Question 1

Which setting in indexes. conf allows data retention to be controlled by time?

Options :

A : maxDaysToKeep

B : moveToFrozenAfter

C : maxDataRetentionTime

D : frozenTimePeriodlnSecs

Answer: D

Question 2

Which file will be matched for the following monitor stanza in inputs. conf?

[monitor: ///var/log/*/bar/*. txt]

Options :

A : /var/log/host_460352847/temp/bar/file/csv/foo.txt

B : /var/log/host_460352847/bar/foo.txt

C : /var/log/host_460352847/bar/file/foo.txt

D : /var/ log/ host_460352847/temp/bar/file/foo.txt

Answer: C

Question 3

Which of the following types of data count against the license daily quota?

Options :

A : Replicated data

B : splunkd logs

C : Summary index data

D : Windows internal logs

Answer: D

Question 4

When enabling data integrity control, where does Splunk Enterprise store the hash files for each bucket?

Options :

A : Splunk Enterprise stores hash files in the logdata directory of the corresponding bucket.

B : Splunk Enterprise stores hash files in the rawdata directory of the corresponding bucket.

C : Splunk Enterprise stores hash files in the hashdata directory of the corresponding bucket.

D : Splunk Enterprise stores hash files in the metadata directory of the corresponding bucket.

Answer: B

Question 5

The universal forwarder has which capabilities when sending data? (select all that apply)

Options :

A : Sending alerts

B : Compressing data

C : Obfuscating/hiding data

D : Indexer acknowledgement

Answer: B,D

Free SPLK-1003 Mock Exam – Practice Online Confidently