Real SPLK-1003 are Uploaded by VCEPrep provide 2021 Latest SPLK-1003 Practice Tests Dumps.
All SPLK-1003 Dumps and Splunk Enterprise Certified Admin Training Courses Help candidates to study and pass the Splunk Enterprise Certified Admin Exams hassle-free!
NEW QUESTION 24
Which of the following are supported options when configuring optional network inputs?
- A. Metadata override, sender filtering options, network input queues (quantum queues)
- B. Metadata override, sender filtering options, network input queues (memory/persistent queues)
- C. Metadata override, receiver filtering options, network input queues (memory/persistent queues)
- D. Filename override, sender filtering options, network output queues (memory/persistent queues)
Answer: C
NEW QUESTION 25
Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?
- A. transforms.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw - B. transforms.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw - C. props.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
KEY = _raw - D. props.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw
Answer: D
NEW QUESTION 26
Where can scripts for scripted inputs reside on the host file system? (select all that apply)
- A. $S?LUNK_HOME/etc/apps/<your_app>/bin_
- B. $SPLUNK_HOME/etc/system/bin
- C. $SFLUNK_HOME/bin/scripts
- D. $SPLUNK_HOME/etc/apps/bin
Answer: A,B,C
NEW QUESTION 27
Which Splunk component performs indexing and responds to search requests from the search head?
- A. License master
- B. Search peer
- C. Search head cluster
- D. Forwarder
Answer: B
Explanation:
Explanation/Reference: https://www.edureka.co/blog/splunk-architecture/
NEW QUESTION 28
Which of the following must be done to define user permissions when integrating Splunk with LDAP?
- A. Map Users
- B. Map LDAP to Active Directory
- C. Map Groups
- D. Map LDAP Inheritance
Answer: C
NEW QUESTION 29
User role inheritance allows what to be inherited from the parent role? (Select all that apply.)
- A. Search history
- B. Parents
- C. Index access
- D. Capabilities
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/ Aboutusersandroles#How_users_inherit_capabilities
NEW QUESTION 30
Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?
- A. Role inheritance
- B. Role federation
- C. Linked roles
- D. Grantable roles
Answer: A
NEW QUESTION 31
Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?
- A. Any OS platform
- B. None of the above.
- C. Linux platform only
- D. Windows platform only.
Answer: D
NEW QUESTION 32
What options are available when creating custom roles? (Choose all that apply.)
- A. Limit the number of concurrent search jobs.
- B. Restrict search terms.
- C. Whitelist search terms.
- D. Allow or restrict indexes that can be searched.
Answer: B,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Aboutusersandroles
NEW QUESTION 33
What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?
- A. REGEX, DEST. FORMAT
- B. REGEX. SRC_KEY, FORMAT
- C. REGEX, DEST_KEY FORMATTING
- D. REGEX, DEST_KEY, FORMAT
Answer: D
NEW QUESTION 34
What is the valid option for a [monitor] stanza in inputs.conf?
- A. server_name
- B. datasource
- C. enabled
- D. ignoreOlderThan
Answer: D
NEW QUESTION 35
What type of data is counted against the Enterprise license at a fixed 150 bytes per event?
- A. Internal Splunk data
- B. Metricsdata
- C. Internal Windows logs
- D. License data
Answer: B
NEW QUESTION 36
Which Splunk configuration file is used to enable data integrity checking?
- A. indexes.conf
- B. global.conf
- C. data_integrity.conf
- D. props.conf
Answer: A
NEW QUESTION 37
Which of the following apply to how distributed search works? (Select all that apply.)
- A. The search head consolidates the individual results and prepares reports.
- B. The search peers pull the data from the forwarders.
- C. Peers run searches in parallel and return their portion of results.
- D. The search head dispatches searches to the peers.
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Whatisdistributedsearch
NEW QUESTION 38
Which of the following are methods for adding inputs in Splunk? (select all that apply)
- A. CLI
- B. Editing monitor. conf
- C. Splunk Web
- D. Editing inputs. conf
Answer: A,C,D
NEW QUESTION 39
To set up a network input in Splunk, what needs to be specified?
- A. Network protocol and port number.
- B. File path.
- C. Username and password.
- D. Network protocol and MAC address.
Answer: B
Explanation:
Explanation/Reference: http://dev.splunk.com/view/dev-guide/SP-CAAAE3A
NEW QUESTION 40
Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?
- A. None of the above.
- B. Linux platform only
- C. Windows platform only.
- D. Any OS platform
Answer: D
NEW QUESTION 41
Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)
- A. Edit forwarder.conf
- B. Edit inputs . conf
- C. CLI
- D. Forwarder Management
Answer: B,C,D
NEW QUESTION 42
When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?
- A. splunk check-integrity -index <index name>
- B. Enable forwarder acknowledgment.
- C. Enable indexer acknowledgment.
- D. index=_internal component=ACK | stats count by host
Answer: C
Explanation:
Explanation
Reference https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/AboutHECIDXAck
NEW QUESTION 43
Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?
- A. Download option
- B. Upload option
- C. Monitor option
- D. Forward option
Answer: C
NEW QUESTION 44
......
Valid Way To Pass Splunk's SPLK-1003 Exam with : https://www.vceprep.com/SPLK-1003-latest-vce-prep.html
Free Test Engine For Splunk Enterprise Certified Admin Certification Exams: https://drive.google.com/open?id=1RiAlp0eWY3icd8Rdpk229NDHse3ZKygd