NEW QUESTION 1
Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

• A. A Hadoop application can search data in Splunk.
• B. Splunk can search data in the Hadoop File System (HDFS).
• C. You can use Splunk alerts to provision actions on a third-party system.
• D. You can forward data from Splunk forwarder to a third-party system without indexing it first.

Answer: CD

NEW QUESTION 2
Which of the following commands is used to clear the KV store?

• A. splunk clean kvstore
• B. splunk clear kvstore
• C. splunk delete kvstore
• D. splunk reinitialize kvstore

Answer: A

NEW QUESTION 3
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

• A. Replace the indexer storage to solid state drives (SSD).
• B. Add more search heads and redistribute users based on the search type.
• C. Look for slow searches and reschedule them to run during an off-peak time.
• D. Add more search peers and make sure forwarders distribute data evenly across all indexers.

Answer: C

NEW QUESTION 4
Which server.conf attribute should be added to the master node's server.conf file when decommissioning a site in an indexer cluster?

• A. site_mappings
• B. available_sites
• C. site_search_factor
• D. site_replication_factor

Answer: A

NEW QUESTION 5
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

• A. btool.log
• B. metrics.log
• C. splunkd.log
• D. tailing_processor.log

Answer: C

NEW QUESTION 6
Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

• A. Adding search peers increases the maximum size of search results.
• B. Adding RAM to an existing search heads provides additional search capacity.
• C. Adding search peers increases the search throughput as search load increases.
• D. Adding search heads provides additional CPU cores to run more concurrent searches.

Answer: BD

NEW QUESTION 7
To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

• A. Indexers
• B. Forwarders
• C. Search head
• D. Cluster master

Answer: AB

NEW QUESTION 8
Which search will show all deployment client messages from the client (UF)?

• A. index=_audit component=DC* host=<ds> | stats count by message
• B. index=_audit component=DC* host=<uf> | stats count by message
• C. index=_internal component= DC* host=<uf> | stats count by message
• D. index=_internal component=DS* host=<ds> | stats count by message

Answer: D

NEW QUESTION 9
When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?

• A. Restart the search head.
• B. Run the splunk apply shcluster-bundle command from the deployer.
• C. Run the clean raft command on all members of the search head cluster.
• D. Run the splunk resync shcluster-replicated-config command on this member.

Answer: B

NEW QUESTION 10
In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

• A. SPLUNK_HOME/var/lib/searchpeers
• B. SPLUNK_HOME/var/log/searchpeers
• C. SPLUNK_HOME/var/run/searchpeers
• D. SPLUNK_HOME/var/spool/searchpeers

Answer: C

NEW QUESTION 11
When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

• A. replication_factor = 2search_factor = 2
• B. replication_factor = 2 searchfactor = 3
• C. replication_factor = 3search_factor = 2
• D. replication_factor = 3 searchfactor = 3

Answer: A

NEW QUESTION 12
Which Splunk Enterprise offering has its own license?

• A. Splunk Cloud Forwarder
• B. Splunk Heavy Forwarder
• C. Splunk Universal Forwarder
• D. Splunk Forwarder Management

Answer: C

NEW QUESTION 13
Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

• A. Use case checklist.
• B. Install Splunk apps.
• C. Inventory data sources.
• D. Review network topology.

Answer: D

NEW QUESTION 14
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

• A. Two indexers not in a cluster, assuming users run many long searches.
• B. Three indexers not in a cluster, assuming a long data retention period.
• C. Two indexers clustered, assuming high availability is the greatest priority.
• D. Two indexers clustered, assuming a high volume of saved/scheduled searches.

Answer: D

NEW QUESTION 15
What is a Splunk Job? (Select all that apply.)

• A. A user-defined Splunk capability.
• B. Searches that are subjected to some usage quota.
• C. A search process kicked off via a report or an alert.
• D. A child OS process manifested from the splunkd process.

Answer: A

NEW QUESTION 16
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

• A. Auto
• B. None
• C. True
• D. False

Answer: C

NEW QUESTION 17
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

• A. Configure syslog to send the data to multiple Splunk indexers.
• B. Use a Splunk indexer to collect a network input on port 514 directly.
• C. Use a Splunk forwarder to collect the input on port 514 and forward the data.
• D. Configure syslog to write logs and use a Splunk forwarder to collect the logs.

Answer: C

NEW QUESTION 18
How does the average run time of all searches relate to the available CPU cores on the indexers?

• A. Average run time is independent of the number of CPU cores on the indexers.
• B. Average run time decreases as the number of CPU cores on the indexers decreases.
• C. Average run time increases as the number of CPU cores on the indexers decreases.
• D. Average run time increases as the number of CPU cores on the indexers increases.

Answer: C

NEW QUESTION 19
The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

• A. rawdata is: 10%, tsidx is: 40%
• B. rawdata is: 15%, tsidx is: 35%
• C. rawdata is: 35%, tsidx is: 15%
• D. rawdata is: 40%, tsidx is: 10%

Answer: B

NEW QUESTION 20
Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

• A. REPORT
• B. LINE_BREAKER
• C. ANNOTATE_PUNCT
• D. SHOULD_LINEMERGE

Answer: BD

NEW QUESTION 21
A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering] mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements
describe this Splunk instance?
(Select all that apply.)

• A. This is a multi-site cluster.
• B. This cluster's search factor is 2.
• C. This Splunk instance needs to be restarted.
• D. This instance is missing the master_uri attribute.

Answer: AC

NEW QUESTION 22
When troubleshooting monitor inputs, which command checks the status of the tailed files?

• A. splunk cmd btool inputs list | tail
• B. splunk cmd btool check inputs layer
• C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus
• D. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus

Answer: C

NEW QUESTION 23
......