Splunk SPLK-1005 Exam Questions

Question 6 of 60

Which of the following are valid settings for file and directory monitor inputs?

A.

host, index, source_length, _TCP_Routing, host_segment

B.

host, index, sourcetype, _TCP_Routing, host_regex, host_segment

C.

host, index, directory, host_regex, host_segment

D.

host, index, sourcetype, _UDP_Routing, host_regex, host_segment

Question 7 of 60

Which of the following are features of a managed Splunk Cloud environment?

A.

Availability of premium apps, no IP address whitelisting or blacklisting, deployed in US East AWS region.

B.

20GB daily maximum data ingestion, no SSO integration, no availability of premium apps.

C.

Availability of premium apps, SSO integration, IP address whitelisting and blacklisting.

D.

Availability of premium apps, SSO integration, maximum concurrent search limit of 20.

Question 8 of 60

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

A.

This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

B.

The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app.

C.

The configuration changes can be made using CLI, directly in configuration files, or via a deployment app.

D.

It is only possible to make this change directly in configuration files or via a deployment app.

Question 9 of 60

What does the followTail attribute do in inputs.conf?

A.

Pauses a file monitor if the queue is full.

B.

Only creates a tail checkpoint of the monitored file.

C.

Ingests a file starting with new content and then reading older events.

D.

Prevents pre-existing content in a file from being ingested.

Question 10 of 60

In case of a Change Request, which of the following should submit a support case for Splunk Support?

A.

The party requesting the change.

B.

Certified Splunk Cloud administrator.

C.

Splunk infrastructure owner.

D.

Any person with the appropriate entitlement.