When does a warm bucket roll over to a cold bucket?
Correct Answer: D
https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It always selects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage. Reference: https://community.splunk.com/t5/Deployment-Architecture/Rolling-Hot-Data-to-to-Cold-quicker /tdp/ 166653
Question 157
Which of the following are methods for adding inputs in Splunk? (select all that apply)
Correct Answer: A,B,C
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Configureyourinputs Add your data to Splunk Enterprise. With Splunk Enterprise, you can add data using Splunk Web or Splunk Apps. In addition to these methods, you also can use the following methods. -The Splunk Command Line Interface (CLI) -The inputs.conf configuration file. When you specify your inputs with Splunk Web or the CLI, the details are saved in a configuartion file on Splunk Enterprise indexer and heavy forwarder instances.
Question 158
What is the correct order of steps in Duo Multifactor Authentication?
Correct Answer: C
Using the provided DUO/Splunk reference URL https://duo.com/docs/splunk Scroll down to the Network Diagram section and note the following 6 similar steps 1 - SPlunk connection initiated 2 - Primary authentication 3 - Splunk connection established to Duo Security over TCP port 443 4 - Secondary authentication via Duo Security's service 5 - Splunk receives authentication response 6 - Splunk session logged in.
Question 159
What is the correct order of index time precedence? (For each of the following, highest precedence is shown at the top and lowest precedence is shown at the bottom)
Correct Answer: C
Splunk uses alayered configuration modelwhere settings are loaded in a specific order. This order determines which configuration takes precedence when multiple settings conflict. Atindex time(the point when data is parsed and indexed), the configuration precedence is clearly defined in the official documentation. FromSplunk Docs(props.conf precedence): Configuration file resolution order (highest to lowest precedence): * $SPLUNK_HOME/etc/users/<username>/<appname>/local * $SPLUNK_HOME/etc/apps/<appname>/local * $SPLUNK_HOME/etc/apps/<appname>/default * $SPLUNK_HOME/etc/system/local * $SPLUNK_HOME/etc/system/default However, forindex-time configurations, a slight difference applies: system/local and users/local areoften treated specially, butin practice and according to Splunk Docs, thesystem /localconfigs override apps/default, and so on. InOption C, the correct precedence fromhighest to lowestis: /etc/users/local (Highest) /etc/system/default /etc/apps/aaa/local /etc/apps/zzz/default /etc/system/local (Lowest of these listed) Though system/local typically has high precedence,when users/local is involved, that is the ultimate override. Splunk Docs confirms this in: * Configuration file precedence * Configuration layering reference Therefore, Option C reflects the correct Splunk configuration file precedence order at index time.
Question 160
Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?
Correct Answer: D
--reset Reset the fishbucket for the given key or file in the btree. Resetting the checkpoint for an active monitor input reindexes data, resulting in increased license use.