How would you configure your distsearch conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

• A.option A
• B.Option B
• C.Option C
• D.Option D

Comment: *

Name: *

Email: *

Verification: *

Which Splunk component would one use to perform line breaking prior to indexing?

• A.Heavy Forwarder
• B.Universal Forwarder
• C.Search head
• D.This can only be done at the indexing layer.

Comment: *

Name: *

Email: *

Verification: *

Which layers are involved in Splunk configuration file layering? (select all that apply)

• A.App context
• B.User context
• C.Global context
• D.Forwarder context

Comment: *

Name: *

Email: *

Verification: *

What is the command to reset the fishbucket for one source?

• A.rm -r ~/splunkforwarder/var/lib/splunk/fishbucket
• B.splunk clean eventdata -index _thefishbucket
• C.splunk cmd btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file
  <source> --reset
• D.splunk btool fishbucket reset <source>

Comment: *

Name: *

Email: *

Verification: *

What is the default value ofLINE_BREAKER?

• A.\r\n
• B.([\r\n]+)
• C.\r+\n+
• D.(\r\n+)

Comment: *

Name: *

Email: *

Verification: *