SPLK-1003 Practice Test

SPLK-1003 Practice Test practice questions, page 7 of 9, with answer review and explanations.

Question 31

What is the default character encoding used by Splunk during the input phase?

  1. UTF-8
  2. UTF-16
  3. EBCDIC
  4. ISO 8859

Question 32

Which of the following enables compression for universal forwarders in outputs.conf?

  1. [udpout:mysplunk_indexer11] compression=true
  2. [tcpout] defaultGroup=my_indexers compressed=true
  3. /opt/splunkforwarder/bin/splunk enable compression
  4. [tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false

Question 33

User role inheritance allows what to be inherited from the parent role? (Choose all that apply.)

  1. Parents
  2. Capabilities
  3. Index access
  4. Search history

Question 34

Which of the following statements apply to directory inputs? (Choose all that apply.)

  1. All discovered text files are consumed.
  2. Compressed files are ignored by default.
  3. Splunk recursively traverses through the directory structure.
  4. When adding new log files to a monitored directory, the forwarder must be restarted to take them into account.

Question 35

How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

  1. [distributedSearch:NYC] default = false servers = nyc1:8089, nyc2:8089 [distributedSearch:HOUSTON] default = false servers = houston1:8089, houston2:8089
  2. [distributedSearch] servers =nyc1, nyc2, houston1, houston2 [distributedSearch:NYC] default = false servers = nyc1, nyc2 [distributedSearch:HOUSTON] default = false servers = houston1, houston2
  3. [distributedSearch] servers =nyc1:8089, nyc2:8089, houston1:8089, houston2:8089 [distributedSearch:NYC] default = false servers = nyc1:8089, nyc2:8089 [distributedSearch:HOUSTON] default = false servers = houston1:8089, houston2:8089
  4. [distributedSearch] servers =nyc1:8089; nyc2:80893; houston1:8089; houston2:8089 [distributedSearch:NYC] default = false servers = nyc1:8089; nyc2:8089 [distributedSearch:HOUSTON] default = false servers = houston1:80897706; houston2:80898350