Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 161:

  In case of a conflict between a whitelist and a blacklist input setting, which one is used?

  A. Blacklist

  B. Whitelist

  C. They cancel each other out.

  D. Whichever is entered into the configuration first.

  Correct Answer: A

  https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Whitelistorblacklistspecificincomi ngdata "It is not necessary to define both an allow list and a deny list in a configuration stanza. The settings are independent. If you do define both filters and a file matches them both, Splunk Enterprise does not index that file, as the blacklist filter overrides the whitelist filter." Source:https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Whitelistorblacklistspecif icincomingdata

• Question 162:

  Which of the following enables compression for universal forwarders in outputs. conf ?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

  # Compression # # This example sends compressed events to the remote indexer. # NOTE: Compression can be enabled TCP or SSL outputs only. # The receiver input port should also have compression enabled. [tcpout] server = splunkServer.example.com:4433 compressed = true

• Question 163:

  What conf file needs to be edited to set up distributed search groups?

  A. props.conf

  B. search.conf

  C. distsearch.conf

  D. distibutedsearch.conf

  Correct Answer: C

  "You can group your search peers to facilitate searching on a subset of them. Groups of search peers are known as "distributed search groups." You specify distributed search groups in the distsearch.conf file"

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Distributedsearchgroups

• Question 164:

  Which forwarder type can parse data prior to forwarding?

  A. Universal forwarder

  B. Heaviest forwarder

  C. Hyper forwarder

  D. Heavy forwarder

  Correct Answer: D

  https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Typesofforwarders "A heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event."

• Question 165:

  Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

  A. _license

  B. _lnternal

  C. _external

  D. _thefishbucket

  Correct Answer: BD

  https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Howindexingworks

• Question 166:

  Which of the following types of data count against the license daily quota?

  A. Replicated data

  B. splunkd logs

  C. Summary index data

  D. Windows internal logs

  Correct Answer: D

  https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/Distdeploylicenses#Clustered_ deployments_and_licensing_issues

  Reference:https://community.splunk.com/t5/Deployment-Architecture/License-usage-in- Indexer-Cluster/m-p/493548

• Question 167:

  Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

  A. Indexer

  B. Deployment server

  C. Universal forwarder

  D. Search head

  Correct Answer: D

• Question 168:

  For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

  A. True

  B. False

  C.

  D. Newline Character

  Correct Answer: B

  https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking Attribute : SHOULD_LINEMERGE = [true|false]

  Description : When set to true, the Splunk platform combines several input lines into a single event, with configuration based on the settings described in the next section.

• Question 169:

  Which of the following is the use case for the deployment server feature of Splunk?

  A. Managing distributed workloads in a Splunk environment.

  B. Automating upgrades of Splunk forwarder installations on endpoints.

  C. Orchestrating the operations and scale of a containerized Splunk deployment.

  D. Updating configuration and distributing apps to processing components, primarily forwarders.

  Correct Answer: D

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Aboutdeploymentserver "The deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances."

• Question 170:

  In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

  A. services/collector

  B. data/collector

  C. services/inputs?raw

  D. services/data/collector

  Correct Answer: A

  This is the endpoint URI used to collect data using the HTTP Event Collector (HEC), which is a token-based API that allows you to send data to Splunk Enterprise from any application that can make an HTTP request. The endpoint URI consists of the protocol (http or https), the hostname or IP address of the Splunk server, the port number (default is 8088), and the service name (services/collector). For example: https://mysplunkserver.example.com:8088/services/collector