SPLK-3003 Online Practice Questions and Answers

Which configuration item should be set to false to significantly improve data ingestion performance?

A. AUTO_KV_JSON

B. BREAK_ONLY_BEFORE_DATE

C. SHOULD_LINEMERGE

D. ANNOTATE_PUNCT

A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?

A. Nothing. Decommissioning a site is not possible.

B. Create an alias for where the new data should be sent.

C. Remove the site from the list of available sites.

D. Remove the site from the list of available sites and create an alias for where the new data should be sent.

The customer wants to migrate their current Splunk Index cluster to new hardware to improve indexing and search performance. What is the correct process and procedure for this task?

A. 1. Install new indexers.

2.

Configure indexers into the cluster as peers; ensure they receive the same configuration via the deployment server.

3.

Decommission old peers one at a time.

4.

Remove old peers from the CM's list.

5.

Update forwarders to forward to the new peers.

B. 1. Install new indexers.

2.

Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers.

3.

Decommission old peers one at a time.

4.

Remove old peers from the CM's list.

5.

Update forwarders to forward to the new peers.

C. 1. Install new indexers.

2.

Configure indexers into the cluster as peers; ensure they receive the same configuration via the deployment server.

3.

Update forwarders to forward to the new peers.

4.

Decommission old peers on at a time.

5.

Restart the cluster master (CM).

D. 1. Install new indexers.

2.

Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers.

3.

Update forwarders to forward to the new peers.

4.

Decommission old peers one at a time.

5.

Remove old peers from the CM's list.

The data in Splunk is now subject to auditing and compliance controls. A customer would like to ensure that at least one year of logs are retained for both Windows and Firewall events. What data retention controls must be configured?

A. maxTotalDataSizeMB and frozenTimePeriodInSecs

B. coldToFrozenDir and coldToFrozenScript

C. Splunk Volume and maxTotalDataSizMB

D. Splunk Volume and frozenTimePeriodInSecs

As a best practice which of the following should be used to ingest data on clustered indexers?

A. Monitoring (via a process), collecting data (modular inputs) from remote systems/applications

B. Modular inputs, HTTP Event Collector (HEC), inputs.conf monitor stanza

C. Actively listening on ports, monitoring (via a process), collecting data from remote systems/applications

D. splunktcp, splunktcp-ssl, HTTP Event Collector (HEC)

A customer has a number of inefficient regex replacement transforms being applied. When under heavy load the indexers are struggling to maintain the expected indexing rate. In a worst case scenario, which queue(s) would be expected to fill up?

A. Typing, merging, parsing, input

B. Parsing

C. Typing

D. Indexing, typing, merging, parsing, input

In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing configurations need to be installed for this to work?

A. All universal forwarders.

B. Only the indexers.

C. All heavy forwarders.

D. On all parsing Splunk instances.

Which command is most efficient in finding the pass4SymmKey of an index cluster?

A. find / -name server.conf -print | grep pass4SymKey

B. $SPLUNK_HOME/bin/splunk search | rest splunk_server=local /servicesNS/-/unhash_app/storage/ passwords

C. $SPLUNK_HOME/bin/splunk btool server list clustering | grep pass4SymmKey

D. $SPLUNK_HOME/bin/splunk btool clustering list clustering --debug | grep pass4SymmKey

The Splunk Validated Architectures (SVAs) document provides a series of approved Splunk topologies. Which statement accurately describes how it should be used by a customer?

A. Customer should look at the category tables, pick the highest number that their budget permits, then select this design topology as the chosen design.

B. Customers should identify their requirements, provisionally choose an approved design that meets them, then consider design principles and best practices to come to an informed design decision.

C. Using the guided requirements gathering in the SVAs document, choose a topology that suits requirements, and be sure not to deviate from the specified design.

D. Choose an SVA topology code that includes Search Head and Indexer Clustering because it offers the highest level of resilience.

Which event processing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested?

A. Merging pipeline

B. Indexing pipeline

C. Typing pipeline

D. Parsing pipeline