Download Splunk.SPLK-1003.TestInside.2019-09-17.36q.tqb
| Vendor: | Splunk |
| Exam Code: | SPLK-1003 |
| Exam Name: | Splunk Enterprise Certified Admin |
| Date: | Sep 17, 2019 |
| File Size: | 132 KB |
Demo Questions
Question 1
Which setting in indexes.conf allows data retention to be controlled by time?
- maxDaysToKeep
- moveToFrozenAfter
- maxDataRetentionTime
- frozenTimePeriodInSecs
Correct answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/SmartStoredataretention Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/SmartStoredataretention
Question 2
The universal forwarder has which capabilities when sending data? (Select all that apply.)
- Sending alerts
- Compressing data
- Obfuscating/hiding data
- Indexer acknowledgement
Correct answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders
Question 3
In which Splunk configuration is the SEDCMD used?
- props.conf
- inputs.conf
- indexes.conf
- transforms.conf
Correct answer: A
Explanation:
Reference: https://answers.splunk.com/answers/212128/why-sedcmd-configured-in-propsconf-is-working-duri.html Reference: https://answers.splunk.com/answers/212128/why-sedcmd-configured-in-propsconf-is-working-duri.html
