Splunk Enterprise Certified Admin (SPLK-1003)

Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?

When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

Which pathway represents where a network input in Splunk might be found?

Syslog files are being monitored on a Heavy Forwarder.

Where would the appropriate TRANSFORMS setting be deployed to reroute logs based on the event message?

An admin oversees an environment with a 1000 GB / day license. The configuration file server.conf has strict_pool_quota=false set. The license is divided into the following three pools, and today's usage is shown on the right-hand column:

What is the timespan for which a Splunk Enterprise Trial License is valid?

A sourcetype has been explicitly set in inputs.conf. How can the sourcetype be fine-tuned in props.conf during the Input phase?

Which of the following is an alternative method to manually editing the outputs.conf file on the forwarder to send data?

What command is used to configure a deployment client?

Which of the following is true about the Data Preview step in the Add Data workflow?

Which of these is not a valid way to get data into Splunk?

When configuring Distributed Search, which of the following stanzas will add search peers?

What is the correct order of index time precedence?

(For each of the following, highest precedence is shown at the top and lowest precedence is shown at the bottom)

Which stanza value in props.conf defines index-time data masking?

Which of the following primary authentication methods is not supported with Splunk handling its paired multi-factor authentication method?

Which scenario is applicable given the stanzas in authentication.conf below?

There is a file with a vast amount of old data. Which of the following inputs. conf attributes would allow an admin to monitor the file for updates without indexing the pre-existing data?

The Deployment Server is overwhelmed by forwarders checking in too frequently. To address this problem, the admin wants to have forwarders check in on an hourly basis. How would the admin accomplish this?

The following stanzas in inputs. conf are currently being used by a deployment client:

Metadata settings are assigned when Splunk indexes event data. Which of the following is not a default metadata value?

A Universal Forwarder has the following active stanza in inputs.conf:

An admin is configuring timestamp extraction for the following event:

[13:11:08] [main/forge] Diamonds are blue

Which of the following configurations will correctly extract the timestamp?

How would you configure your distsearch.conf to allow you to run the search below?

sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A Universal Forwarder is monitoring a very active syslog stream and as a result is unable to switch between destinations. How would an admin safely remediate this issue?

Which of the following is a valid method to create a Splunk user?

Which of the following is true when authenticating users to Splunk using LDAP?

Which of the methods listed below supports multi-factor authentication?

Which of the following is an acceptable channel value when using the HTTP Event Collector indexer acknowledgement capability?

A new XML data source contains multiple events. Each event in this data source starts with an element.

Which of the following props.conf configuration would break this data stream into events during the parsing phase?

In which of the following scenarios would a monitored log file be re-ingested by Splunk?

As part of setting up Distributed Search, what capability on the Search Peer is required to authenticate access?

How would you configure your distsearch.conf to allow you to run the search below?

sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A Splunk index has the following configuration:

Which file will be matched for the following monitor stanza in inputs. conf?

[monitor:///var/log/*/bar/…/*.txt]

Which setting in indexes.conf allows data retention to be controlled by time?

The universal forwarder has which capabilities when sending data? (Choose all that apply.)

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

In which Splunk configuration is the SEDCMD used?

Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)