2022 Actual4Labs Splunk SPLK-1003 Dumps and Exam Test Engine
Splunk SPLK-1003 DUMPS WITH REAL EXAM QUESTIONS
NEW QUESTION 57
Which of the following statements accurately describes using SSL to secure the feed from a forwarder?
- A. It requires that the forwarder be set to compressed=true.
- B. SSL automatically compresses the feed by default.
- C. It does not encrypt the certificate password.
- D. It requires that the receiver be set to compression=true.
Answer: C
NEW QUESTION 58
Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)
- A. CLI
- B. Edit forwarder.conf
- C. Forwarder Management
- D. Edit inputs.conf
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/Configuretheuniversalforwarder
NEW QUESTION 59
To set up a Network input in Splunk, what needs to be specified'?
- A. Network protocol and MAC address.
- B. Username and password
- C. Network protocol and port number.
- D. File path.
Answer: C
NEW QUESTION 60
The universal forwarder has which capabilities when sending data? (select all that apply)
- A. Sending alerts
- B. Obfuscating/hiding data
- C. Compressing data
- D. Indexer acknowledgement
Answer: C,D
NEW QUESTION 61
The LINE_BREAKER attribute is configured in which configuration file?
- A. transforms.conf
- B. props.conf
- C. indexes.conf
- D. inpucs.conf
Answer: B
NEW QUESTION 62
You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command:
splunk btoo1 props list -debug. What will the output be?
- A. A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located
- B. A verbose list of all configurations as they were when splunkd started.
- C. A list of the current running props, conf configurations along with a file path from which the configuration was made
- D. list of all the configurations on-disk that Splunk contains.
Answer: A
NEW QUESTION 63
What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?
- A. REGEX, DEST. FORMAT
- B. REGEX, DEST_KEY, FORMAT
- C. REGEX, DEST_KEY FORMATTING
- D. REGEX. SRC_KEY, FORMAT
Answer: B
NEW QUESTION 64
Which of the following enables compression for universal forwarders in outputs.conf?
- A.
- B. [tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false
- C. [udpout:mysplunk_indexer11]
compression=true
[tcpout] - D. defaultGroup=my_indexers
compressed=true
/opt/splunkforwarder/bin/splunk enable compression
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Outputsconf
NEW QUESTION 65
Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?
- A. Any OS platform
- B. Linux platform only
- C. None of the above.
- D. Windows platform only.
Answer: A
NEW QUESTION 66
How can native authentication be disabled in Splunk?
- A. Remove the $SPLUNK_HOME/etc/passwdfile
- B. Create an empty $SPLUNK_HOME/etc/passwdfile
- C. Set nativeAuthentication=falsein authentication.conf
- D. Set SPLUNK_AUTHENTICATION=falsein splunk-launch.conf
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Secureyouradminaccount
NEW QUESTION 67
What are the required stanza attributes when configuring the transforms.confto manipulate or remove events?
- A. REGEX, SRC_KEY, FORMAT
- B. REGEX, DEST, FORMAT
- C. REGEX, DEST_KEY, FORMATTING
- D. REGEX, DEST_KEY, FORMAT
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf
NEW QUESTION 68
Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)
- A. rawdata.conf
- B. inputs.conf
- C. transforms.conf
- D. props.conf
Answer: D
NEW QUESTION 69
Which valid bucket types are searchable? (select all that apply)
- A. Warm buckets
- B. Hot buckets
- C. Cold buckets
- D. Frozen buckets
Answer: A,B,C
NEW QUESTION 70
This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog
A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conffile:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog
Which file is now monitored?
/var/log/messages
- A. /var/log/maillogand /var/log/messages
- B.
- C. /var/log/maillog
- D. none of the above
Answer: A
NEW QUESTION 71
What options are available when creating custom roles? (select all that apply)
- A. Allow or restrict indexes that can be searched.
- B. Whitelist search terms
- C. Restrict search terms
- D. Limit the number of concurrent search jobs
Answer: A
NEW QUESTION 72
Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
- A. CLI
- B. Edit forwarder.conf
- C. Forwarder Management
- D. Edit inputs.conf
Answer: A,D
Explanation:
Explanation
Explanation/Reference:
https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/HowtoforwarddatatoSplunkEnterprise#Define_inputs_on_the_universal_forwarder_with_configuration_files
NEW QUESTION 73
Which of the following is a benefit of distributed search?
- A. Peers run search in parallel.
- B. Resilience from search head failure.
- C. Peers run search in sequence.
- D. Resilience from indexer failure.
Answer: B
NEW QUESTION 74
What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?
- A. host=server1
index=unixinfo - B. host=searchsvr1
index=searchinfo - C. host=unixsvr1
index=unixinfo - D. host=server1
index=searchinfo
Answer: C
NEW QUESTION 75
Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)
- A. inputs.conf
- B. monitor.conf
- C. forwarder.conf
- D. outputs.conf
Answer: A,D
NEW QUESTION 76
Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?
props.conf
- A. [mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
KEY = _raw
props.conf - B. [mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw - C. [mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw
transforms.conf - D. [mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw
transforms.conf
Answer: C
Explanation:
Explanation/Reference: https://community.splunk.com/t5/Archive/How-to-mask-SSN-into-our-logs-going-into-Splunk/td- p/433035
NEW QUESTION 77
For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGEto what value?
- A. <regex string>
- B. True
- C. False
- D. Newline Character
Answer: C
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/704533/what-are-the-best-practices-for-defining-source- ty.html
NEW QUESTION 78
Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
- A. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g
- B. SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g
- C. SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g
- D. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g
Answer: A
NEW QUESTION 79
Which of the following statements describe deployment management? (select all that apply)
- A. Is responsible for sending apps to forwarders.
- B. Once used, is the only way to manage forwarders
- C. Can automatically restart the host OS running the forwarder.
- D. Requires an Enterprise license
Answer: D
NEW QUESTION 80
Which setting in indexes. conf allows data retention to be controlled by time?
- A. maxDaysToKeep
- B. maxDataRetentionTime
- C. frozenTimePeriodlnSecs
- D. moveToFrozenAfter
Answer: C
NEW QUESTION 81
Which Splunk component requires a Forwarder license?
- A. Universal forwarder
- B. Heavy forwarder
- C. Heaviest forwarder
- D. Search head
Answer: A
NEW QUESTION 82
......
2022 New Actual4Labs SPLK-1003 PDF Recently Updated Questions: https://www.actual4labs.com/Splunk/SPLK-1003-actual-exam-dumps.html
SPLK-1003 Exam with Guarantee Updated 122 Questions: https://drive.google.com/open?id=12TY3hHAmz7EuEickPIt5tqY3FtcwHo8s