During search time, which directory of configuration files has the highest precedence?

• A.$SFLUNK_KOME/etc/system/local
• B.$SPLUNK HCME/etc/users/admin/local
• C.$SPLUNK_HCME/etc/apps/app1/local
• D.$SPLUNK_KCME/etc/system/default

Comment: *

Name: *

Email: *

Verification: *

Which of the following apply to how distributed search works? (select all that apply)

• A.The search peers pull the data from the forwarders.
• B.Peers run searches in parallel and return their portion of results.
• C.The search head dispatches searches to the peers
• D.The search head consolidates the individual results and prepares reports

Comment: *

Name: *

Email: *

Verification: *

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

• A.Blacklist
• B.Whitelist
• C.They cancel each other out.
• D.Whichever is entered into the configuration first.

Comment: *

Name: *

Email: *

Verification: *

Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

• A.splunk btool indexes list --debug
• B.splunk btool server list --debug
• C.splunk list forward-indexer
• D.splunk list forward-server

Comment: *

Name: *

Email: *

Verification: *

When are knowledge bundles distributed to search peers?

• A.After a user logs in.
• B.When Splunk is restarted.
• C.When adding a new search peer.
• D.When a distributed search is initiated.

Comment: *

Name: *

Email: *

Verification: *