The Secret Of Splunk SPLK-1003 Exam

NEW QUESTION 1
Which Splunk component performs indexing and responds to search requests from the search head?

• A. Forwarder
• B. Search peer
• C. License master
• D. Search head cluster

Answer: B

Explanation:
Reference: https://www.edureka.co/blog/splunk-architecture/

NEW QUESTION 2
Which of the following authentication types requires scripting in Splunk?

• A. ADFS
• B. LDAP
• C. SAML
• D. RADIUS

Answer: D

Explanation:
Reference: https://answers.splunk.com/answers/131127/scripted-authentication.html

NEW QUESTION 3
When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

• A. App Class
• B. Client Class
• C. Server Class
• D. Forwarder Class

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Createdeploymentapps

NEW QUESTION 4
What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf?

• A. ... is not supported in monitor stanzas.
• B. There is no difference, they are interchangeable and match anything beyond directory boundaries.
• C. * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.
• D. ... matches anything in that specific directory path segment, whereas * recurses through subdirectories as well.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Specifyinputpathswithwildcards

NEW QUESTION 5
Local user accounts created in Splunk store passwords in which file?

• A. $SPLUNK_HOME/etc/passwd
• B. $SPLUNK_HOME/etc/authentication
• C. $SPLUNK_HOME/etc/users/passwd.conf
• D. $SPLUNK_HOME/etc/users/authentication.conf

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/User-seedconf

NEW QUESTION 6
How do you remove missing forwarders from the Monitoring Console?

• A. By restarting Splunk.
• B. By rescanning active forwarders.
• C. By reloading the deployment server.
• D. By rebuilding the forwarder asset table.

Answer: D

Explanation:
Reference: https://answers.splunk.com/answers/447096/how-to-remove-missing-forwarders-from-the-distribu.html

NEW QUESTION 7
What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

• A. REGEX, DEST, FORMAT
• B. REGEX, SRC_KEY, FORMAT
• C. REGEX, DEST_KEY, FORMAT
• D. REGEX, DEST_KEY, FORMATTING

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf

NEW QUESTION 8
Which of the following are supported options when configuring optional network inputs?

• A. Metadata override, sender filtering options, network input queues (quantum queues)
• B. Metadata override, sender filtering options, network input queues (memory/persistent queues)
• C. Filename override, sender filtering options, network output queues (memory/persistent queues)
• D. Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Answer: D

NEW QUESTION 9
When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

• A. Slash notation
• B. Regular expression
• C. Irregular expression
• D. Wildcard-only expression

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Filterclients

NEW QUESTION 10
Which of the following statements describe deployment management? (Select all that apply.)

• A. Requires an Enterprise license.
• B. Is responsible for sending apps to forwarders.
• C. Once used, is the only way to manage forwarders.
• D. Can automatically restart the host OS running the forwarder.

Answer: A

NEW QUESTION 11
Which parent directory contains the configuration files in Splunk?

• A. $SPLUNK_HOME/etc
• B. $SPLUNK_HOME/var
• C. $SPLUNK_HOME/conf
• D. $SPLUNK_HOME/default

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Configurationfiledirectories

NEW QUESTION 12
Which of the following statements apply to directory inputs? (Select all that apply.)

• A. All discovered text files are consumed.
• B. Compressed files are ignored by default.
• C. Splunk recursively traverses through the directory structure.
• D. When adding new log files to a monitored directory, the forwarder must be restarted to take them into account.

Answer: C

Explanation:
Reference: https://answers.splunk.com/answers/133875/recursive-monitoring-of -directories.html

NEW QUESTION 13
Which of the following indexes come pre-configured with Splunk Enterprise? (Select all that apply.)

• A. _licence
• B. _internal
• C. _external
• D. _thefishbucket

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Howindexingworks

NEW QUESTION 14
In which phase of the index time process does the license metering occur?

• A. Input phase
• B. Parsing phase
• C. Indexing phase
• D. Licensing phase

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

NEW QUESTION 15
Which of the following are methods for adding inputs in Splunk? (Select all that apply.)

• A. CLI
• B. Splunk Web
• C. Editing inpits.conf
• D. Editing monitor.conf

Answer: AB

Explanation:
Reference: http://dev.splunk.com/view/dev -guide/SP-CAAAE3A

NEW QUESTION 16
How often does Splunk recheck the LDAP server?

• A. Every 5 minutes.
• B. Each time a user logs in.
• C. Each time Splunk is restarted.
• D. Varies based on LDAP_refresh setting.

Answer: D

Explanation:
Reference: http://docshare02.docshare.tips/files/22651/226514302.pdf

NEW QUESTION 17
With authentication methods are natively supported within Splunk Enterprise? (Select all that apply.)

• A. LDAP
• B. SAML
• C. RADIUS
• D. Duo Multifactor Authentication

Answer: AD

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/SetupuserauthenticationwithSplunk

NEW QUESTION 18
You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list –-debug. What will the output be?

• A. A list of all the configurations on-disk that Splunk contains.
• B. A verbose list of all configurations as they were when splunkd started.
• C. A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
• D. A list of the current running props.conf configurations along with a file path from which the configuration was made.

Answer: D

Explanation:
Reference: https://answers.splunk.com/answers/494219/need-help-with-what-should-be-a-simple-precedence.html

NEW QUESTION 19
Which of the following are required when defining an index in indexes.conf? (Select all that apply.)

• A. coldPath
• B. homePath
• C. frozenPath
• D. thawedPath

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Indexesconf#PER_INDEX_OPTIONS

NEW QUESTION 20
Which of the following is a valid distributed search group?

• A. [distributedSearch:Paris] default = false servers = server1, server2
• B. [searchGroup:Paris] default = false servers = server1:8089, server2:8089
• C. [searchGroup:Paris] default = false servers = server1:9997, server2:9997
• D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Distributedsearchgroups

NEW QUESTION 21
Within props.conf, which stanzas are valid for data modification? (Select all that apply.)

• A. Host
• B. Server
• C. Source
• D. Sourcetype

Answer: CD

Explanation:
Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for-udp-514-data-sources.html

NEW QUESTION 22
......