What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?
Correct Answer: B
https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture Scroll down to section titled, How the cluster handles concurrent search quotas, "Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_Searches_per_cpu and related settings in limits.conf."
Question 177
Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?
Correct Answer: C
The correct answer is C. MonitorNoHandle. MonitorNoHandle is a type of input stanza that allows a Splunk forwarder to read files on Windows systems as Windows writes to them. It does this by using a kernel-mode filter driver to capture raw data as it gets written to the file1. This input stanza is useful for files that get locked open for writing, such as the Windows DNS server log file2. The other options are incorrect because: A: Tail Reader is not a valid input stanza in Splunk. It is a component of the Tailing Processor, which is responsible for monitoring files and directories for new data3. B: Upload is a type of input stanza that allows Splunk to index a single file from a local or network file system. It is not suitable for files that are constantly being updated, as it only indexes the file once and does not monitor it for changes4. D: Monitor is a type of input stanza that allows Splunk to monitor files and directories for new data. However, it may not work for files that Windows prevents Splunk from reading while they are open. In such cases, MonitorNoHandle is a better option2. A Splunk forwarder is a lightweight agent that can forward data to a Splunk deployment. There are two types of forwarders: universal and heavy. A universal forwarder can only forward data, while a heavy forwarder can also perform parsing, filtering, routing, and aggregation on the data before forwarding it5. An input stanza is a section in the inputs.conf configuration file that defines the settings for a specific type of input, such as files, directories, network ports, scripts, or Windows event logs. An input stanza starts with a square bracket, followed by the input type and the input path or name. For example, [monitor:///var/log] is an input stanza for monitoring the /var/log directory. References: 1: Monitor files and directories - Splunk Documentation 2: How to configure props.conf for proper line breaking ... - Splunk Community 3: How Splunk Enterprise monitors files and directories - Splunk Documentation 4: Upload a file - Splunk Documentation 5: Use forwarders to get data into Splunk Enterprise - Splunk Documentation 6: inputs.conf - Splunk Documentation
Question 178
Which authentication methods are natively supported within Splunk Enterprise? (select all that apply)
Correct Answer: A,B,C
Reference: Splunk authentication: Provides Admin, Power and User by default, and you can define your own roles using a list of capabilities. If you have an Enterprise license, Splunk authentication is enabled by default. See Set up user authentication with Splunk's built-in system for more information. LDAP: Splunk Enterprise supports authentication with its internal authentication services or your existing LDAP server. See Set up user authentication with LDAP for more information. Scripted authentication API: Use scripted authentication to integrate Splunk authentication with an external authentication system, such as RADIUS or PAM. See Set up user authentication with external systems for more information. Note: Authentication, including native authentication, LDAP, and scripted authentication, is not available in Splunk Free.
Question 179
Which parent directory contains the configuration files in Splunk?
Correct Answer: A
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Configurationfiledirectories Section titled, Configuration file directories, states "A detailed list of settings for each configuration file is provided in the .spec file names for that configuration file. You can find the latest version of the .spec and . example files in the $SPLUNK_HOME/etc system/README folder of your Splunk Enterprise installation..."
Question 180
Which setting in indexes. conf allows data retention to be controlled by time?
