Download 2022 Update Splunk SPLK-1003 Practice Exam Questions

test2022-04-25T03:57:40+00:00

SPLK-1003 Splunk Enterprise Certified Admin exam is the final step towards completion of the Splunk Enterprise Certified Admin certification. Before taking the SPLK-1003 exam, you may test your knowledge with a free SPLK-1003 practice test. FreeTestShare SPLK-1003 practice exam fully describes what you will face on the real exam, allowing you to pass the SPLK-1003 exam quickly. We ensure that if you use the most accurate SPLK-1003 questions and answers, you will pass the exam on the first try!

Take this free SPLK-1003 practice exam right now to see how well you know yourself.

Page 1 of 4

1. Which of the following enables compression for universal forwarders in outputs. conf ?

A)

Option A

Option B

Option C

Option D

2. The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers.

Following best practices, which types of Splunk component instances are needed?

Indexers, search head, universal forwarders, license master

Indexers, search head, deployment server, universal forwarders

Indexers, search head, deployment server, license master, universal forwarder

Indexers, search head, deployment server, license master, universal forwarder, heavy forwarder

3. When indexing a data source, which fields are considered metadata?

source, host, time

time, sourcetype, source

host, raw, sourcetype

sourcetype, source, host

4. Which of the following are required when defining an index in indexes. conf? (select all that apply)

coldPath

homePath

frozenPath

thawedPath

5. An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day.

To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Buy a bigger Splunk license.

Add 2.5 TB each day for the next 5 days.

Add all 10 TB in a single 24 hour period.

Add 200 GB of historical data each day for 50 days.

6. The Splunk administrator wants to ensure data is distributed evenly amongst the indexers.

To do this, he runs the following search over the last 24 hours:

index=*

What field can the administrator check to see the data distribution?

host

index

linecount

splunk_server

7. Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

inputs.conf

monitor.conf

outputs.conf

forwarder.conf

8. Which Splunk component does a search head primarily communicate with?

Indexer

Forwarder

Cluster master

Deployment server

9. Social Security Numbers (PII) data is found in log events, which is against company policy.

SSN format is as follows: 123-44-5678.

Which configuration file and stanza pair will mask possible SSNs in the log events?

props.conf [mask-SSN] REX = (?ms)^(.)<[SSN>d{3}-?d{2}-?(d{4}.*)$" FORMAT = $1<SSN>###-##-$2 KEY = _raw

props.conf [mask-SSN] REGEX = (?ms)^(.)<[SSN>d{3}-?d{2}-?(d{4}.*)$" FORMAT = $1<SSN>###-##-$2 DEST_KEY = _raw

transforms.conf [mask-SSN] REX = (?ms)^(.)<[SSN>d{3}-?d{2}-?(d{4}.*)$" FORMAT = $1<SSN>###-##-$2 DEST_KEY = _raw

transforms.conf [mask-SSN] REGEX = (?ms)^(.)<[SSN>d{3}-?d{2}-?(d{4}.*)$" FORMAT = $1<SSN>###-##-$2 DEST_KEY = _raw

10. Which of the following applies only to Splunk index data integrity check?

Lookup table

Summary Index

Raw data in the index

Data model acceleration

Page 2 of 4

11. Which Splunk configuration file is used to enable data integrity checking?

props.conf

global.conf

indexes.conf

data_integrity.conf

12. In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Indexer

Deployer

Forwarder

Deployment server

13. User role inheritance allows what to be inherited from the parent role? (select all that apply)

Parents

Capabilities

Index access

Search history

14. What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

host=server1 index=unixinfo

host=server1 index=searchinfo

host=searchsvr1 index=searchinfo

host=unixsvr1 index=unixinfo

15. Which of the following apply to how distributed search works? (select all that apply)

The search head dispatches searches to the peers

The search peers pull the data from the forwarders.

Peers run searches in parallel and return their portion of results.

The search head consolidates the individual results and prepares reports

16. What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

License data

Metricsdata

Internal Splunk data

Internal Windows logs

17. What is required when adding a native user to Splunk? (select all that apply)

Password

Username

Full Name

Default app

18. In which Splunk configuration is the SEDCMD used?

props, conf

inputs.conf

indexes.conf

transforms.conf

19. A log file contains 193 days worth of timestamped events.

Which monitor stanza would be used to collect data 45 days old and newer from that log file?

followTail = -45d

ignore = 45d

includeNewerThan = -35d

ignoreOlderThan = 45d

20. Which of the following statements accurately describes using SSL to secure the feed from a forwarder?

It does not encrypt the certificate password.

SSL automatically compresses the feed by default.

It requires that the forwarder be set to compressed=true.

It requires that the receiver be set to compression=true.

Page 3 of 4

21. When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Slash notation

Regular expression

Irregular expression

Wildcard-only expression

22. How often does Splunk recheck the LDAP server?

Every 5 minutes

Each time a user logs in

Each time Splunk is restarted

Varies based on LDAP_refresh setting.

23. Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

Upload option

Forward option

Monitor option

Download option

24. When are knowledge bundles distributed to search peers?

After a user logs in.

When Splunk is restarted.

When adding a new search peer.

When a distributed search is initiated.

25. Which layers are involved in Splunk configuration file layering? (select all that apply)

App context

User context

Global context

Forwarder context

26. Where are deployment server apps mapped to clients?

Apps tab in forwarder management interface or clientapps.conf.

Clients tab in forwarder management interface or deploymentclient.conf.

Server Classes tab in forwarder management interface or serverclass.conf.

Client Applications tab in forwarder management interface or clientapps.conf.

27. Which of the following accurately describes HTTP Event Collector indexer acknowledgement?

It requires a separate channel provided by the client.

It is configured the same as indexer acknowledgement used to protect in-flight data.

It can be enabled at the global setting level.

It stores status information on the Splunk server.

28. During search time, which directory of configuration files has the highest precedence?

$SFLUNK_KOME/etc/system/local

$SPLUNK_KCME/etc/system/default

$SPLUNK_HCME/etc/apps/app1/local

$SPLUNK HCME/etc/users/admin/local

29. How does the Monitoring Console monitor forwarders?

By pulling internal logs from forwarders.

By using the forwarder monitoring add-on

With internal logs forwarded by forwarders.

With internal logs forwarded by deployment server.

30. An index stores its data in buckets.

Which default directories does Splunk use to store buckets? (Choose all that apply.)

bucketdb

frozendb

colddb

Page 4 of 4

31. Which of the following types of data count against the license daily quota?

Replicated data

splunkd logs

Summary index data

Windows internal logs