Weekend Special Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: scxmas70

SPLK-1003 Exam Dumps - Splunk Enterprise Certified Admin

Go to page:
Question # 25

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user’s local context to disable the field aliases?

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Full Access
Question # 26

What options are available when creating custom roles? (select all that apply)

A.

Restrict search terms

B.

Whitelist search terms

C.

Limit the number of concurrent search jobs

D.

Allow or restrict indexes that can be searched.

Full Access
Question # 27

When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?

A.

Default app

B.

LDAP group

C.

Password

D.

Username

Full Access
Question # 28

Which of the following types of data count against the license daily quota?

A.

Replicated data

B.

splunkd logs

C.

Summary index data

D.

Windows internal logs

Full Access
Question # 29

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

A.

License data

B.

Metricsdata

C.

Internal Splunk data

D.

Internal Windows logs

Full Access
Question # 30

On the deployment server, administrators can map clients to server classes using client filters. Which of the

following statements is accurate?

A.

The blacklist takes precedence over the whitelist.

B.

The whitelist takes precedence over the blacklist.

C.

Wildcards are not supported in any client filters.

D.

Machine type filters are applied before the whitelist and blacklist.

Full Access
Question # 31

This file has been manually created on a universal forwarder

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new

Which file is now monitored?

A.

/var/log/messages

B.

/var/log/maillog

C.

/var/log/maillog and /var/log/messages

D.

none of the above

Full Access
Question # 32

The CLI command splunk add forward-server indexer: will create stanza(s) in

which configuration file?

A.

inputs.conf

B.

indexes.conf

C.

outputs.conf

D.

servers.conf

Full Access
Go to page: