How would you configure your distsearch conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

• A.option A
• B.Option B
• C.Option C
• D.Option D

Comment: *

Name: *

Email: *

Verification: *

The following stanza is active in indexes.conf:
[cat_facts]
maxHotSpanSecs = 3600
frozenTimePeriodInSecs = 2630000
maxTota1DataSizeMB = 650000
All other related indexes.conf settings are default values.
If the event timestamp was 3739283 seconds ago, will it be searchable?

• A.Yes, only if the bucket is still hot.
• B.No, because the index will have exceeded its maximum size.
• C.Yes, only if the index size is also below 650000 MB.
• D.No, because the event time is greater than the retention time.

Comment: *

Name: *

Email: *

Verification: *

Which of the following apply to how distributed search works? (select all that apply)

• A.The search head dispatches searches to the peers
• B.The search peers pull the data from the forwarders.
• C.Peers run searches in parallel and return their portion of results.
• D.The search head consolidates the individual results and prepares reports

Comment: *

Name: *

Email: *

Verification: *

What is the correct order of steps in Duo Multifactor Authentication?

• A.1. Request Login
  2. Connect to SAML server
  3 Duo MFA
  4 Create User session
  5 Authentication Granted 6. Log into Splunk
• B.1. Request Login 2 Duo MFA
  3. Authentication Granted 4 Connect to SAML server
  5. Log into Splunk
  6. Create User session
• C.1 Request Login
  2 Check authentication / group mapping
  3 Authentication Granted
  4. Duo MFA
  5. Create User session
  6. Log into Splunk
• D.1 Request Login 2 Duo MFA
  3. Check authentication / group mapping
  4 Create User session
  5. Authentication Granted
  6 Log into Splunk

Comment: *

Name: *

Email: *

Verification: *

Event processing occurs at which phase of the data pipeline?

• A.Search
• B.Indexing
• C.Parsing
• D.Input

Comment: *

Name: *

Email: *

Verification: *