Question 1

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Accepted Answer

Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges

Question 2

In which phase of the index time process does the license metering occur?

Accepted Answer

Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

Question 3

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list –-debug. What will the output
be?

Accepted Answer

Reference: https://answers.splunk.com/answers/494219/need-help-with-what-should-be-a-simple-precedence.html

Question 4

Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

Accepted Answer

Reference: https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Forwarding/Typesofforwarders

Question 5

Within props.conf, which stanzas are valid for data modification? (Select all that apply.)

Accepted Answer

Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for-udp-514-data-sources.html

Question 6

How does the Monitoring Console monitor forwarders?

Accepted Answer

Correct answer: A

Question 7

What options are available when creating custom roles? (Select all that apply.)

Accepted Answer

Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Aboutusersandroles

Question 8

Which of the following enables compression for universal forwarders in outputs.conf?

Accepted Answer

Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Outputsconf

Question 9

How would you configure your distsearch.conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

Accepted Answer

Correct answer: D

Question 10

Local user accounts created in Splunk store passwords in which file?

Accepted Answer

Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/User-seedconf