Splunk certified Study guides, Class notes & Summaries

Splunk Certified Admin Exam Qs & Answers (100 %Score) Latest updated 2024/2025 Comprehensive Questions and A+ Graded Answers | 100% Pass

Splunk core certified user exam questions with correct answers

A calculated field maybe based on which of the following? A. Lookup tables B. Extracted fields C. Regular expressions D. Fields generated within a search string B. Extracted fields Which are valid ways to create an event type? (select all that apply) A. By using the searchtypes command in the search bar. B. By editing the event_type stanza in the file. C. By going to the Settings menu and clicking Event Types > New. D. By selecting an event in search results and clicking Event Actio...

Splunk Validated Architectures (SVA) CORRECT ANSWER S = Single D = Distributed C = Clustered Indexer Tier M = Multi-site cluster 1 = 1SH 2 = 2 or more SH 3 = SH Cluster 4 = Stretched SHC 10+ = ES App 12 = SH + ES SH 13 = SHC + ES SHC High Availability CORRECT ANSWER IDX/SH Clustering Disaster Recovery CORRECT ANSWER Multisite clusters MC host choices CORRECT ANSWER -Stand alone server, dedicated SH. -DS with <50 clients -Deployer if NOT combined already w/ Cluster Mas...

which parent directory contains the configuration files in Splunk? $SPLUNK_HOME/etc where can scripts for scripted inputs reside on the host file system? $SPLUNK_HOME/bin/scripts $SPLUNK_HOME/etc/system/bin In which Splunk configuration is the SEDCMD used User Role inheritance allows what to be inherited? Capabilities Index Access What are the correct order of steps in Duo Multifactor Authentication? 1. request login 2.Duo MFA 3.Authentication Granted 4. Connect to SAML server 5. Log...

T/F: Machine data is always structured. - Answer- False. Machine data can be structured or unstructured. Machine data makes up for more than ___% of the data accumulated by organizations. - Answer- 90 T/F: Machine data is only generated by web servers. - Answer- False Search requests are processed by the ___________. - Answer- Indexers Search strings are sent from the _________. - Answer- Search Head In most Splunk deployments, ________ serve as the primary way data is suppli...

SPLUNK CORE CERTIFIED USER & SPLUNK FUNDAMENTALS 1 STUDY GUIDE EXAM 2023

Within , which stanzas are valid for data modification? (select all that apply) A. Host B. Server C. Source D. Sourcetype ANSWER: ACD The universal forwarder has which capabilities when sending data? A. Sending alerts B. Compressing Data C. Obfuscating/hiding data D. Indexer acknowledgement ANSWER: BD When running the command show below, what is the default path in which deployment is created?

What is the only writeable bucket type? The hot bucket By what filter are indexes divided into buckets? By time What are the 4 types of searches in Splunk (by performance) Dense, Sparse, Super Sparse, Rare In searches, what is the scanCount? The number of events scanned for that particular search What are the requirement of the underlying search in order to get multi-series table? The underlying search must use reporting search commands like chart or timechart What are the seven chart typ...

Which setting in alows data retention to be controlled by time? - Answer frozen TimePeriodInSecs What is required when adding a native user to Splunk - Answer Username Password When configuring monitoring inputs with whitelists or blacklists, what is the supported method of filtering the list? - Answer Regular Expression