SPLK-1003 Practice Test

SPLK-1003 Practice Test practice questions, page 3 of 9, with answer review and explanations.

Question 11

This file has been manually created on a universal forwarder: /opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file: /opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog index=syslog Which file is now monitored?

  1. /var/log/messages
  2. /var/log/maillog
  3. /var/log/maillog and /var/log/messages
  4. none of the above

Question 12

In which phase of the index time process does the license metering occur?

  1. Input phase
  2. Parsing phase
  3. Indexing phase
  4. Licensing phase

Question 13

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will the output be?

  1. A list of all the configurations on-disk that Splunk contains.
  2. A verbose list of all configurations as they were when splunkd started.
  3. A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
  4. A list of the current running props.conf configurations along with a file path from which the configuration was made.

Question 14

When running the command shown below, what is the default path in which deploymentserver.conf is created? splunk set deploy-poll deployServer:port

  1. SPLUNK_HOME/etc/deployment
  2. SPLUNK_HOME/etc/system/local
  3. SPLUNK_HOME/etc/system/default
  4. SPLUNK_HOME/etc/apps/deployment

Question 15

The priority of layered Splunk configuration files depends on the file's:

  1. Owner
  2. Weight
  3. Context
  4. Creation time