Splunk Admin Basics

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

What is the default port used by the Splunk Web interface?

An administrator needs to change the default maximum size of an index. Which file should be modified?

Which of the following is a valid method to restart the Splunk service on a Linux system?

Where are the local configuration files for an installed app located?

Which Splunk component is primarily responsible for parsing and indexing incoming data streams?

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

Which THREE of the following configurations can be performed in props.conf?

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

Which Splunk process is responsible for the actual indexing of data on the indexer?

You need to ensure that specific data is retained for 365 days. Which parameter in indexes.conf controls this?

Which TWO of the following directories are used to store Splunk configuration files?

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?

Which THREE of the following are components of a standard Splunk architecture?

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Which TWO of the following settings are typically found in inputs.conf?

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

An administrator needs to increase the number of search results displayed in a dashboard panel. Where can this limit be adjusted?

Which TWO of the following are true regarding the Deployment Server?

Which THREE of the following items are considered Knowledge Objects in Splunk?

What is the primary function of the 'Indexer Cluster' feature?

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Which TWO of the following are true about the Universal Forwarder?

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

Which TWO of the following are true regarding Indexer Clustering?

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?