When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?

• A.All replicated copies will be rolled to frozen; original copies will remain.
• B.Replicated copies of the bucket will remain on all other indexers and the Cluster Master (CM) assigns a new primary bucket.
• C.The bucket rolls to frozen on all clustered indexers simultaneously.
• D.Nothing. Replicated copies of the bucket will remain on all other indexers until a local retention rule causes it to roll.3

Comment: *

Name: *

Email: *

Verification: *

In addition to the normal responsibilities of a search head cluster captain, which of the following is a default behavior?

• A.The captain is not a cluster member and does not perform normal search activities.
• B.The captain is a cluster member who performs normal search activities.
• C.The captain is not a cluster member but does perform normal search activities.
• D.The captain is a cluster member but does not perform normal search activities.

Comment: *

Name: *

Email: *

Verification: *

Consider the scenario where the /var/logdirectory contains the files secure, messages, cron, audit. A customer has created the following inputs.confstanzas in the same Splunk app in order to attempt to monitor the files secure and messages:

Which file(s) will actually be actively monitored?
/var/log/secure

• A./var/log/messages, /var/log/cron, /var/log/audit, /var/log/secure
• B./var/log/messages
• C.
• D./var/log/secure, /var/log/messages

Comment: *

Name: *

Email: *

Verification: *

A customer has asked for a five-node search head cluster (SHC), but does not have the storage budget to use a replication factor greater than 2. They would like to understand what might happen in terms of the users' ability to view historic scheduled search results if they log onto a search head which doesn't contain one of the 2 copies of a given search artifact.
Which of the following statements best describes what would happen in this scenario?

• A.Because the dispatch folder containing the search results is not present on the search head, the user will not be able to view the search results.
• B.The search head that the user has logged onto will proxy the required artifact over to itself from a search head that currently holds a copy. A copy will also be replicated from that search head permanently, so it is available for future use.
• C.The user will not be able to see the results of the search until one of the search heads is restarted, forcing synchronization of all dispatched artifacts across all search heads.
• D.The user will not be able to see the results of the search until the Splunk administrator issues the apply shcluster-bundle command on the search head deployer, forcing synchronization of all dispatched artifacts across all search heads.

Comment: *

Name: *

Email: *

Verification: *

A customer wants to implement LDAP because managing local Splunk users is becoming too much of an overhead. What configuration details are needed from the customer to implement LDAP authentication?

• A.LDAP server: port, bind user credentials, base DN for groups, base DN for users.
• B.API: Python script with PAM/RADIUS details.
• C.LDAP REST details, base DN for groups, base DN for users.
• D.LDAP server: port, bind user credentials, path/to/groups, path/to/user.

Comment: *

Name: *

Email: *

Verification: *