SPLK-1005 by Splunk Actual Free Exam Q&As

Question 1

What syntax is required in inputs.conf to ingest data from files or directories?

A. Only the monitor stanza is required to ingest data. B. A monitor stanza, sourcetype, and Index is required to ingest data. C. A monitor stanza, sourcetype, index, and host is required to ingest data. D. A monitor stanza and sourcetype is required to ingest data.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

When monitoring network inputs, there will be times when the forwarder is unable to send data to the indexers. Splunk uses a memory queue and a disk queue. Which setting is used for the disk queue?

A. maxQeueSize B. diskQiioiioiiizo C. queueSize D. persistentQueueSize

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

Which of the following is not a path used by Splunk to execute scripts?

A. SPLUNK HOME/etc/appa/<app name>/bin B. SPLUNKHOMS/ctc/scripts/local C. SPLUNK_HOME/bin/scripts D. SPLUNK_HOME/etc/system/bin

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Which of the following files is used for both search-time and index-time configuration?

A. savesearch.conf B. props.conf C. inputs.conf D. macros.conf

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

In Splunk terminology, what is an index?

A. A data repository that contains raw, uncompressed data along with tsidx files. B. A data repository that contains raw, compressed data along with tsidx files. C. A data repository that contains raw, compressed data along with psidx files. D. A data repository that contains raw, uncompressed data along with psidx files.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

Which of the following is not considered a best practice for the deployment server?

A. Create small, single-purpose deployment apps. B. Use a Linux server as the deployment server. C. Dedicate a Splunk instance as the deployment server. D. Create large, multi-purpose deployment apps.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

A. The value of the TZ attribute in props. cont for the a :ces3_ccwbined sourcetype. B. The time zone of the Heavy/Intermediate Forwarder with the monitor input. C. The value of the TZ attribute in props, conf for the my.webserver.example host. D. The time zone indicator in the raw event data.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

Which Splunk Cloud feature primarily provides centralized operational dashboards for distributed infrastructure monitoring activities?

A. Universal Forwarders synchronize indexed events and retention settings across cloud storage infrastructures automatically. B. Deployment Server permanently stores archived security logs for forensic investigations across enterprises globally. C. Search Head clustering authenticates users and distributes application packages toward enterprise endpoints continuously. D. Monitoring Console displays deployment health metrics and distributed search performance information centrally.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Splunk Cloud Certified Admin - SPLK-1005 Exam Practice Test