Free Splunk Cloud Certified Admin Exam SPLK-1005 Exam Practice Test

What Splunk command will allow an administrator to view the runtime configuration instructions for a monitored file in Inputs. cont on the forwarders?

• ./splunk _internal call /services/data/input.3/filemonitor
• ./splunk show config inputs.conf
• ./splunk _internal rest /services/data/inputs/monitor
• ./splunk show config inputs

Which of the following is true when using Intermediate Forwarders?

• Intermediate Forwarders may be a mix of Universal and Heavy Forwarders.
• All Intermediate Forwarders must be Heavy Forwarders.
• Intermediate Forwarders may be Universal Forwarders or Heavy Forwarders, but may not be mixed.
• All Intermediate Forwarders must be Universal Forwarders.

In which of the following situations should Splunk Support be contacted?

• When a custom search needs tuning due to not performing as expected.
• When an app on Splunkbase indicates Request Install.
• Before using the delete command.
• When a new role that mirrors sc_admin is required.

Which of the following app installation scenarios can be achieved without involving Splunk Support?

• Deploy premium apps.
• Install apps via the Request Install button.
• Install apps via self-service.
• Install apps that have not gone through the vetting process.

Which of the following is true when integrating LDAP authentication?

• Splunk stores LDAP end user names and passwords on search heads.
• The mapping of LDAP groups to Splunk roles happens automatically.
• Splunk Cloud only supports Active Directory LDAP servers.
• New user data is cached the first time a user logs in.

When monitoring network inputs, there will be times when the forwarder is unable to send data to the indexers. Splunk uses a memory queue and a disk queue. Which setting is used for the disk queue?

• queueSize
• maxQeueSize
• diskQiioiioiiizo
• persistentQueueSize

A monitor has been created in inputs. con: for a directory that contains a mix of file types.How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

• On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.
• On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props. conf that assigns a specific sourcetype by source stanza.
• On the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props, com that filters out unwanted files.
• On the forwarder collecting the data, set multiple 3ourcotype_sourc« attributes for the directory monitor collecting the files. Then create a props. conf that filters out unwanted files.

Which of the following tasks is the responsibility of a Splunk Cloud administrator?

• Configuring deployer
• Configuring cluster master
• Configuring indexers
• Configuring indexes

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

• transforms.conf
• props.conf
• inputs.conf
• outputs.cont

Which file or folder below is not a required part of a deployment app?

• app.conf (in default or local)
• local.meta
• metadata folder
• props.conf