Free Splunk Enterprise Certified Admin Practice Questions

A.  

After a user logs in.

B.  

When Splunk is restarted.

C.  

When adding a new search peer.

D.  

When a distributed search is initiated.

A.  

Data is treated as streams.

B.  

Data is broken up into events.

C.  

Data is initially written to disk.

D.  

Data is measured by the license meter.

A.  

IgnoreOlderThan

B.  

allowList

C.  

monitor

D.  

followTail

A.  

$ SFLUNK_HOME/etc/passwd

B.  

$ SFLUNK_HOME/etc/authentication

C.  

$ S?LUNK_HOME/etc/users/passwd.conf

D.  

$ SPLUNK HOME/etc/users/authentication.conf

A.  

Free license

B.  

Forwarder license

C.  

Enterprise trial license

D.  

Enterprise license

A.  

MAX_TIMESTAMP_L0CKAHEAD = 5

B.  

MAX_TIMESTAMP_LOOKAHEAD - 10

C.  

MAX_TIMESTAMF_LOOKHEAD = 20

D.  

MAX TIMESTAMP LOOKAHEAD - 30

A.  

Navigate to Settings > Server Settings > General Settings, and set an App server port.

B.  

Navigate to Settings > Forwarding and receiving, and click on Enable Forwarding.

C.  

Create a server class and map it to a client inSPLUNK_HOME/etc/system/local/serverclass.conf.

D.  

Place an app in theSPLUNK_HOME/etc/deployment-appsdirectory of the deployment server.

A.  

The receiving port is not properly setup to listen on the right port.

B.  

The inputs . conf ' S _SYSZOG_ROVTING is not setup to use the right group names.

C.  

The DNS record used is not setup with a valid list of IP addresses.

D.  

The indexAndForward value is not set properly.

A.  

Heavy Forwarder

B.  

Universal Forwarder

C.  

Search head

D.  

This can only be done at the indexing layer.

A.  

props.conf

B.  

indexes.conf

C.  

inpucs.conf

D.  

transforms.conf