Free Splunk SPLK-1003 Exam Dumps Questions & Answers

Which of the following is a valid distributed search group?

• A.[searchGroup:Paris] default = false servers = server1:9997, server2:9997
• B.[searchGroup:Paris] default = false servers = server1:8089, server2:8089
• C.[distributedSearch:Paris] default = false servers = server1:8089; server2:8089
• D.[distributedSearch:Paris] default = false servers = server1, server2

There is a file with a vast amount of old data. Which of the following inputs.conf attributes would allow an admin to monitor the file for updates without indexing the pre-existing data?

• A.followTail
• B.monitor
• C.IgnoreOlderThan
• D.allowList

What is the default purpose of a Splunk Deployment Server ?

• A.To stage and deploy updates to /etc/deployment-apps/
• B.To stage and deploy updates to /etc/manager-apps/
• C.To stage and deploy updates to /etc/pcer-apps/
• D.To stage and deploy updates to $SPLUNK_HOME/etc/apps/

A request has been made to restrict lookup files up to 500 megabytes for replication . Anything larger should not be replicated . Which of the following parameters provides the correct control for this scenario?

• A.excludeReplicatedLookupSize
• B.maxMemoryBundleSize
• C.includeReplicatedLookupSize
• D.maxBundleSize

What is the valid option for a [monitor] stanza in inputs.conf?

• A.ignoreOlderThan
• B.enabled
• C.datasource
• D.server_name