Within props.conf, which stanzas are valid for data modification? (Select all that apply.)

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Which of the following authentication types requires scripting in Splunk?

Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)

Which of the following statements apply to directory inputs? (Select all that apply.)

Local user accounts created in Splunk store passwords in which file?

What are the minimum required settings when creating a network input in Splunk?

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Which forwarder type can parse data prior to forwarding?

Which of the following enables compression for universal forwarders in outputs.conf?

What is the correct order of steps in Duo Multifactor Authentication?

In which Splunk configuration is the SEDCMD used?

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

What is the default character encoding used by Splunk during the input phase?

The universal forwarder has which capabilities when sending data? (Select all that apply.)

What is required when adding a native user to Splunk? (Select all that apply.)

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

What options are available when creating custom roles? (Select all that apply.)

To set up a network input in Splunk, what needs to be specified?

Which authentication methods are natively supported within Splunk Enterprise? (Select all that apply.)

User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

What is the difference between the two wildcards É and * for the monitor stanza in inputs.conf?

Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?

The priority of layered Splunk configuration files depends on the fileÕs:

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list Ðdebug. What will the output be?

Which of the following apply to how distributed search works? (Select all that apply.)

In this sourcetype definition the MAX_TIMESTAMP_LOOKAHEAD is missing. Which value would fit best?

Which layers are involved in Splunk configuration file layering? (Select all that apply.)

How do you remove missing forwarders from the Monitoring Console?

Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

Which of the following is a way to exclude search artifacts when creating a diag?

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

What is a Splunk Job? (Select all that apply.)

In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files. What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Which of the following commands is used to clear the KV store?

In the deployment planning process, when should a person identify who gets to see network data?

Which of the following can a Splunk diag contain?

Which of the following statements describe search head clustering?(Select all that apply.)

Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

How does the average run time of all searches relate to the available CPU cores on the indexers?

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

What is the minimum reference server specification for a Splunk indexer?

Which of the following should be included in a deployment plan?

Which two sections can be expanded using the SearchJob Inspector?

Configurations from the deployer are merged into which location on the search head cluster member?

Which of the following describe migration from single-site to multisite index replication?

Which Splunk server role regulates the functioning of indexer cluster?

Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

When Splunk is installed, where are the internal indexes stored by default?

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Where can scripts for scripted inputs reside on the host file system? (Select all that apply.)

How does the Monitoring Console monitor forwarders?

Which valid bucket types are searchable? (Select all that apply.)

Which of the following indexes come pre-configured with Splunk Enterprise? (Select all that apply.)

Which setting in indexes.conf allows data retention to be controlled by time?