Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 61:

  Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

  A. diskQueueSize

  B. durableQueueSize

  C. persistentOueueSize

  D. queueSize

  Correct Answer: C

  Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2111/Data/Usepersistentqueues

• Question 62:

  Load balancing on a Universal Forwarder is not scaling correctly. The forwarder's outputs. and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue? (select all that apply)

  A. The receiving port is not properly setup to listen on the right port.

  B. The inputs . conf'S _SYSZOG_ROVTING is not setup to use the right group names.

  C. The DNS record used is not setup with a valid list of IP addresses.

  D. The indexAndForward value is not set properly.

  Correct Answer: AC

  The possible causes of the load balancing issue on the Universal Forwarder are A and C. The receiving port and the DNS record are both factors that affect the ability of the Universal Forwarder to distribute data across multiple receivers. If the receiving port is not properly set up to listen on the right port, or if the DNS record used is not set up with a valid list of IP addresses, the Universal Forwarder might fail to connect to some or all of the receivers, resulting in poor load balancing.

• Question 63:

  What is required when adding a native user to Splunk? (select all that apply)

  A. Password

  B. Username

  C. Full Name

  D. Default app

  Correct Answer: AB

  According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED

• Question 64:

  Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

  A. CLI

  B. Edit inputs . conf

  C. Edit forwarder.conf

  D. Forwarder Management

  Correct Answer: ABD

  https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/HowtoforwarddatatoSpl unkEnterprise "You can collect data on the universal forwarder using several methods. Define inputs on the universal forwarder with the CLI. You can use the CLI to define inputs on the universal forwarder. After you define the inputs, the universal forwarder collects data based on those definitions as long as it has access to the data that you want to monitor. Define inputs on the universal forwarder with configuration files. If the input you want to configure does not have a CLI argument for it, you can configure inputs with configuration files. Create an inputs.conf file in the directory, $SPLUNK_HOME/etc/system/local

• Question 65:

  The following stanza is active in indexes.conf:

  [cat_facts]

  maxHotSpanSecs = 3600

  frozenTimePeriodInSecs = 2630000

  maxTota1DataSizeMB = 650000

  All other related indexes.conf settings are default values.

  If the event timestamp was 3739283 seconds ago, will it be searchable?

  A. Yes, only if the bucket is still hot.

  B. No, because the index will have exceeded its maximum size.

  C. Yes, only if the index size is also below 650000 MB.

  D. No, because the event time is greater than the retention time.

  Correct Answer: D

  The correct answer is D. No, because the event time is greater than the retention time. According to the Splunk documentation1, the frozenTimePeriodInSecs setting in indexes.conf determines how long Splunk software retains indexed data before deleting it or archiving it to a remote storage. The default value is 188697600 seconds, which is equivalent to six years. The setting can be overridden on a per-index basis. In this case, the cat_facts index has a frozenTimePeriodInSecs setting of 2630000 seconds, which is equivalent to about 30 days. This means that any event that is older than 30 days from the current time will be removed from the index and will not be searchable. The event timestamp was 3739283 seconds ago, which is equivalent to about 43 days. This means that the event is older than the retention time of the cat_facts index and will not be searchable. The other settings in the stanza, such as maxHotSpanSecs and maxTota1DataSizeMB, do not affect the retention time of the events. They only affect the size and duration of the buckets that store the events. References:1:Set a retirement and archiving policy - Splunk Documentation

• Question 66:

  Which Splunk component would one use to perform line breaking prior to indexing?

  A. Heavy Forwarder

  B. Universal Forwarder

  C. Search head

  D. This can only be done at the indexing layer.

  Correct Answer: A

  According to the Splunk documentation1, a heavy forwarder is a Splunk Enterprise instance that can parse and filter data before forwarding it to an indexer. A heavy forwarder can perform line breaking, which is the process of splitting incoming data into individual events based on a set of rules2. A heavy forwarder can also apply other transformations to the data, such as field extractions, event type matching, or masking sensitive data3.

• Question 67:

  What is the command to reset the fishbucket for one source?

  A. rm -r ~/splunkforwarder/var/lib/splunk/fishbucket

  B. splunk clean eventdata -index _thefishbucket

  C. splunk cmd btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db -- file --reset

  D. splunk btool fishbucket reset

  Correct Answer: C

  Reference:https://community.splunk.com/t5/Getting-Data-In/How-can-I-trigger-the-re- indexing-of-a-single-file/m-p/108568

  The fishbucket is a directory that stores information about the files that have been monitored and indexed by Splunk. The fishbucket helps Splunk avoid indexing duplicate data by keeping track of file signatures and offsets. To reset the fishbucket for one source, the command splunk cmd btprobe can be used with the -reset option and the name of the source file. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Use btprobe to troubleshoot file monitoring - Splunk Documentation]

• Question 68:

  An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the defaultprops.confbelow, whichSPLUNK_HOME/etc/ users/buttercup/myTA/local/props.confstanza can be added to the user's local context to disable the field aliases?

  

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  https://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Clear%20a%20setting

• Question 69:

  When indexing a data source, which fields are considered metadata?

  A. source, host, time

  B. time, sourcetype, source

  C. host, raw, sourcetype

  D. sourcetype, source, host

  Correct Answer: D

• Question 70:

  This file has been manually created on a universal forwarder

  

  A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new

  

  Which file is now monitored?

  A. /var/log/messages

  B. /var/log/maillog

  C. /var/log/maillog and /var/log/messages

  D. none of the above

  Correct Answer: B