Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)
Correct Answer: A,D
https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge /Configureadvancedextractionswithfieldtransforms use transformations with props.conf and transforms.conf to: - Mask or delete raw data as it is being indexed -Override sourcetype or host based upon event values - Route events to specific indexes based on event content - Prevent unwanted events from being indexed
Question 57
Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?
Correct Answer: A
Question 58
You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list -debug. What will the output be?
Correct Answer: A
Question 59
Search heads in a company's European offices need to be able to search data in their New York offices. They also need to restrict access to certain indexers. What should be configured to allow this type of action?
Correct Answer: C
The correct answer is C. Distributed search is the feature that allows search heads in a company's European offices to search data in their New York offices. Distributed search also enables restricting access to certain indexers by using the splunk_server field or the server.conf file1. Distributed search is a way to scale your Splunk deployment by separating the search management and presentation layer from the indexing and search retrieval layer. With distributed search, a Splunk instance called a search head sends search requests to a group of indexers, or search peers, which perform the actual searches on their indexes. The search head then merges the results back to the user2. Distributed search has several use cases, such as horizontal scaling, access control, and managing geo-dispersed data. For example, users in different offices can search data across the enterprise or only in their local area, depending on their needs and permissions2. The other options are incorrect because: A) Indexer clustering is a feature that replicates data across a group of indexers to ensure data availability and recovery. Indexer clustering does not directly affect distributed search, although search heads can be configured to search across an indexer cluster3. B) LDAP control is a feature that allows Splunk to integrate with an external LDAP directory service for user authentication and role mapping. LDAP control does not affect distributed search, although it can be used to manage user access to data and searches. D) Search head clustering is a feature that distributes the search workload across a group of search heads that share resources, configurations, and jobs. Search head clustering does not affect distributed search, although the search heads in a cluster can search across the same set of indexers.
Question 60
Which forwarder type can parse data prior to forwarding?
Correct Answer: D
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Typesofforwarders "A heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event."
