Splunk Splunk Certifications SPLK-3003 Questions & Answers

• Question 21:

  Which of the following is the most efficient search?

  A. index=www status=200 uri=/cart/checkout | append [search index = sales] | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

  B. (index=www status=200 uri=/cart/checkout) OR (index=sales) | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

  C. index=www | append [search index = sales] | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

  D. (index=www) OR (index=sales) | search (index=www status=200 uri=/cart/checkout) OR (index=sales) | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

  Correct Answer: B

• Question 22:

  Consider the search shown below.

  

  What is this search's intended function?

  A. To return all the web_log events from the web index that occur two hours before and after the most recent high severity, denied event found in the firewall index.

  B. To find all the denied, high severity events in the firewall index, and use those events to further search for lateral movement within the web index.

  C. To return all the web_log events from the web index that occur two hours before and after all high severity, denied events found in the firewall index.

  D. To search the firewall index for web logs that have been denied and are of high severity.

  Correct Answer: C

• Question 23:

  A customer has three users and is planning to ingest 250GB of data per day. They are concerned with search uptime, can tolerate up to a two-hour downtime for the search tier, and want advice on single search head versus a search head cluster. (SHC).

  Which recommendation is the most appropriate?

  A. The customer should deploy two active search heads behind a load balancer to support HA.

  B. The customer should deploy a SHC with a single member for HA; more members can be added later.

  C. The customer should deploy a SHC, because it will be required to support the high volume of data.

  D. The customer should deploy a single search head with a warm standby search head and an rsync process to synchronize configurations.

  Correct Answer: D

• Question 24:

  Where are Splunk Data Model Acceleration (DMA) summaries stored?

  A. In tstatsHomePath

  B. In the .tsidx files.

  C. In summaryHomePath

  D. In journal.gz

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/ Acceleratedatamodels#:~:text=Splunk%20software%20creates%20ad%20hoc,your%20indexes% 20alongside%20index%20buckets

• Question 25:

  When can the Search Job Inspector be used to debug searches?

  A. If the search has not expired.

  B. If the search is currently running.

  C. If the search has been queued.

  D. If the search has expired.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/ ViewsearchjobpropertieswiththeJobInspector

• Question 26:

  A Splunk Index cluster is being installed and the indexers need to be configured with a license master. After the customer provides the name of the license master, what is the next step?

  A. Enter the license master configuration via Splunk web on each indexer before disabling Splunk web.

  B. Update /opt/splunk/etc/master-apps/_cluster/default/server.conf on the cluster master and apply a cluster bundle.

  C. Update the Splunk PS base config license app and copy to each indexer.

  D. Update the Splunk PS base config license app and deploy via the cluster master.

  Correct Answer: C

• Question 27:

  In preparation for the deployment of a new environment for a customer, which of the following mappings are correct per PS best practices?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

• Question 28:

  Which of the following statements is true, as it pertains to search head clustering (SHC)?

  A. SHC is supported on AIX, Linux, and Windows operating systems.

  B. Maximum number of nodes for a SHC is 10.

  C. SHC members must run on the same hardware specifications.

  D. Minimum number of nodes for a SHC is 5.

  Correct Answer: B

• Question 29:

  A customer is using regex to whitelist access logs and secure logs from a web server, but only the access logs are being ingested. Which troubleshooting resource would provide insight into why the secure logs are not being ingested?

  A. list monitor

  B. oneshot

  C. btprobe

  D. tailingprocessor

  Correct Answer: B

• Question 30:

  A customer with a large distributed environment has blacklisted a large lookup from the search bundle to decrease the bundle size using distsearch.conf. After this change, when running searches utilizing the lookup that was blacklisted they see error messages in the Splunk Search UI stating the lookup file does not exist.

  What can the customer do to resolve the issue?

  A. The search needs to be modified to ensure the lookup command specifies parameter local=true.

  B. The blacklisted lookup definition stanza needs to be modified to specify setting allow_caching=true.

  C. The search needs to be modified to ensure the lookup command specified parameter blacklist=false.

  D. The lookup cannot be blacklisted; the change must be reverted.

  Correct Answer: A