Which of the following is a way to exclude search artifacts when creating a diag?

• A.SPLUNK_HOME/bin/splunk diag --exclude
• B.SPLUNK_HOME/bin/splunk diag --debug --refresh
• C.SPLUNK_HOME/bin/splunk diag --disable=dispatch
• D.SPLUNK_HOME/bin/splunk diag --filter-searchstrings

Comment: *

Name: *

Email: *

Verification: *

When should multiple search pipelines be enabled?

• A.Only if disk IOPS is at 800 or better.
• B.Only if there are fewer than twelve concurrent users.
• C.Only if running Splunk Enterprise version 6.6 or later.
• D.Only if CPU and memory resources are significantly under-utilized.

Comment: *

Name: *

Email: *

Verification: *

As a best practice, where should the internal licensing logs be stored?

• A.License server.
• B.Deployment layer.
• C.Search head layer.
• D.Indexing layer.

Comment: *

Name: *

Email: *

Verification: *

What does setting site=site0on all Search Head Cluster members do in a multi-site indexer cluster?

• A.Disables search site affinity.
• B.Sets all members to dynamic captaincy.
• C.Enables multisite search artifact replication.
• D.Enables automatic search site affinity discovery.

Comment: *

Name: *

Email: *

Verification: *

Which of the following should be included in a deployment plan?

• A.A comprehensive list of stakeholders, either direct or indirect.
• B.Current and future topology diagrams of the IT environment.
• C.Current logging details and data source inventory.
• D.Business continuity and disaster recovery plans.

Comment: *

Name: *

Email: *

Verification: *