Splunk Splunk Certifications SPLK-3003 Questions & Answers

• Question 31:

  As data enters the indexer, it proceeds through a pipeline where event processing occurs. In which pipeline does line breaking occur?

  A. Indexing

  B. Typing

  C. Merging

  D. Parsing

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/ Howindexingworks#Event_processing_and_the_data_pipeline

• Question 32:

  A customer has a multisite cluster (two sites, each site in its own data center) and users experiencing a slow response when searches are run on search heads located in either site. The Search Job Inspector shows the delay is being caused by search heads on either site waiting for results to be returned by indexers on the opposing site. The network team has confirmed that there is limited bandwidth available between the two data centers, which are in different geographic locations.

  Which of the following would be the least expensive and easiest way to improve search performance?

  A. Configure site_search_factor to ensure a searchable copy exists in the local site for each search head.

  B. Move all indexers and search heads in one of the data centers into the same site.

  C. Install a network pipe with more bandwidth between the two data centers.

  D. Set the site setting on each indexer in the server.conf clustering stanza to be the same for all indexers regardless of site.

  Correct Answer: A

• Question 33:

  Where does the bloomfilter reside?

  A. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8

  B. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/*.tsidx

  C. $SPLUNK_HOME/var/lib/splunk/fishbucket

  D. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/rawdata

  Correct Answer: C

• Question 34:

  A customer is having issues with truncated events greater than 64K. What configuration should be deployed to a universal forwarder (UF) to fix the issue?

  A. None. Splunk default configurations will process the events as needed; the UF is not causing truncation.

  B. Configure the best practice magic 6 or great 8 props.conf settings.

  C. EVENT_BREAKER_ENABLE and EVENT_BREAKER regular expression settings per sourcetype.

  D. Global EVENT_BREAKER_ENABLE and EVENT_BREAKER regular expression settings.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Resolvedataqualityissues

• Question 35:

  A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?

  A. Open a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.

  B. Open a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

  C. Use a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.

  D. Use a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.

  Correct Answer: D

• Question 36:

  Report acceleration has been enabled for a specific use case. In which bucket location is the corresponding CSV file located?

  A. thawedPath

  B. summaryHomePath

  C. tstatsHomePath

  D. homePath, coldPath

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/ Manageacceleratedsearchsummaries

• Question 37:

  Which command is most efficient in finding the pass4SymmKey of an index cluster?

  A. find / -name server.conf -print | grep pass4SymKey

  B. $SPLUNK_HOME/bin/splunk search | rest splunk_server=local /servicesNS/-/unhash_app/storage/ passwords

  C. $SPLUNK_HOME/bin/splunk btool server list clustering | grep pass4SymmKey

  D. $SPLUNK_HOME/bin/splunk btool clustering list clustering --debug | grep pass4SymmKey

  Correct Answer: D

  Reference: https://community.splunk.com/t5/Deployment-Architecture/Which-instance-or-configuration-filein-my-Splunk-environment/m-p/241486

• Question 38:

  What is required to setup the HTTP Event Collector (HEC)?

  A. Each HEC input requires a unique name but token values can be shared.

  B. Each HEC input requires an existing forwarder output group.

  C. Each HEC input entry must contain a valid token.

  D. Each HEC input requires a Source name field.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/UsetheHTTPEventCollector

• Question 39:

  In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing configurations need to be installed for this to work?

  

  A. All universal forwarders.

  B. Only the indexers.

  C. All heavy forwarders.

  D. On all parsing Splunk instances.

  Correct Answer: D

• Question 40:

  A new search head cluster is being implemented. Which is the correct command to initialize the deployer node without restarting the search head cluster peers?

  A. $SPLUNK_HOME/bin/splunk apply shcluster-bundle

  B. $SPLUNK_HOME/bin/splunk apply cluster-bundle

  C. $SPLUNK_HOME/bin/splunk apply shcluster-bundle -action stage D. $SPLUNK_HOME/bin/splunk apply cluster-bundle -action stage

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/ PropagateSHCconfigurationchanges