Free Splunk Enterprise Certified Admin Exam SPLK-1003 Exam Practice Test

In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

• 21MB
• 28MB
• 14MB
• 7MB

A new forwarder has been installed with a manually created deploymentclient.conf.What is the next step to enable the communication between the forwarder and the deployment server?

• Restart Splunk on the deployment server.
• Enable the deployment client in Splunk Web under Forwarder Management.
• Restart Splunk on the deployment client.
• Wait for up to the time set in the phoneHomeIntervalInSecs setting.

Which Splunk component does a search head primarily communicate with?

• Indexer
• Forwarder
• Cluster master
• Deployment server

Which Splunk configuration file is used to enable data integrity checking?

• props.conf
• global.conf
• indexes.conf
• data_integrity.conf

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

• Slash notation
• Regular expression
• Irregular expression
• Wildcard-only expression

What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

• ... is not supported in monitor stanzas
• There is no difference, they are interchangable and match anything beyond directory boundaries.
• * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.
• ... matches anything in that specific directory path segment, whereas - recurses through subdirectories as well.

The following stanzas in inputs. conf are currently being used by a deployment client:[udp: //145.175.118.177:1001Connection_host = dnssourcetype = syslogWhich of the following statements is true of data that is received via this input?

• If Splunk is restarted, data will be queued and then sent when Splunk has restarted.
• Local firewall ports do not need to be opened on the deployment client since the port is defined in inputs.conf.
• The host value associated with data received will be the IP address that sent the data.
• If Splunk is restarted, data may be lost.

When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

• On Universal Forwarder, $SPLUNK_HOME/etc/apps
• On Deployment Server, $SPLUNK_HOME/etc/apps
• On Deployment Server, $SPLUNK_HOME/etc/deployment-apps
• On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps

Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

• Indexer
• Deployment server
• Universal forwarder
• Search head

Which Splunk component performs indexing and responds to search requests from the search head?

• Forwarder
• Search peer
• License master
• Search head cluster