Question 1

Which of the following statements describe deployment management? (select all that apply)

Options :

A : Requires an Enterprise license

B : Is responsible for sending apps to forwarders.

C : Once used, is the only way to manage forwarders

D : Can automatically restart the host OS running the forwarder.

Answer: A,B

Question 2

When are knowledge bundles distributed to search peers?

Options :

A : After a user logs in.

B : When Splunk is restarted.

C : When adding a new search peer.

D : When a distributed search is initiated.

Answer: D

Question 3

What conf file needs to be edited to set up distributed search groups?

Options :

A : props.conf

B : search.conf

C : distsearch.conf

D : distibutedsearch.conf

Answer: C

Question 4

Which of the following are supported options when configuring optional network inputs?

Options :

A : Metadata override, sender filtering options, network input queues (quantum queues)

B : Metadata override, sender filtering options, network input queues (memory/persistent queues)

C : Filename override, sender filtering options, network output queues (memory/persistent queues)

D : Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Answer: B

Question 5

In inputs. conf, which stanza would mean Splunk was only reading one local file?

Options :

A : [read://opt/log/crashlog/Jan27crash.txt]

B : [monitor::/ opt/log/crashlog/Jan27crash.txt]

C : [monitor:/// opt/log/]

D : [monitor:/// opt/log/ crashlog/Jan27crash.txt]

Answer: B