Splunk SPLK-1003 Splunk Enterprise Certified Admin Exam Practice Test

Page: 1 / 14
Total 138 questions

Question 1

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

Answer : B

Question 2

When using license pools, volume allocations apply to which Splunk components?

Answer : A

Question 3

When using a directory monitor input, specific source type can be selectively overridden using which configuration file?

Answer : A

Question 4

A new forwarder has been installed with a manually created deploymentclient.conf.

What is the next step to enable the communication between the forwarder and the deployment server?

Answer : A

Question 5

Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

Answer : C

Question 6

Which of the following are reasons to create separate indexes? (Choose all that apply.)

Answer : A, D

Question 7

In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

Answer : A

Page:    1 / 14   
Total 138 questions