SPLK-1003 Sample Questions & Answers

Which parent directory contains the configuration files in Splunk?

Which forwarder type can parse data prior to forwarding?

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Where should apps be located on the deployment server that the clients pull from?

This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog index=syslog Which file is now monitored?

In which phase of the index time process does the license metering occur?

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command:
splunk btool props list -debug.

What will the output be?

When running the command shown below, what is the default path in which deploymentserver.conf is created? splunk set deploy-poll deployServer:port

The priority of layered Splunk configuration files depends on the files: