Free Splunk Enterprise Certified Admin Practice Questions

Question # 31

When enabling data integrity control, where does Splunk Enterprise store the hash files for each bucket?

Options:

Splunk Enterprise stores hash files in the logdata directory of the corresponding bucket.

Splunk Enterprise stores hash files in the rawdata directory of the corresponding bucket.

Splunk Enterprise stores hash files in the hashdata directory of the corresponding bucket.

Splunk Enterprise stores hash files in the metadata directory of the corresponding bucket.

Discussion 0

Question # 32

After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

Options:

90 days

60 days

7 days

14 days

Discussion 0

Question # 33

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Options:

Indexers

Forwarder

Search head

Search peers

Discussion 0

Question # 34

Which of the following types of data count against the license daily quota?

Options:

Replicated data

splunkd logs

Summary index data

Windows internal logs

Discussion 0

Question # 35

In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

Options:

services/ collector

services/ inputs ? raw

services/ data/ collector

data/ collector

Discussion 0

Question # 36

Immediately after installation, what will a Universal Forwarder do first?

Options:

Automatically detect any indexers in its subnet and begin routing data.

Begin generating internal Splunk logs.

Begin reading local files on its server.

Send an email to the operator that the installation process has completed.

Discussion 0

Question # 37

In this example, ifuseACKis set to true and themaxQueueSizeis set to 7MB, what is the size of the wait queue on this universal forwarder?

Options:

21MB

28MB

14MB

7MB

Discussion 0

Question # 38

Which of the following statements describes how distributed search works?

Options:

Forwarders pull data from the search peers.

Search heads store a portion of the searchable data.

The search head dispatches searches to the search peers.

Search results are replicated within the indexer cluster.

Discussion 0

Question # 39

What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Options:

Disk

CPUs

Memory

Network interface cards

Discussion 0

Question # 40

A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk. What does the administrator need to do to

ensure that the masking takes place successfully?

Options:

Make sure that props . conf and transforms . conf are both present on the in-dexer and the search head.

For source A, make sure that props . conf is in place on the indexer; and for source B, make sure transforms . conf is present on the Heavy Forwarder.

Make sure that props . conf and transforms . conf are both present on the Universal Forwarder.

Place both props . conf and transforms . conf on the Heavy Forwarder for source A, and place both props . conf and transforms . conf on the indexer for source

Discussion 0