Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

• A.Indexers
• B.Forwarder
• C.Search head
• D.Search peers

Comment: *

Name: *

Email: *

Verification: *

Which of the following are reasons to create separate indexes? (Choose all that apply.)

• A.Increase number of users.
• B.File organization.
• C.Restrict user permissions.
• D.Different retention times.

Comment: *

Name: *

Email: *

Verification: *

What is the valid option for a [monitor] stanza in inputs.conf?

• A.enabled
• B.datasource
• C.server_name
• D.ignoreOlderThan

Comment: *

Name: *

Email: *

Verification: *

A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk.
What does the administrator need to do to ensure that the masking takes place successfully?

• A.Place both props . conf and transforms . conf on the Heavy Forwarder for source A, and place both props . conf and transforms . conf on the indexer for source B.
• B.Make sure that props . conf and transforms . conf are both present on the Universal Forwarder.
• C.For source A, make sure that props . conf is in place on the indexer; and for source B, make sure transforms . conf is present on the Heavy Forwarder.
• D.Make sure that props . conf and transforms . conf are both present on the in-dexer and the search head.

Comment: *

Name: *

Email: *

Verification: *

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

• A.App Class
• B.Client Class
• C.Server Class
• D.Forwarder Class

Comment: *

Name: *

Email: *

Verification: *