In preparation for the deployment of a new environment for a customer, which of the following mappings are correct per PS best practices?

• A.Option B
• B.Option D
• C.Option A
• D.Option C

Comment: *

Name: *

Email: *

Verification: *

A new single-site three indexer cluster is being stood up with replication_factor:2, search_factor:2.
At which step would the Indexer Cluster be classed as 'Indexing Ready' and be able to ingest new data?
Step 1: Install and configure Cluster Master (CM)/Master Node with base clustering stanza settings, restarting CM.
Step 2: Configure a base app in etc/master-appson the CM to enable a splunktcp input on port 9997 and deploy index creation configurations.
Step 3: Install and configure Indexer 1 so that once restarted, it contacts the CM, download the latest config bundle.
Step 4: Indexer 1 restarts and has successfully joined the cluster.
Step 5: Install and configure Indexer 2 so that once restarted, it contacts the CM, downloads the latest config bundle Step 6: Indexer 2 restarts and has successfully joined the cluster.
Step 7: Install and configure Indexer 3 so that once restarted, it contacts the CM, downloads the latest config bundle.
Step 8: Indexer 3 restarts and has successfully joined the cluster.

• A.Step 2
• B.Step 4
• C.Step 6
• D.Step 8

Comment: *

Name: *

Email: *

Verification: *

A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?

• A.Use a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.
• B.Use a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.
• C.Open a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.
• D.Open a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

Comment: *

Name: *

Email: *

Verification: *

A customer is migrating their existing Splunk Indexer from an old set of hardware to a new set of indexers. What is the earliest method to migrate the system?

• A.1. Add new indexers to the cluster as peers, to a new site. 2. Ensure new indexers receive common configuration from the CM. 3. Decommission old indexers (one at a time) to allow time for CM to fix/migrate buckets to new hardware. 4. Remove all the old indexers from the CM's list.
• B.1. Add new indexers to the cluster as peers, in the same site. 2. Update the replication factor by +1 to Instruct the cluster to start replicating to new peers. 3. Allow time for CM to fix/migrate buckets to new hardware. 4. Remove all the old indexers from the CM's list.
• C.1. Add new indexers to the cluster as peers, in the same site (if needed). 2. Ensure new indexers receive common configuration. 3. Decommission old indexers (one at a time) to allow time for CM to fix/migrate buckets to new hardware. 4. Remove all the old indexers from the CM's list.
• D.1. Add new indexers to the cluster as new site. 2. Update cluster master (CM) server.conf to include the new available site. 3. Allow time for CM to fix/migrate buckets to new hardware. 4. Remove the old indexers from the CM's list.

Comment: *

Name: *

Email: *

Verification: *

Which of the following server.conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

• A.Option D
• B.Option C
• C.Option B
• D.Option A

Comment: *

Name: *

Email: *

Verification: *