SPLK-1003 Practice Test

Review 209 SPLK-1003 practice questions with answer explanations and community insights.

Question 1

Which setting in indexes.conf allows data retention to be controlled by time?

  1. maxDaysToKeep
  2. moveToFrozenAfter
  3. maxDataRetentionTime
  4. frozenTimePeriodInSecs

Question 2

The universal forwarder has which capabilities when sending data? (Choose all that apply.)

  1. Sending alerts
  2. Compressing data
  3. Obfuscating/hiding data
  4. Indexer acknowledgement

Question 3

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

  1. Blacklist
  2. Whitelist
  3. They cancel each other out.
  4. Whichever is entered into the configuration first.

Question 4

In which Splunk configuration is the SEDCMD used?

  1. props.conf
  2. inputs.conf
  3. indexes.conf
  4. transforms.conf

Question 5

Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)

  1. CLI
  2. Edit inputs.conf
  3. Edit forwarder.conf
  4. Forwarder Management