SPLK-1003 Practice Test 6 — 10 Questions

Question 1

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 2

Which TWO of the following are valid stanza types found in indexes.conf?

Accepted Answer

[default]. indexes.conf uses index names as stanzas, and [default] for global settings.

Answer

[tcpout]

Answer

[input]

Answer

[source::...]

Question 3

Which TWO settings are required to enable cold-to-frozen archiving?

Accepted Answer

coldToFrozenDir. To enable archiving, you must define the coldToFrozenScript and ensure the path for frozen data exists.

Answer

frozenPath

Answer

maxFrozenSize

Answer

enableArchive = true

Question 4

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 5

Which user interface feature allows you to view the connectivity status of all forwarders reporting to an Indexer?

Accepted Answer

Forwarder Management. The Forwarder Management dashboard provides a high-level view of connected forwarders.

Answer

License Manager

Answer

Data Inputs

Answer

Indexes

Question 6

Which license type does not support license clustering?

Accepted Answer

Free License. The Free license is a standalone, single-instance license and does not support clustering or license pools.

Answer

Enterprise License

Answer

Trial License

Answer

Developer License

Question 7

When setting up a License Master in a distributed environment, what is the recommended practice for the License Master role?

Accepted Answer

Dedicate an instance to act as the License Master.. The License Master should be a dedicated instance (or a primary instance) to ensure license availability and accurate reporting.

Answer

Co-locate it with a Search Head.

Answer

Co-locate it with a heavy forwarder.

Answer

Assign it to a standalone Indexer.

Question 8

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 9

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 10

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local