SPLK-1003 Multiple Select — 10 Questions

Question 1

Which TWO actions should be taken before manually moving an index to a new storage volume?

Accepted Answer

Verify the file system permissions of the new path.. You must stop the Splunk service and ensure the filesystem permissions are correct for the new directory.

Answer

Modify the indexes.conf file.

Answer

Clear the license master cache.

Answer

Delete the existing index.

Question 2

Which TWO of the following are valid ways to define field extractions?

Accepted Answer

Using the EXTRACT- prefix in props.conf. Field extractions can be defined using inline regex in props.conf or via transforms.conf.

Answer

Directly in inputs.conf

Answer

Using the INDEXED-EXTRACTION attribute in transforms.conf

Answer

Using a CSV file in etc/system/local

Question 3

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. The forwarder handshakes, downloads app bundles, and restarts/reloads as configured.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 4

Which THREE of the following are true regarding license usage monitoring?

Accepted Answer

Usage can be viewed via the Splunk Web UI.. Monitoring can be done via the UI, the REST API, or by querying internal logs.

Answer

Usage must be calculated manually from event count.

Answer

License usage is only available to the splunk-system-user.

Question 5

Which TWO of the following are true about the 72-hour grace period?

Accepted Answer

It disables indexing after 72 hours.. The 72-hour grace period applies when a slave cannot reach the master; it is not a violation in the 30-day window sense.

Answer

It allows the admin to search during the period.

Answer

It only applies to trial licenses.

Answer

It counts as a license violation.

Question 6

Which THREE of the following items are considered 'license slaves'?

Accepted Answer

Standalone instances. Only indexers and search heads (that perform indexing) are typically categorized as slaves in this context; heavy forwarders are not.

Answer

Universal Forwarders

Answer

Deployment Servers

Question 7

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Universal forwarders perform no parsing and have a minimal footprint.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 8

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Monitoring can be done via the CLI 'splunk status' or the Monitoring Console in the GUI.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 9

Which TWO of the following actions occur when a Splunk license violation is active?

Accepted Answer

Splunk continues to index data.. During a violation, indexing continues, but the ability to perform searches is impacted according to the rules of the violation.

Answer

All user accounts are locked.

Answer

Data ingestion is blocked immediately.

Answer

The license key is automatically deleted.

Question 10

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. btool is a utility for viewing, checking, and debugging configuration files.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service