SPLK-1003 Exam - Free Splunk Questions and Answers

Question #11 (Topic: Single Topic)

This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog
A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog
Which file is now monitored?

A. /var/log/messages B. /var/log/maillog C. /var/log/maillog and /var/log/messages D. none of the above

Answer: B

Question #12 (Topic: Single Topic)

In which phase of the index time process does the license metering occur?

A. Input phase B. Parsing phase C. Indexing phase D. Licensing phase

Answer: C

Question #13 (Topic: Single Topic)

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will
the output be?

A. A list of all the configurations on-disk that Splunk contains. B. A verbose list of all configurations as they were when splunkd started. C. A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located. D. A list of the current running props.conf configurations along with a file path from which the configuration was made.

Answer: C

Question #14 (Topic: Single Topic)

When running the command shown below, what is the default path in which deploymentserver.conf is created?
splunk set deploy-poll deployServer:port

A. SPLUNK_HOME/etc/deployment B. SPLUNK_HOME/etc/system/local C. SPLUNK_HOME/etc/system/default D. SPLUNK_HOME/etc/apps/deployment

Answer: B

Question #15 (Topic: Single Topic)

The priority of layered Splunk configuration files depends on the file's:

A. Owner B. Weight C. Context D. Creation time

Answer: C

Splunk SPLK-1003 - Splunk Enterprise Certified Admin Exam