  A. App context
  B. User context
  C. Global context
  D. Forwarder context
  A. App context
  B. User context
  C. Global context

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles

  To determine the order of directories for evaluating configuration file precedence, Splunk software considers each file's context. Configuration files operate in either a global context or inthe context of the current app and user: Global. Activities

  like indexing take place in a global context. They are independent of any app or user. For example, configuration files that determine monitoring or indexing behavior occur outside of the app and user context and are global in nature. App/

  user. Some activities, like searching, take place in an app or user context. The app and user context is vital to search-time processing, where certain knowledge objects or actions might be valid only for specific users in specific apps.

• Question 12:

  Which of the following applies only to Splunk index data integrity check?

  A. Lookup table
  B. Summary Index
  C. Raw data in the index
  D. Data model acceleration
  C. Raw data in the index

• Question 13:

  Load balancing on a Universal Forwarder is not scaling correctly. The forwarder's outputs. and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue? (select all that apply)

  A. The receiving port is not properly setup to listen on the right port.
  B. The inputs . conf'S _SYSZOG_ROVTING is not setup to use the right group names.
  C. The DNS record used is not setup with a valid list of IP addresses.
  D. The indexAndForward value is not set properly.
  A. The receiving port is not properly setup to listen on the right port.
  C. The DNS record used is not setup with a valid list of IP addresses.

  ---

  Explanation/Reference:

  The possible causes of the load balancing issue on the Universal Forwarder are A and C. The receiving port and the DNS record are both factors that affect the ability of the Universal Forwarder to distribute data across multiple receivers. If the receiving port is not properly set up to listen on the right port, or if the DNS record used is not set up with a valid list of IP addresses, the Universal Forwarder might fail to connect to some or all of the receivers, resulting in poor load balancing.

• Question 14:

  Which of the following are methods for adding inputs in Splunk? (select all that apply)

  A. CLI
  B. Splunk Web
  C. Editing inputs. conf
  D. Editing monitor. conf
  A. CLI
  B. Splunk Web
  C. Editing inputs. conf

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Configureyourinputs Add your data to Splunk Enterprise. With Splunk Enterprise, you can add data using Splunk Web or Splunk Apps. In addition to these methods, you also can use the following methods. -The Splunk Command Line Interface (CLI) -The inputs.conf configuration file. When you specify your inputs with Splunk Web or the CLI, the details are saved in a configuartion file on Splunk Enterprise indexer and heavy forwarder instances.

• Question 15:

  In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

  A. Universal forwarders
  B. Splunk Cloud
  C. Linux package managers
  D. Windows using WMI
  A. Universal forwarders

  ---

  Explanation/Reference:

  The deployment server is a Splunk component that distributes apps and other configurations to deployment clients, which are Splunk instances that receive updates from the deployment server. The deployment server can push apps to single, non-clustered Splunk instances, as well as universal forwarders, which are lightweight Splunk agents that forward data to indexers. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About deployment server and forwarder management

  -Splunk Documentation]

• Question 16:

  Where are license files stored?

  A. $SPLUNK_HOME/etc/secure
  B. $SPLUNK_HOME/etc/system
  C. $SPLUNK_HOME/etc/licenses
  D. $SPLUNK_HOME/etc/apps/licenses
  C. $SPLUNK_HOME/etc/licenses

• Question 17:

  Immediately after installation, what will a Universal Forwarder do first?

  A. Automatically detect any indexers in its subnet and begin routing data.
  B. Begin generating internal Splunk logs.
  C. Begin reading local files on its server.
  D. Send an email to the operator that the installation process has completed.
  B. Begin generating internal Splunk logs.

  ---

  Explanation/Reference:

  Immediately after installation, a universal forwarder will start generating internal Splunk logs that contain information about its own operation, such as configuration changes, data inputs, and forwarding activities1. These logs are stored in the $SPLUNK_HOME/var/log/splunk directory on the universal forwarder machine1. The universal forwarder will not automatically detect any indexers in its subnet and begin routing data, as it needs to be configured with the IP address and port number of the indexer or the deployment server2. The universal forwarder will not begin reading local files on its server, as it needs to be configured with the data inputs that specify which files or directories to monitor2. The universal forwarder will not send an email to the operator that the installation process has completed, as this is not a default behavior of the universal forwarder and would require additional configuration3.

• Question 18:

  If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

  A. Indexer
  B. Forwarder
  C. Search head
  D. Deployment server
  A. Indexer

  ---

  Explanation/Reference:

  https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket- thing.html "Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf"

  Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a- forwarder/td-p/93310

• Question 19:

  A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk's response?

  A. Update the user in Splunk web informing them that the results of their search may be incomplete.
  B. Repeat the search request on indexer B without informing the user.
  C. Update the user in Splunk web that their results may be incomple and that Splunk will try to re-execute the search.
  D. Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.
  A. Update the user in Splunk web informing them that the results of their search may be incomplete.

  ---

  If an indexer goes down during a search, the search head notifies you that the results might be incomplete. The search head does not attempt to re-run the search on another indexer.

• Question 20:

  Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

  A. Any OS platform
  B. Linux platform only
  C. Windows platform only.
  D. None of the above.
  A. Any OS platform

  ---

  Explanation/Reference:

  "The forwarder/indexer relationship can be considered platform agnostic (within the sphere of supported platforms) because they exchange their data handshake (and the data, if you wish) over TCP.