Splunk Admin Basics

Which Splunk component is primarily responsible for parsing and indexing incoming data streams?

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

An administrator needs to change the default maximum size of an index. Which file should be modified?

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

Which of the following is a valid method to restart the Splunk service on a Linux system?

What is the default port used by the Splunk Web interface?

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Which Splunk process is responsible for the actual indexing of data on the indexer?

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Where are the local configuration files for an installed app located?

What is the primary function of the 'Indexer Cluster' feature?

Which TWO of the following are true about the Universal Forwarder?

An administrator needs to increase the number of search results displayed in a dashboard panel. Where can this limit be adjusted?

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Which TWO of the following directories are used to store Splunk configuration files?

You need to ensure that specific data is retained for 365 days. Which parameter in indexes.conf controls this?

Which THREE of the following are components of a standard Splunk architecture?

Which TWO of the following are true regarding the Deployment Server?

Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Which THREE of the following configurations can be performed in props.conf?

Which TWO of the following are true regarding Indexer Clustering?

Which TWO of the following settings are typically found in inputs.conf?

Which THREE of the following items are considered Knowledge Objects in Splunk?