SPLK-1003 Free Practice Test

Within props.conf, which stanzas are valid for data modification? (Select all that apply.)

1. A. Host
2. B. Server
3. C. Source
4. D. Sourcetype

Correct Answer: CD
Reference: https://answers.splunk.com/answers/3687/host-stanza-in-props-conf-not-being-honored-for-udp-514-data-sources.html

Which of the following is a valid distributed search group?

1. A. [distributedSearch:Paris] default = false servers = server1, server2
2. B. [searchGroup:Paris] default = false servers = server1:8089, server2:8089
3. C. [searchGroup:Paris] default = false servers = server1:9997, server2:9997
4. D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089

Correct Answer: D
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Distributedsearchgroups

To set up a network input in Splunk, what needs to be specified?

1. A. File path.
2. B. Username and password.
3. C. Network protocol and port number.
4. D. Network protocol and MAC address.

Correct Answer: A
Reference: http://dev.splunk.com/view/dev -guide/SP-CAAAE3A

In which phase of the index time process does the license metering occur?

1. A. Input phase
2. B. Parsing phase
3. C. Indexing phase
4. D. Licensing phase

Correct Answer: C
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

1. A. REGEX, DEST, FORMAT
2. B. REGEX, SRC_KEY, FORMAT
3. C. REGEX, DEST_KEY, FORMAT
4. D. REGEX, DEST_KEY, FORMATTING

Correct Answer: C
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf