Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log

• A.[monitor:///var/log/www*/secure.*]
• B.[monitor:///var/log/.../secure.*
• C.[monitor:///var/log/www1/secure.*]
• D.[monitor:///var/log/www1/secure.log]

Comment: *

Name: *

Email: *

Verification: *

What is the valid option for a [monitor] stanza in inputs.conf?

• A.server_name
• B.enabled
• C.datasource
• D.ignoreOlderThan

Comment: *

Name: *

Email: *

Verification: *

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

• A.Buy a bigger Splunk license.
• B.Add 2.5 TB each day for the next 5 days.
• C.Add all 10 TB in a single 24 hour period.
• D.Add 200 GB of historical data each day for 50 days.

Comment: *

Name: *

Email: *

Verification: *

Which Splunk component does a search head primarily communicate with?

• A.Cluster master
• B.Indexer
• C.Forwarder
• D.Deployment server

Comment: *

Name: *

Email: *

Verification: *

Which forwarder type can parse data prior to forwarding?

• A.Universal forwarder
• B.Heaviest forwarder
• C.Hyper forwarder
• D.Heavy forwarder

Comment: *

Name: *

Email: *

Verification: *