How do you remove missing forwarders from the Monitoring Console?

By rebuilding the forwarder asset table.

By rescanning active forwarders.

By reloading the deployment server.

By rebuilding the forwarder asset table.

How often does Splunk recheck the LDAP server?

Varies based on LDAP_refresh setting.

In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

To ensure that data has not been tampered with for auditing and/or legal purposes

To ensure that hot buckets are still open for writes and have not been forced to roll to a cold state

To ensure that configuration files have not been tampered with for auditing and/or legal purposes

To ensure that user passwords have not been tampered with for auditing and/or legal purposes.

To ensure that data has not been tampered with for auditing and/or legal purposes

Which is a valid stanza for a network input?

[tcp://172.16.10.1:10001]connection_host = dnssourcetype = dns

[udp://172.16.10.1:9997]connection = dnssourcetype = dns

[any://172.16.10.1:10001]connection_host = ipsourcetype = web

[tcp://172.16.10.1:9997]connection_host = websourcetype = web

[tcp://172.16.10.1:10001]connection_host = dnssourcetype = dns

When are knowledge bundles distributed to search peers?

When a distributed search is initiated.

Which of the following is a benefit of distributed search?

Resilience from indexer failure.

Resilience from search head failure.

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.Which configuration file and stanza pair will mask possible SSNs in the log events?

transforms.conf[mask-SSN]REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT = $1<SSN>###-##-$2DEST_KEY = _raw

props.conf[mask-SSN]REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT = $1<SSN>###-##-$2KEY = _raw

props.conf[mask-SSN]REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT = $1<SSN>###-##-$2DEST_KEY = _raw

transforms.conf[mask-SSN]REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT = $1<SSN>###-##-$2DEST_KEY = _raw

transforms.conf[mask-SSN]REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT = $1<SSN>###-##-$2DEST_KEY = _raw

How can native authentication be disabled in Splunk?

Create an empty $SPLUNK_HOME/etc/passwd file

Remove the $SPLUNK_HOME/etc/passwd file

Create an empty $SPLUNK_HOME/etc/passwd file

Set SPLUNK_AUTHENTICATION=false in splunk-launch.conf

Set nativeAuthentication=false in authentication.conf

The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

Indexers, search head, deployment server, license master, universal forwarder

Indexers, search head, universal forwarders, license master

Indexers, search head, deployment server, universal forwarders

Indexers, search head, deployment server, license master, universal forwarder

Indexers, search head, deployment server, license master, universal forwarder, heavy forwarder

On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

The blacklist takes precedence over the whitelist.

The whitelist takes precedence over the blacklist.

Wildcards are not supported in any client filters.

Machine type filters are applied before the whitelist and blacklist.

When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Enable forwarder acknowledgment.

splunk check-integrity -index <index name>

index=_internal component=ACK | stats count by host

Which of the following apply to how distributed search works? (select all that apply)

The search head dispatches searches to the peers

Peers run searches in parallel and return their portion of results.

The search head consolidates the individual results and prepares reports

The search head dispatches searches to the peers

The search peers pull the data from the forwarders.

Peers run searches in parallel and return their portion of results.

The search head consolidates the individual results and prepares reports

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Whichever is entered into the configuration first.

Splunk SPLK-1003 Practice Test 1 - Free Online Exam Prep & Questions

Which valid bucket types are searchable? (select all that apply)

Hot buckets

Cold buckets

Warm buckets

Frozen buckets

Comment (0)

Splunk SPLK-1003 Practice Test 1

Question

Splunk SPLK-1003 Practice Tests

Practice Tests