Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 41:

  Which Splunk forwarder has a built-in license?

  A. Light forwarder

  B. Heavy forwarder

  C. Universal forwarder

  D. Cloud forwarder

  Correct Answer: C

  Reference:https://community.splunk.com/t5/Getting-Data-In/Do-we-need-a-license-for-Heavy-forwarder/m-p/210451

• Question 42:

  The following stanzas in inputs. conf are currently being used by a deployment client: [udp: //145.175.118.177:1001 Connection_host = dns sourcetype = syslog Which of the following statements is true of data that is received via this input?

  A. If Splunk is restarted, data will be queued and then sent when Splunk has restarted.

  B. Local firewall ports do not need to be opened on the deployment client since the port is defined in inputs.conf.

  C. The host value associated with data received will be the IP address that sent the data.

  D. If Splunk is restarted, data may be lost.

  Correct Answer: D

  This is because the input type is UDP, which is an unreliable protocol that does not guarantee delivery, order, or integrity of the data packets. UDP does not have any mechanism to resend or acknowledge the data packets, so if Splunk is restarted, any data that was in transit or in the buffer may be dropped and not indexed.

• Question 43:

  After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

  A. index=main

  B. index=test

  C. index=summary

  D. index=_internal

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Validateyourconfiguration

• Question 44:

  Which of the following are methods for adding inputs in Splunk? (select all that apply)

  A. CLI

  B. Splunk Web

  C. Editing inputs. conf

  D. Editing monitor. conf

  Correct Answer: ABC

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Configureyourinputs Add your data to Splunk Enterprise. With Splunk Enterprise, you can add data using Splunk Web or Splunk Apps. In addition to these methods, you also can use the following methods. -The Splunk Command Line Interface (CLI) -The inputs.conf configuration file. When you specify your inputs with Splunk Web or the CLI, the details are saved in a configuartion file on Splunk Enterprise indexer and heavy forwarder instances.

• Question 45:

  Which forwarder is recommended by Splunk to use in a production environment?

  A. Heavy forwarder

  B. SSL forwarder

  C. Lightweight forwarder

  D. Universal forwarder

  Correct Answer: D

  Reference:https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/18009

  The forwarder that is recommended by Splunk to use in a production environment is the universal forwarder. The universal forwarder is a lightweight Splunk agent that forwards data to indexers or other forwarders. The universal forwarder has a small footprint and consumes minimal system resources. It also supports secure and reliable data forwarding with encryption and acknowledgement features. Therefore, option D is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About forwarding and receiving data - Splunk Documentation]

• Question 46:

  Which Splunk component performs indexing and responds to search requests from the search head?

  A. Forwarder

  B. Search peer

  C. License master

  D. Search head cluster

  Correct Answer: B

  A Splunk platform instance that responses to search requests from a search head. The term "Search peer" is usually synonymous with the indexer role in a distributed search topology..."

• Question 47:

  When using license pools, volume allocations apply to which Splunk components?

  A. Indexers

  B. Indexes

  C. Heavy Forwarders

  D. Search Heads

  Correct Answer: A

  When using license pools, volume allocations apply to indexers. A license pool is a group of indexers that share a certain amount of daily indexing volume. The license pool specifies how much data each indexer can index per day, as well as which indexes are available for each indexer. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Set up and manage license pools - Splunk Documentation]

• Question 48:

  Which of the following are supported options when configuring optional network inputs?

  A. Metadata override, sender filtering options, network input queues (quantum queues)

  B. Metadata override, sender filtering options, network input queues (memory/persistent queues)

  C. Filename override, sender filtering options, network output queues (memory/persistent queues)

  D. Metadata override, receiver filtering options, network input queues (memory/persistent queues)

  Correct Answer: B

  https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

• Question 49:

  In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

  A. Indexer

  B. Deployer

  C. Forwarder

  D. Deployment server

  Correct Answer: D

  The deployer is a Splunk Enterprise instance that you use to distribute apps and certain other configuration updates to search head cluster members. The set of updates that the deployer distributes is called the configuration bundle.

• Question 50:

  When using a directory monitor input, specific source types can be selectively overridden using which configuration file?

  A. sourcetypes . conf

  B. trans forms . conf

  C. outputs . conf

  D. props . conf

  Correct Answer: D

  When using a directory monitor input, specific source types can be selectively overridden using the props.conf file. According to the Splunk documentation, "You can specify a source type for data based on its input and source. Specify source type for an input. You can assign the source type for data coming from a specific input, such as /var/log/. If you use Splunk Cloud Platform, use Splunk Web to define source types. If you use Splunk Enterprise, define source types in Splunk Web or by editing the inputs.conf configuration file." However, this method is not very granular and assigns the same source type to all data from an input. To override the source type on a per-event basis, you need to use the props.conf file and the transforms.conf file. The props.conf file contains settings that determine how the Splunk platform processes incoming data, such as how to segment events, extract fields, and assign source types. The transforms.conf file contains settings that modify or filter event dataduring indexing or search time. You can use these files to create rules that match specific patterns in the event data and assign different source types accordingly. For example, you can create a rule that assigns a source type of apache_error to any event that contains the word "error" in the first line.