Question 1

You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list —debug. What will the output be?

Options :

A : list of all the configurations on-disk that Splunk contains.

B : A verbose list of all configurations as they were when splunkd started.

C :

A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located

D :

A list of the current running props, conf configurations along with a file path from which the configuration was made

Answer: C

Question 2

Which file will be matched for the following monitor stanza in inputs. conf?

[monitor: ///var/log/*/bar/*. txt]

Options :

A : /var/log/host_460352847/temp/bar/file/csv/foo.txt

B : /var/log/host_460352847/bar/foo.txt

C : /var/log/host_460352847/bar/file/foo.txt

D : /var/ log/ host_460352847/temp/bar/file/foo.txt

Answer: C

Question 3

In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

Options :

A : services/collector

B : data/collector

C : services/inputs?raw

D : services/data/collector

Answer: A

Question 4

Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Options :

A : Apps

B : Search

C : Data preview

D : Forwarder inputs

Answer: C

Question 5

What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Options :

A : Disk

B : CPUs

C : Memory

D : Network interface cards

Answer: B

Free SPLK-1003 Mock Exam – Practice Online Confidently

Buying Options: