The universal forwarder (UF) should be used whenever possible, as it is smaller and more efficient. In which of the following scenarios would a heavy forwarder (HF) be a more appropriate choice?

• A.When a predictable version of Python is required.
• B.When filtering 10%""15% of incoming events.
• C.When monitoring a log file.
• D.When running a script.

Comment: *

Name: *

Email: *

Verification: *

Which statement is correct?

• A.When trying to reduce a search result to unique elements, the dedup command is the only way to achieve this.
• B.As a streaming command, streamstats performs better than stats since stats is just a reporting command.
• C.Formatting commands such as fieldformat should occur as early as possible in the search to take full advantage of the often larger number of search peers.
• D.In general, search commands that can be distributed to the search peers should occur as early as possible in a well-tuned search.

Comment: *

Name: *

Email: *

Verification: *

The data in Splunk is now subject to auditing and compliance controls. A customer would like to ensure that at least one year of logs are retained for both Windows and Firewall events. What data retention controls must be configured?

• A.Splunk Volume and maxTotalDataSizMB
• B.Splunk Volume and frozenTimePeriodInSecs
• C.coldToFrozenDir and coldToFrozenScript
• D.maxTotalDataSizeMB and frozenTimePeriodInSecs

Comment: *

Name: *

Email: *

Verification: *

In which directory should base config app(s) be placed to initialize an indexer?

• A.$SPLUNK_HOME/etc/<app_name>
• B.$SPLUNK_HOME/etc/apps
• C.$SPLUNK_HOME/etc/slave-apps
• D.$SPLUNK_HOME/etc/system/local

Comment: *

Name: *

Email: *

Verification: *

A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

• A.The SHC will function as expected as the SHC deployer will become the new captain until the network communication is restored.
• B.The SHC will stop all scheduled search activity within the SHC.
• C.The SHC will function as expected as the minimum required number of nodes for a SHC is 3.
• D.The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.

Comment: *

Name: *

Email: *

Verification: *