Monitoring Console (MC) health check configuration items are stored in which configuration file?

• A.healthcheck.conf
• B.alert_actions.conf
• C.distsearch.conf
• D.checklist.conf

Comment: *

Name: *

Email: *

Verification: *

Data can be onboarded using apps, Splunk Web, or the CLI.
Which is the PS preferred method?

• A.Use the add data wizard in Splunk Web.
• B.Use a scripted input to monitor a log file.
• C.Create UDP input port 9997 on a UF.
• D.Use the inputs.conf file.

Comment: *

Name: *

Email: *

Verification: *

The customer wants to migrate their current Splunk Index cluster to new hardware to improve indexing and search performance. What is the correct process and procedure for this task?

• A.1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the same configuration via the deployment server. 3. Update forwarders to forward to the new peers.
  4. Decommission old peers on at a time. 5. Restart the cluster master (CM).
• B.1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers. 3. Decommission old peers one at a time. 4. Remove old peers from the CM's list. 5. Update forwarders to forward to the new peers.
• C.1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the same configuration via the deployment server. 3. Decommission old peers one at a time. 4.
  Remove old peers from the CM's list. 5. Update forwarders to forward to the new peers.
• D.1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers. 3. Update forwarders to forward to the new peers. 4. Decommission old peers one at a time. 5. Remove old peers from the CM's list.

Comment: *

Name: *

Email: *

Verification: *

What happens when an index cluster peer freezes a bucket?

• A.All indexers with a copy of the bucket will delete it.
• B.The cluster master will ensure another copy of the bucket is made on the other peers to meet the replication settings.
• C.The cluster master will no longer perform fix-up activities for the bucket.
• D.All indexers with a copy of the bucket will immediately roll it to frozen.

Comment: *

Name: *

Email: *

Verification: *

A customer would like to remove the output_file capability from users with the default user role to stop them from filling up the disk on the search head with lookup files. What is the best way to remove this capability from users?

• A.Create a new role without the output_file capability that inherits the default user role and assign it to the users.
• B.Create a new role with the output_file capability that inherits the default user role and assign it to the users.
• C.Edit the default user role and remove the output_file capability.
• D.Clone the default user role, remove the output_file capability, and assign it to the users.

Comment: *

Name: *

Email: *

Verification: *