Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dpt65

SPLK-1003 Questions and Answers

Question # 6

Which of the following apply to how distributed search works? (select all that apply)

A.

The search head dispatches searches to the peers

B.

The search peers pull the data from the forwarders.

C.

Peers run searches in parallel and return their portion of results.

D.

The search head consolidates the individual results and prepares reports

Full Access
Question # 7

When are knowledge bundles distributed to search peers?

A.

After a user logs in.

B.

When Splunk is restarted.

C.

When adding a new search peer.

D.

When a distributed search is initiated.

Full Access
Question # 8

What are the minimum required settings when creating a network input in Splunk?

A.

Protocol, port number

B.

Protocol, port, location

C.

Protocol, username, port

D.

Protocol, IP. port number

Full Access
Question # 9

Which of the following are methods for adding inputs in Splunk? (select all that apply)

A.

CLI

B.

Splunk Web

C.

Editing inputs. conf

D.

Editing monitor. conf

Full Access
Question # 10

What is the default value of LINE_BREAKER?

A.

\r\n

B.

([\r\n]+)

C.

\r+\n+

D.

(\r\n+)

Full Access
Question # 11

Which data pipeline phase is the last opportunity for defining event boundaries?

A.

Input phase

B.

Indexing phase

C.

Parsing phase

D.

Search phase

Full Access
Question # 12

How does the Monitoring Console monitor forwarders?

A.

By pulling internal logs from forwarders.

B.

By using the forwarder monitoring add-on

C.

With internal logs forwarded by forwarders.

D.

With internal logs forwarded by deployment server.

Full Access
Question # 13

The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs

the following search over the last 24 hours:

index=*

What field can the administrator check to see the data distribution?

A.

host

B.

index

C.

linecount

D.

splunk_server

Full Access
Question # 14

In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

A.

21MB

B.

28MB

C.

14MB

D.

7MB

Full Access
Question # 15

Which Splunk component performs indexing and responds to search requests from the search head?

A.

Forwarder

B.

Search peer

C.

License master

D.

Search head cluster

Full Access
Question # 16

Which Splunk configuration file is used to enable data integrity checking?

A.

props.conf

B.

global.conf

C.

indexes.conf

D.

data_integrity.conf

Full Access
Question # 17

What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

A.

... is not supported in monitor stanzas

B.

There is no difference, they are interchangable and match anything beyond directory boundaries.

C.

* matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.

D.

... matches anything in that specific directory path segment, whereas - recurses through subdirectories as well.

Full Access
Question # 18

What is the default character encoding used by Splunk during the input phase?

A.

UTF-8

B.

UTF-16

C.

EBCDIC

D.

ISO 8859

Full Access
Question # 19

Which of the following Splunk components require a separate installation package?

A.

Deployment server

B.

License master

C.

Universal forwarder

D.

Heavy forwarder

Full Access
Question # 20

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

A.

Deployer

B.

Cluster master

C.

Deployment server

D.

Search head cluster master

Full Access