Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)

This file has been manually created on a universal forwarder: /opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file: /opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog index=syslog Which file is now monitored?

In which Splunk configuration is the SEDCMD used?

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

Where should apps be located on the deployment server that the clients pull from?

Which Splunk component requires a Forwarder license?

Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

Which parent directory contains the configuration files in Splunk?

During search time, which directory of configuration files has the highest precedence?

Which setting in indexes.conf allows data retention to be controlled by time?

When running the command shown below, what is the default path in which deploymentserver.conf is created? splunk set deploy-poll deployServer:port

The priority of layered Splunk configuration files depends on the fileÕs:

What is required when adding a native user to Splunk? (Select all that apply.)

What options are available when creating custom roles? (Select all that apply.)

Which of the following statements describe deployment management? (Select all that apply.)

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Where are license files stored?

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

Which of the following are methods for adding inputs in Splunk? (Select all that apply.)

Which of the following are required when defining an index in indexes.conf? (Select all that apply.)

Which layers are involved in Splunk configuration file layering? (Select all that apply.)

In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Which of the following authentication types requires scripting in Splunk?

Local user accounts created in Splunk store passwords in which file?

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

How do you remove missing forwarders from the Monitoring Console?

Which of the following indexes come pre-configured with Splunk Enterprise?

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Which authentication methods are natively supported within Splunk Enterprise?

Which of the following statements describe deployment management? (Select all that apply.)

Which Splunk component performs indexing and responds to search requests from the search head?

In which phase of the index time process does the license metering occur?

When running the command shown below, what is the default path in which deploymentserver.conf is created? splunk set deploy-poll deployServer:port

Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Which parent directory contains the configuration files in Splunk?

During search time, which directory of configuration files has the highest precedence?

This file has been manually created on a universal forwarder: /opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file: /opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog index=syslog Which file is now monitored?

Which of the following is a valid distributed search group?

Where should apps be located on the deployment server that the clients pull from?

Which Splunk component requires a Forwarder license?

Which of the following are supported options when configuring optional network inputs?

How often does Splunk recheck the LDAP server?

Which of the following are methods for adding inputs in Splunk? (Select all that apply.)

Which Splunk component does a search head primarily communicate with?

$SPLUNK_HOME/etc/users/authentication.conf
Newline Character

Where are license files stored?

Which of the following are required when defining an index in indexes.conf? (Select all that apply.)

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Within props.conf, which stanzas are valid for data modification? (Select all that apply.)

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list Ðdebug. What will the output be?

Which forwarder type can parse data prior to forwarding?

In which phase of the index time process does the license metering occur?

Where can scripts for scripted inputs reside on the host file system? (Select all that apply.)

What are the minimum required settings when creating a network input in Splunk?

To set up a network input in Splunk, what needs to be specified?

Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?

Which of the following enables compression for universal forwarders in outputs.conf?

How does the Monitoring Console monitor forwarders?