Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 31:

  In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

  A. To ensure that hot buckets are still open for writes and have not been forced to roll to a cold state
  B. To ensure that configuration files have not been tampered with for auditing and/or legal purposes
  C. To ensure that user passwords have not been tampered with for auditing and/or legal purposes.
  D. To ensure that data has not been tampered with for auditing and/or legal purposes
  D. To ensure that data has not been tampered with for auditing and/or legal purposes

• Question 32:

  Which additional component is required for a search head cluster?

  A. Deployer
  B. Cluster Master
  C. Monitoring Console
  D. Management Console
  A. Deployer

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/SHCdeployme ntoverview

  The deployer. This is a Splunk Enterprise instance that distributes apps and other configurations to the cluster members. It stands outside the cluster and cannot run on the same instance as a cluster member. It can, however, under some circumstances, reside on the same instance as other Splunk Enterprise components, such as a deployment server or an indexer cluster master node.

• Question 33:

  Consider the following stanza ininputs.conf:

  

  What will the value of the source filed be for events generated by this scripts input?

  A. /opt/splunk/ecc/apps/search/bin/liscer.sh
  B. unknown
  C. liscer
  D. liscer.sh
  A. /opt/splunk/ecc/apps/search/bin/liscer.sh

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Inputsconf

  -Scroll down to source = *Default: the input file path

• Question 34:

  During search time, which directory of configuration files has the highest precedence?

  A. $SFLUNK_KOME/etc/system/local
  B. $SPLUNK_KCME/etc/system/default
  C. $SPLUNK_HCME/etc/apps/app1/local
  D. $SPLUNK HCME/etc/users/admin/local
  D. $SPLUNK HCME/etc/users/admin/local

  ---

  Explanation/Reference:

  Adding further clarity and quoting same Splunk reference URL from @giubal"

  "To keep configuration settings consistent across peer nodes, configuration files are managed from the cluster master, which pushes the files to the slave-app directories on the peer nodes. Files in the slave-app directories have the highest precedence in a cluster peer's configuration. Here is the expanded precedence order for cluster peers: 1.Slave-app local directories -- highest priority

  2.

  System local directory

  3.

  App local directories

  4.

  Slave-app default directories

  5.

  App default directories

  6.

  System default directory --lowest priority

• Question 35:

  To set up a Network input in Splunk, what needs to be specified'?

  A. File path.
  B. Username and password
  C. Network protocol and port number.
  D. Network protocol and MAC address.
  C. Network protocol and port number.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Monitornetworkports

• Question 36:

  A Universal Forwarder has the following active stanza in inputs . conf:

  [monitor: //var/log]

  disabled = O

  host = 460352847

  An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?

  A. Universal Coordinated Time.
  B. The timezone of the search head.
  C. The timezone of the indexer that indexed the event.
  D. The timezone of the forwarder.
  D. The timezone of the forwarder.

  ---

  Explanation/Reference:

  The correct answer is D. The timezone of the forwarder will be added to the event as part of indexing.

  According to the Splunk documentation1, Splunk software determines the time zone to assign to a timestamp using the following logic in order of precedence:

  Use the time zone specified in raw event data (for example, PST, -0800), if present.

  Use the TZ attribute set in props.conf, if the event matches the host, source, or source type that the stanza specifies.

  If the forwarder and the receiving indexer are version 6.0 or higher, use the time zone that the forwarder provides.

  Use the time zone of the host that indexes the event. In this case, the event does not have a time zone specified in the raw data, nor does it have a TZ attribute set in props.conf. Therefore, the next rule applies, which is to use the time zone

  that the forwarder provides.A universal forwarder is a lightweight agent that can forward data to a Splunk deployment, and it knows its system time zone and sends that information along with the events to the indexer2.The indexer then

  converts the event time to UTC and stores it in the _time field1.

  The other options are incorrect because:

  A. Universal Coordinated Time (UTC) is not the time zone that Splunk adds to the event as part of indexing, but rather the time zone that Splunk uses to store the event time in the _time field.Splunk software converts the event time to UTC based on the time zone that it determines from the rules above1. B.The timezone of the search head is not relevant for indexing, as the search head is a Splunk component that handles search requests and distributes them to indexers, but it does not process incoming data3.The search head uses the user's timezone setting to determine the time range in UTC that should be searched and to display the timestamp of the results in the user's timezone2. C. The timezone of the indexer that indexed the event is only used as a last resort, if none of the other rules apply.In this case, the forwarder provides the time zone information, so the indexer does not use its own time zone1.

• Question 37:

  Which setting allows the configuration of Splunk to allow events to span over more than one line?

  A. SHOULD_LINEMERGE = true
  B. BREAK_ONLY_BEFORE_DATE = true
  C. BREAK_ONLY_BEFORE =
  D. SHOULD_LINEMERGE = false
  A. SHOULD_LINEMERGE = true

  ---

  Explanation/Reference:

  The setting that allows the configuration of Splunk to allow events to span over more than one line is SHOULD_LINEMERGE. This setting determines whether consecutive lines from a single source should be concatenated into a single event. If SHOULD_LINEMERGE is set to true, Splunk will attempt to merge multiple lines into one event based on certain criteria, such as timestamps or regular expressions. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Configure event line merging - Splunk Documentation]

• Question 38:

  Syslog files are being monitored on a Heavy Forwarder. Where would the appropriate TRANSFORMS setting be deployed to reroute logs based on the event message?

  A. Heavy Forwarder
  B. Indexer
  C. Search head
  D. Deployment server
  A. Heavy Forwarder

  ---

  Explanation/Reference:

  A Heavy Forwarder is a Splunk instance that can parse and filter data before forwarding it to another Splunk instance, such as an indexer1. A Heavy Forwarder can also perform index-time field extractions using the TRANSFORMS setting2.

  The TRANSFORMS setting is used to configure data transformations in the transforms.conf file3. The transforms.conf file contains settings and values that you canuse to configure host and source type overrides, anonymize sensitive data,

  route events to different indexes, create index-time and search-time field extractions, and set up lookup tables3.

  The TRANSFORMS setting can be deployed to the Heavy Forwarder where the syslog files are being monitored, so that the logs can be rerouted based on the event message before they are forwarded to the indexer2. This can improve the

  performance and efficiency of data processing and indexing2.

• Question 39:

  Immediately after installation, what will a Universal Forwarder do first?

  A. Automatically detect any indexers in its subnet and begin routing data.
  B. Begin reading local files on its server.
  C. Begin generating internal Splunk logs.
  D. Send an email to the operator that the installation process has completed.
  C. Begin generating internal Splunk logs.

  ---

  Explanation/Reference:

  Begin generating internal Splunk logs. Immediately after installation, a Universal Forwarder will start generating internal Splunk logs that contain information about its own operation, such as startup and shutdown events, configuration changes, data ingestion, and forwarding activities. These logs are stored in the $SPLUNK_HOME/var/log/splunk directory on the Universal Forwarder machine.

• Question 40:

  When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

  A. Enable indexer acknowledgment.
  B. Enable forwarder acknowledgment.
  C. splunk check-integrity -index
  D. index=_internal component=ACK | stats count by host
  A. Enable indexer acknowledgment.

  ---

  Explanation/Reference:

  Per the provided Splunk reference URL https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/AboutHECIDXAck

  "While HEC has precautions in place to prevent data loss, it's impossible to completely prevent such an occurrence, especially in the event of a network failure or hardware crash. This is where indexer acknolwedgment comes in."

  Reference https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/AboutHECIDXAck