An admin oversees an environment with a 1000 GBI day license. The configuration file server.conf has strict pool quota=false set. The license is divided into the following three pools, and today's usage is shown on the right-hand column:
Pool License Size Today's usage
X 500 GB/day 100 GB
Y 350 GB/day 400 GB
Z 150 GB/day 300 GB
Given this, which pool(s) are issued warnings?

• A.All pools
• B.Z only
• C.None
• D.Y and Z

Comment: *

Name: *

Email: *

Verification: *

When running a real-time search, search results are pulled from which Splunk component?

• A.Search heads
• B.Heavy forwarders and search peers
• C.Heavy forwarders
• D.Search peers

Comment: *

Name: *

Email: *

Verification: *

In which phase of the index time process does the license metering occur?

• A.Input phase
• B.Parsing phase
• C.Indexing phase
• D.Licensing phase

Comment: *

Name: *

Email: *

Verification: *

Local user accounts created in Splunk store passwords in which file?

• A.$ SPLUNK HCME/etc/users/authentication.conf
• B.$ SFLUNK_KOME/etc/passwd
• C.$ SFLUNK_KCME/etc/authentication
• D.$ S?LUNK_HCME/etc/users/passwd.conf

Comment: *

Name: *

Email: *

Verification: *

This file has been manually created on a universal forwarder

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new

Which file is now monitored?

• A.none of the above
• B./var/log/maillog
• C./var/log/maillog and /var/log/messages
• D./var/log/messages

Comment: *

Name: *

Email: *

Verification: *