When is data deleted from a Splunk Cloud index?

When buckets roll to frozen, without a defined archive.

When data is deleted via the Splunk Cloud Admin GUI.

When TA_Delete is downloaded and enabled from SplunkBase.

When the daleteindex command is executed from the CLI.

What is the recommended method to test the onboarding of a new data source before putting it in production?

Send test data to a test index.

Send data to the associated production index.

Replicate Splunk deployment in a test environment.

Which of the following is an accurate statement about the delete command?

Events are virtually deleted by marking them as deleted.

The delete command removes events from disk.

By default, only admins can run the delete command.

Events are virtually deleted by marking them as deleted.

Deleting events reclaims disk space.

What can be used in a Splunk Cloud environment to create new sourcetypes?

props. conf can be edited directly from the GUI

Which statement is true about monitor inputs?

The ignoreOlderThan option allows files to be ignored based on the file modification time.

Monitor inputs are configured in the monitor, conf file.

The ignoreOlderThan option allows files to be ignored based on the file modification time.

The crSalt setting is required.

Monitor inputs can ignore a file's existing content, indexing new data as it arrives, by configuring the tailProcessor option.

Where is the recommended place to deploy input apps that are not permitted on Splunk Cloud?

Universal Forwarder or Heavy Forwarder.

Apps cannot be installed on on-prem instances.

For the following data, what would be the correct attribute/value oair to use to successfully extract the correct timestamp from all the events?

TIMK_FORMAT = %b %d %H:%M:%S %z

DATETIME CONFIG = %Y-%m-%d %H:%M:%S %2

DATETIKE CONFIG = Sb %d %H:%M:%S

In what scenarios would transforms.conf be used?

Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing

Per-Event Index Routing, Applying Event Types, SEOCMD operations

Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing

Per-Event Host Name, Per-Event Index Rooting, SEDCMD operations

Per-Event Sourcetype, Per-Event Index Routing, Applying Event Types

Which monitor statement will retrieve only files that start with 'access' in the directory /opt/log/ww2/?

[monitor:///opt/log/www2/access*]

[monitor:///opt/lug/.../access]

[monitor:///opt/log/www2/access*]

By default, which of the following capabilities are granted to the sc_admin role?

indexes_edit, fsh_manage, admin_all_objects can_delete

indexes_edit, edit___token, admin_all_objects, delete_by_keyword

indexes_edit, fsh_manage, acs_conf, list_indexesdiscovert

indexes_edit, fsh_manage, admin_all_objects can_delete

indexes_edit, edit_token_http, admin _all objects, edit limits_conf

In Splunk terminology, what is an index?

A data repository that contains raw, compressed data along with tsidx files.

A data repository that contains raw, compressed data along with psidx files.

A data repository that contains raw, compressed data along with tsidx files.

A data repository that contains raw, uncompressed data along with psidx files.

A data repository that contains raw, uncompressed data along with tsidx files.

Which of the following methods is valid for creating index-time field extractions?

Create a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.

Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.

Create a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.

Use the CU app to define settings in fields.conf, and restart Splunk Cloud.

Use the rex command to extract the desired field, and then save as a calculated field.

A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

props.conf on a Heavy Forwarder.

props. conf on a Splunk Cloud search head,

props.conf on a Heavy Forwarder.

transforms, cent on a Splunk Cloud indexer.

props. conf- on a Universal Forwarder.

Which of the following is a valid monitor stanza for inputs.conf?

[monitor:///var/log/httpd-[0-9].log] index = linux sourcetype = access_combined host = 489307057

[monitor:///var/log/*.log] index = linux sourcetype = access_combined host = 489307057

[monitor:\\\var\log\httpd-[0-9].log] index = linux sourcetype = access_combined host = 489307057

[monitor:///var/log/httpd-[0-9].log] index = linux sourcetype = access_combined host = 489307057

[monitor:\\\var\log\*.log] index = linux sourcetype = access_combined host = 489307057

In Splunk Cloud, which of the following statements regarding REST API is true?

A subset of REST API endpoints are enabled for customers to manage Splunk.

REST API and Splunk HEC are on the same port.

All REST API endpoints are open and available by default.

REST API is not available in Splunk Cloud.

A subset of REST API endpoints are enabled for customers to manage Splunk.

Which configuration shown is used to enable a forwarder as a deployment client of the server 10.1.2.3?

[target-broker:deploymentserver] targetUri = 10.1.2.3:8089

[target-broker:deploymentServer] targetUri = 10.1.2.3:9997

[target-broker:deploymentserver] targetUri = 10.1.2.3:8089

[target-broker:deploymentserver] deploymentserver = 10.1.2.3:9997

[target-broker:deploymentserver] deploymentserver = 10.1.2.3:8089

Which of the following would always require raising a support ticket?

Capacity or configuration changes in Splunk Cloud.

Search does not return expected results in Splunk Cloud.

A user is unable to log into Splunk Cloud.

Data is not indexed in Splunk Cloud.

How is the forwarder configuration app for Splunk Cloud obtained?

Download from the Splunk Cloud UI under the Universal Forwarder app.

Use the wget URL presented when an sc_admin user logs in for the first time.

Download from the email sent to the person listed in the SHIP TO: field when the customer licensed Splunk Cloud.

Download from the Splunk Cloud UI under the Universal Forwarder app.

Download from Splunkbase using splunk.com credentials.

A log file is being ingested into Splunk, and a few events have no date stamp. How would Splunk first try to determine the missing date of the events?

Splunk will take the date from the file modification time.

Splunk will take the date of a previous event within the log file.

Splunk will use the current system time of the Indexer for the date.

Splunk will use the date of when the file monitor was created.

Splunk will take the date from the file modification time.

A customer has worked with their LDAP administrator to configure an LDAP strategy in Splunk. The configuration works, and user Mia can log into Splunk using her LDAP Account. After some time, the Splunk Cloud administrator needs to move Mia from the user role to the power role. How should they accomplish this?

Ask the LDAP administrator to move Mia's account to an appropriately mapped LDAP group.

Have Mia log into Splunk, then update her own role in user settings.

Create a role named Power in Splunk, then map Mia's account to that role.

Use the Cloud Monitoring Console app as an administrator to map Mia's account to the power role.

Which of the following is a valid method to test if a forwarder can successfully send data to Splunk Cloud?

Use oneshot from the CLI on the forwarders, then check to see if those logs show up in the Splunk Cloud environment.

Search the _audit index to confirm whether the forwarder ID was registered.

Use oneshot from the CLI on the forwarders, then check to see if those logs show up in the Splunk Cloud environment.

On Splunk Cloud UI, click Add Data and upload a test file, then search to see if the logs show up.

Ping the inputssl.example.splunkcloud.com to see if it returns the ping.

Which of the following statements is true regarding sedcmd?

SEDCMD provides search and replace functionality using regular expressions and substitutions.

SEDCMD can be defined in either props.conf or transforms.conf.

SEDCMD does not work on Windows-based installations of Splunk.

SEDCMD uses the same syntax as Splunk's replace command.

SEDCMD provides search and replace functionality using regular expressions and substitutions.

How is it possible to test a script from the Splunk perspective before using it within a scripted input?

./$SPLUNK_HOME/etc/apps/<app>/bin/<scriptname>

What two files are used in the data transformation process?

parsing.conf and transforms.conf

transforms.conf and fields.conf

transforms.conf and sourcetypes.conf

Where can an administrator download the Splunk Cloud Universal Forwarder credentials package?

Universal Forwarder app in the Splunk Cloud search head.

Cloud Monitoring Console forwarder drop-down.

Universal Forwarder app in the Splunk Cloud search head.

When creating a new index, which of the following is true about archiving expired events?

Store expired events on-prem using your own storage systems.

Store expired events in private AWS-based storage.

Expired events cannot be archived.

Archive some expired events from an index and discard others.

Store expired events on-prem using your own storage systems.

Due to internal security policies, a Splunk Cloud administrator cannot send data directly to Splunk Cloud from certain data sources. Additional parsing and API-based data sources also need to be sent to Splunk Cloud. What forwarder type should the Splunk Cloud administrator use to satisfy these requirements within their environment?

Heavy forwarder as an intermediate forwarder

Syslog-ng server with a universal forwarder

Light forwarder as an intermediate forwarder

Heavy forwarder as an intermediate forwarder

Universal forwarder as an intermediate forwarder

Configuration folders named default contain configuration files/settings specified in the Splunk product or default settings specified in apps. Which of the following is recommended to override these settings?

Overrides should be placed in a folder named local, ideally within a custom Splunk app. This ensures the overrides are preserved upon product or app upgrade and will also be easier to maintain/support.

It does not matter whether setting overrides are placed in default or local folders. Both are equally acceptable since Splunk will merge all the files together into one runtime model after each restart.

Any settings to be overridden should be modified in-place wherever the setting was found originally. For example, if overriding a setting originally found in system/default, it should be overridden there to ensure that the desired value is used by Splunk.

Overrides should be placed in a folder named local, ideally within a custom Splunk app. This ensures the overrides are preserved upon product or app upgrade and will also be easier to maintain/support.

Try to store all configuration overrides in system/local folder to keep all configurations in one place. This ensures the modification has the highest precedence over all other configuration entries.