Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 71:

  Search heads in a company's European offices need to be able to search data in their New York offices. They also need to restrict access to certain indexers. What should be configured to allow this type of action?

  A. Indexer clustering

  B. LDAP control

  C. Distributed search

  D. Search head clustering

  Correct Answer: C

  The correct answer is C. Distributed search is the feature that allows search heads in a company's European offices to search data in their New York offices.Distributed search also enables restricting access to certain indexers by using the

  splunk_server field or the server.conf file1.

  Distributed search is a way to scale your Splunk deployment by separating the search management and presentation layer from the indexing and search retrieval layer. With distributed search, a Splunk instance called a search head sends

  search requests to a group of indexers, or search peers, which perform the actual searches on their indexes.The search head then merges the results back to the user2. Distributed search has several use cases, such as horizontal scaling,

  access control, and managing geo-dispersed data.For example, users in different offices can search data across the enterprise or only in their local area, depending on their needs and permissions2.

  The other options are incorrect because:

  A. Indexer clustering is a feature that replicates data across a group of indexers to ensure data availability and recovery.Indexer clustering does not directly affect distributed search, although search heads can be configured to search across an indexer cluster3.

  B. LDAP control is a feature that allows Splunk to integrate with an external LDAP directory service for user authentication and role mapping. LDAP control does not affect distributed search, although it can be used to manage user access to data and searches.

  D. Search head clustering is a feature that distributes the search workload across a group of search heads that share resources, configurations, and jobs. Search head clustering does not affect distributed search, although the search heads in a cluster can search across the same set of indexers.

• Question 72:

  Which of the following monitor inputs stanza headers would match all of the following files?

  /var/log/www1/secure.log

  /var/log/www/secure.l

  /var/log/www/logs/secure.logs

  /var/log/www2/secure.log

  A. [monitor:///var/log/.../secure.*

  B. [monitor:///var/log/www1/secure.*]

  C. [monitor:///var/log/www1/secure.log]

  D. [monitor:///var/log/www*/secure.*]

  Correct Answer: C

• Question 73:

  Which of the following are required when defining an index in indexes. conf? (select all that apply)

  A. coldPath

  B. homePath

  C. frozenPath

  D. thawedPath

  Correct Answer: ABD

  homePath = $SPLUNK_DB/hatchdb/db coldPath = $SPLUNK_DB/hatchdb/colddb thawedPath = $SPLUNK_DB/hatchdb/thaweddb

• Question 74:

  Which of the following statements describes how distributed search works?

  A. Forwarders pull data from the search peers.

  B. Search heads store a portion of the searchable data.

  C. The search head dispatches searches to the search peers.

  D. Search results are replicated within the indexer cluster.

  Correct Answer: C

  "To activate distributed search, you add search peers, or indexers, to a Splunk Enterprise instance that you desingate as a search head. You do this by specifying each search peer manually."

• Question 75:

  What is a role in Splunk? (select all that apply)

  A. A classification that determines what capabilities a user has.

  B. A classification that determines if a Splunk server can remotely control another Splunk server.

  C. A classification that determines what functions a Splunk server controls.

  D. A classification that determines what indexes a user can search.

  Correct Answer: AD

  A role in Splunk is a classification that determines what capabilities and indexes a user has.A capability is a permission to perform a specific action or access a specific feature on the Splunk platform1.An index is a collection of data that Splunk software processes and stores2. By assigning roles to users, you can control what they can do and what data they can access on the Splunk platform. Therefore, the correct answers are A and D. A role in Splunk determines what capabilities and indexes a user has. Option B is incorrect because Splunk servers do not use roles to remotely control each other.Option C is incorrect because Splunk servers use instances and components to determine what functions they control3. References:1:Define roles on the Splunk platform with capabilities - Splunk Documentation2:About indexes and indexers - Splunk Documentation3:Splunk Enterprise components - Splunk Documentation

• Question 76:

  When running the command shown below, what is the default path in which deployment server. conf is created?

  splunk set deploy-poll deployServer:port

  A. SFLUNK_HOME/etc/deployment

  B. SPLUNK_HOME/etc/system/local

  C. SPLUNK_HOME/etc/system/default

  D. SPLUNK_KOME/etc/apps/deployment

  Correct Answer: C

  https://docs.splunk.com/Documentation/Splunk/8.1.1/Updating/Definedeploymentclasses# Ways_to_define_server_classes "When you use forwarder management to create a new server class, it saves the server class definition in a copy of serverclass.conf under $SPLUNK_HOME/etc/system/local. If, instead of using forwarder management, you decide to directly edit serverclass.conf, it is recommended that you create the serverclass.conf file in that same directory, $SPLUNK_HOME/etc/system/local."

• Question 77:

  Which of the following apply to how distributed search works? (select all that apply)

  A. The search head dispatches searches to the peers

  B. The search peers pull the data from the forwarders.

  C. Peers run searches in parallel and return their portion of results.

  D. The search head consolidates the individual results and prepares reports

  Correct Answer: ACD

  Users log on to the search head and run reports: The search head dispatches searches to the peers Peers run searches in parallel and return their portion of results The search head consolidates the individual results and prepares reports

• Question 78:

  Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

  A. splunk btool server list --debug

  B. splunk list forward-indexer

  C. splunk list forward-server

  D. splunk btool indexes list --debug

  Correct Answer: C

  Reference:https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-configure-a- Splunk-Forwarder-on-Linux/m-p/72078 The CLI command to view the current forwarder to indexer configuration is splunk list forward-server. This command displays the hostnames and port numbers of the indexers that the forwarder sends data to. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Use CLI commands to manage your forwarders - Splunk Documentation]

• Question 79:

  A configuration file in a deployed app needs to be directly edited. Which steps would ensure a successful deployment to clients?

  A. Make the change in $SPLUNK HOME/etc/dep10yment apps/$appName/10ca1/ on the deployment server, and the change will be automatically sent to the deployment clients.

  B. Make the change in $SPLUNK HOME /etc/apps/$appname/local/ on any of the deployment clients, and then run the command . / splunk reload deploy-server to push that change to the deployment server.

  C. Make the change in $SPLUNK HOME/etc/dep10yment apps/$appName/10ca1/ on the deployment server, and then run $SPLUNK HOME/bin/sp1unk reload deploy--server.

  D. Make the change in $SPLUNK HOME/etc/apps/$appName/defau1t on the deployment server, and it will be distributed down to the clients' own local versions.

  Correct Answer: C

  According to the Splunk documentation, to customize a configuration file, you need to create a new file with the same name in a local or app directory. Then, add the specific settings that you want to customize to the local configuration file.

  Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. The Splunk Enterprise upgrade process overwrites the default directory. To deploy

  configuration files to deployment clients, you need to use the deployment server. The deployment server is a Splunk Enterprise instance that distributes content and updates to deployment clients. The deployment server uses a directory

  called $SPLUNK_HOME/etc/deployment-apps to store the apps and configuration files that itdeploys to clients. To update the configuration files in this directory, you need to edit them manually and then run the command $SPLUNK_HOME/

  bin/sp1unk reload deploy--server to make the changes take effect. Therefore, option A is incorrect because it does not include the reload command. Option B is incorrect because it makes the change on a deployment client instead of the

  deployment server. Option D is incorrect because it changes the default directory instead of the local directory.

  References:

  1: How to edit a configuration file - Splunk Documentation

  2: Deployment of configuration files - Splunk Community

• Question 80:

  What will the following inputs. conf stanza do?

  [script://myscript . sh]

  Interval=0

  A. The script will run at the default interval of 60 seconds.

  B. The script will not be run.

  C. The script will be run only once for each time Splunk is restarted.

  D. The script will be run. As soon as the script exits, Splunk restarts it.

  Correct Answer: C

  The inputs.conf file is used to configure inputs, distributed inputs such as forwarders, and file system monitoring in Splunk. The [script://myscript.sh] stanza specifies a script input, which means that Splunk runs the script and indexes its

  output.

  The interval setting determines how often Splunk runs the script. If the interval is set to 0, the script runs only once when Splunk starts up. If the interval is omitted, the script runs at the default interval of 60 seconds. Therefore, option C is

  correct, and the other options are incorrect.