Splunk SPLK-1003 Based on Real Exam Environment

Splunk Enterprise Certified Admin Questions and Answers

Question 9

Which Splunk component does a search head primarily communicate with?

Options:

Indexer

Forwarder

Cluster master

Deployment server

Question 10

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Options:

inputs.conf

monitor.conf

outputs.conf

forwarder.conf

Question 11

Which of the following monitor inputs stanza headers would match all of the following files?

/var/log/www1/secure.log

/var/log/www/secure.l

/var/log/www/logs/secure.logs

/var/log/www2/secure.log

Options:

[monitor:///var/log/.../secure.*

[monitor:///var/log/www1/secure.*]

[monitor:///var/log/www1/secure.log]

[monitor:///var/log/www*/secure.*]

Question 12

A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk's response?

Options:

Update the user in Splunk web informing them that the results of their search may be incomplete.

Repeat the search request on indexer B without informing the user.

Update the user in Splunk web that their results may be incomple and that Splunk will try to re-execute the search.

Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.

Winter Special - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: top65certs

Splunk SPLK-1003 Based on Real Exam Environment

Splunk Enterprise Certified Admin Questions and Answers

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

CompTIA

Fortinet

Microsoft

Salesforce