Splunk certifi Study guides, Class notes & Summaries

Which setting in allows data retention to be controlled by time? A. maxDaysToKeep B. moveToFrozenAfter C. maxDataRetentionTime D. frozenTimePeriodInSecs CORRECT ANSWER D. frozenTimePeriodInSecs Reference: The universal forwarder has which capabilities when sending data? (Choose all that apply.) A. Sending alerts B. Compressing data C. Obfuscating/hiding data D. Indexer acknowledgement CORRECT ANSWER B. Compressing data D. Indexer acknowledgement In case of conflict betw...

which parent directory contains the configuration files in Splunk? CORRECT ANSWER $SPLUNK_HOME/etc where can scripts for scripted inputs reside on the host file system? CORRECT ANSWER $SPLUNK_HOME/bin/scripts $SPLUNK_HOME/etc/system/bin In which Splunk configuration is the SEDCMD used CORRECT ANSWER User Role inheritance allows what to be inherited? CORRECT ANSWER Capabilities Index Access What are the correct order of steps in Duo Multifactor Authentication? CORRECT ANSWER 1. req...

A calculated field maybe based on which of the following? A. Lookup tables B. Extracted fields C. Regular expressions D. Fields generated within a search string CORRECT ANSWER B. Extracted fields Which are valid ways to create an event type? (select all that apply) A. By using the searchtypes command in the search bar. B. By editing the event_type stanza in the file. C. By going to the Settings menu and clicking Event Types > New. D. By selecting an event in search results and cli...

Within , which stanzas are valid for data modification? (select all that apply) A. Host B. Server C. Source D. Sourcetype CORRECT ANSWER ANSWER: ACD The universal forwarder has which capabilities when sending data? A. Sending alerts B. Compressing Data C. Obfuscating/hiding data D. Indexer acknowledgement CORRECT ANSWER ANSWER: BD When running the command show below, what is the default path in which deployment is created? splunk set deploy-poll deployServer:port A. SP...

Splunk Core Certified User & Splunk Fundamentals 1 Questions with 100% Correct Answers | Latest Version 2024 | Expert Verified | Ace the Test

Splunk Core Certified User & Splunk Fundamentals 1 Questions with 100% Correct Answers | Latest Version 2024 | Expert Verified | Ace the Test

_________ define what users can do in Splunk. - Roles _____________ are reports gathered together into a single pane of glass. - Dashboards A search job will remain active for _____ minutes after it is run. - 10 Adding child data model objects is like the ______ operator in the Splunk search language. A) NOT B) AND C) OR - AND Admins can change the lookup case_sensitive_match option to false in which file? - All of Splunk's configurations are written within what file type? - Plain tex...

What is the only writeable bucket type? hot bucket warm bucket cold bucket CORRECT ANSWER The hot bucket By what filter are indexes divided into buckets? by time by name by source by host CORRECT ANSWER By time What are the 4 types of searches in Splunk (by performance) dense sparse super sparse rare super rare CORRECT ANSWER Dense, Sparse, Super Sparse, Rare In searches, what is the scanCount? the number of scanned events for all searches the number of events scanned for...

List Splunk forwarder types - - The universal forwarder contains only the components that are necessary to forward data - A heavy forwarder is a full Splunk Enterprise instance that can index, search, and change data as well as forward it. The heavy forwarder has some features disabled to reduce system resource usage. Describe the role of forwarders - Forwarders represent a much more robust solution for data forwarding than raw network feeds, with their capabilities for: - Tagging of metad...