Question 1

This file has been manually created on a universal forwarder: /opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file: /opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog Which file is now monitored?

Accepted Answer

The answer of This file has been manually created on...

Question 2

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

Accepted Answer

The splunk add forward-server command creates stanzas in the outputs.conf file.

Question 3

When does a warm bucket roll over to a cold bucket?

Accepted Answer

The answer of When does a warm bucket roll over...

Question 4

What is the valid option for a [monitor] stanza in inputs.conf ?

Accepted Answer

The answer of What is the valid option for a...

Question 5

Which setting in indexes.conf allows data retention to be controlled by time?

Accepted Answer

The setting "frozenTimePeriodInSecs" in indexes.conf specifies the time period after which data is moved to frozen storage, effectively controlling data retention by time.

Question 6

Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Accepted Answer

The Duo Administrator is responsible for providing the necessary credentials and configuration details, such as the Application Secret, Integration, and Secret keys, as well as the API Hostname, when setting up Duo for Multi-Factor Authentication in Splunk Enterprise.

Question 7

Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Accepted Answer

The answer of Which feature in Splunk allows Event Breaking,...

Question 8

The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours: index=* What field can the administrator check to see the data distribution?

Accepted Answer

The "splunk_server" field indicates which indexer processed each event, allowing the administrator to see how data is distributed across the indexers.

Question 9

The universal forwarder has which capabilities when sending data? (Select all that apply.)

Accepted Answer

The answer of The universal forwarder has which capabilities when...

Question 10

How is data handled by Splunk during the input phase of the data ingestion process?

Accepted Answer

The answer of How is data handled by Splunk during...

Question 11

Which parent directory contains the configuration files in Splunk?

Accepted Answer

The configuration files in Splunk are located in the $SPLUNK_HOME/etc directory.

Question 12

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Accepted Answer

The answer of An admin is running the latest version...

Question 13

An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

Accepted Answer

The answer of An organization wants to collect Windows performance...

Question 14

Where are deployment server apps mapped to clients?

Accepted Answer

Deployment server apps are mapped to clients using the Server Classes tab in the forwarder management interface or the serverclass.conf file.

Question 15

Which of the following must be done to define user permissions when integrating Splunk with LDAP?

Accepted Answer

Mapping groups is essential when integrating Splunk with LDAP to define user permissions, as it allows you to assign roles and permissions based on LDAP group membership.

Question 16

After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

Accepted Answer

The answer of After how many warnings within a rolling...

Question 17

Which forwarder type can parse data prior to forwarding?

Accepted Answer

A Heavy forwarder can parse data prior to forwarding, as it has the capability to perform data parsing and indexing.

Question 18

In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Accepted Answer

The Deployment server is used in a distributed Splunk environment to distribute apps and configurations to other Splunk instances, such as forwarders.

Question 19

Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)

Accepted Answer

The answer of Which of the following are supported configuration...

Question 20

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list --debug . What will the output be?

Accepted Answer

The answer of You update a props.conf file while Splunk...

Exam 3: Splunk Certified Developer