SPLK-1005 Sample Questions & Answers

Network and Other Inputs · Use the HTTP Event Collector (HEC) to get data into Splunk

• A

  The microservice is sending the index and sourcetype information in the HTTP POST body instead of the event JSON object.

• B

  The developers are using incorrect field names for index and sourcetype within the JSON payload.

• C

  The HEC input is configured on the wrong port in Splunk Cloud.

• D

  The HEC token has expired, causing it to revert to default settings.

• E

  The HEC token configuration in Splunk Cloud has the 'Allow override' setting disabled.

Manipulating Raw Data · Use transformations with props.conf and transforms.conf to modify raw data

• A

  In props.conf: TRANSFORMS-ccn = mask_ccn
  In transforms.conf: [mask_ccn]
REGEX = (CCN=)\d{4}-\d{4}-\d{4}-\d{4}
FORMAT = $1XXXX-XXXX-XXXX-XXXX
DEST_KEY = MetaData:ccn

• B

  In props.conf: EVAL-ccn = replace(_raw, "CCN=\d{4}-\d{4}-\d{4}-\d{4}", "CCN=XXXX-XXXX-XXXX-XXXX")

• C

  In props.conf: TRANSFORMS-ccn = mask_ccn
  In transforms.conf: [mask_ccn]
REGEX = CCN=\d{4}-\d{4}-\d{4}-\d{4}
FORMAT = CCN=XXXX-XXXX-XXXX-XXXX
DEST_KEY = _raw

• D

  In props.conf: SEDCMD-ccn = s/CCN=\d{4}-\d{4}-\d{4}-\d{4}/CCN=XXXX-XXXX-XXXX-XXXX/g

Forwarder Management · Managing forwarders using deployment apps

• A

  The deploymentclient.conf on the clients is missing the targetUri setting.

• B

  The administrator has not reloaded the deployment server after creating the new server class.

• C

  The app being deployed is missing a local/app.conf file.

• D

  The [serverClass:linux_web_servers] stanza is missing a blacklist entry.

Index Management · Create indexes in cloud

• A

  It specifies the maximum amount of data that can be ingested into the index per day.

• B

  It defines the maximum size of a single bucket before it rolls to the next stage.

• C

  It sets the total allowable size on disk for the index, triggering data retention policies when reached.

• D

  It allocates a specific amount of memory for searches performed against this index.

Network and Other Inputs · Create a basic scripted input

[script:///opt/splunkforwarder/bin/scripts/get_metrics.sh]
interval = 300
sourcetype = custom_metrics
index = metrics
disabled = 0

• A

  The sourcetype and index parameters cannot be defined in the same stanza as the script path.

• B

  The script does not have execute permissions for the user that the Splunk forwarder service runs as.

• C

  Scripted inputs are not supported on Universal Forwarders and require a Heavy Forwarder.

• D

  The interval is set too high for a scripted input.

Getting Data in Cloud · List Splunk forwarder types

• A

  A Heavy Forwarder with a custom app that contains only an inputs.conf file.

• B

  A Heavy Forwarder using props.conf and transforms.conf to perform data masking.

• C

  A Universal Forwarder using props.conf and transforms.conf to perform data masking.

• D

  A Universal Forwarder using INGEST_EVAL in inputs.conf.

Monitor Inputs · Use optional settings for monitor inputs

• A

  To force Splunk to re-read a file from the beginning, even if it has already been indexed.

• B

  To ensure Splunk re-indexes a file if its name or path changes.

• C

  To allow Splunk to uniquely identify and track files that have the same name and size but are rotated.

• D

  To encrypt the file content before it is forwarded to the indexers.

Parsing Phase and Data Preview · Explain how timestamps and time zones are extracted or assigned to events

• A

  DATETIME_CONFIG = CURRENT

• B

  MAX_TIMESTAMP_LOOKAHEAD = 0

• C

  TZ = GMT

• D

  TIME_FORMAT = %s

Installing and Managing Apps · Describe private apps

• A

  Open a Splunk Support ticket and attach the app's .spl or .tgz file for manual installation by Splunk personnel.

• B

  Use the 'Install app from file' option in the Splunk Web UI on the search head.

• C

  Use the Admin Config Service (ACS) API to upload and install the app package directly.

• D

  Place the app package in the deployment-apps directory on a connected Deployment Server.

Splunk Configuration Files · Review configuration file precedence

• A

  App default directory (etc/apps/ /default/)

• B

  User-specific local directory (etc/users/ / /local/)

• C

  System local directory (etc/system/local/)

• D

  App local directory (etc/apps/ /local/)