SPLK-1003 Practice Test

SPLK-1003 Practice Test practice questions, page 8 of 9, with answer review and explanations.

Question 36

Which of the following is a valid distributed search group?

  1. [distributedSearch:Paris] default = false servers = server1, server2
  2. [searchGroup:Paris] default = false servers = server1:8089, server2:8089
  3. [searchGroup:Paris] default = false servers = server1:9997, server2:9997
  4. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089

Question 37

Local user accounts created in Splunk store passwords in which file?

  1. $SPLUNK_HOME/etc/passwd
  2. $SPLUNK_HOME/etc/authentication
  3. $SPLUNK_HOME/etc/users/passwd.conf
  4. $SPLUNK_HOME/etc/users/authentication.conf

Question 38

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

  1. True
  2. False
  3. <regex string>
  4. Newline Character

Question 39

Which Splunk component does a search head primarily communicate with?

  1. Indexer
  2. Forwarder
  3. Cluster master
  4. Deployment server

Question 40

Which layers are involved in Splunk configuration file layering? (Choose all that apply.)

  1. App context
  2. User context
  3. Global context
  4. Forwarder context