Question 1

When enabling data integrity control, where does Splunk Enterprise store the hash files for each bucket?

Options :

A : Splunk Enterprise stores hash files in the logdata directory of the corresponding bucket.

B : Splunk Enterprise stores hash files in the rawdata directory of the corresponding bucket.

C : Splunk Enterprise stores hash files in the hashdata directory of the corresponding bucket.

D : Splunk Enterprise stores hash files in the metadata directory of the corresponding bucket.

Answer: B

Question 2

The CLI command splunk add forward-server indexer: will create stanza(s) in which configuration file?

Options :

A : inputs.conf

B : indexes.conf

C : outputs.conf

D : servers.conf

Answer: C

Question 3

Which of the following types of data count against the license daily quota?

Options :

A : Replicated data

B : splunkd logs

C : Summary index data

D : Windows internal logs

Answer: D

Question 4

Which parent directory contains the configuration files in Splunk?

Options :

A : SSFLUNK_HOME/etc

B : SSPLUNK_HOME/var

C : SSPLUNK_HOME/conf

D : SSPLUNK_HOME/default

Answer: A

Question 5

Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

Options :

A : splunk btool server list --debug

B : splunk list forward-indexer

C : splunk list forward-server

D : splunk btool indexes list --debug

Answer: C

Free SPLK-1003 Mock Exam – Practice Online Confidently