Question 1

What is the default character encoding used by Splunk during the input phase?

Options :

A : UTF-8

B : UTF-16

C : EBCDIC

D : ISO 8859

Answer: A

Question 2

Which of the following Splunk components require a separate installation package?

Options :

A : Deployment server

B : License master

C : Universal forwarder

D : Heavy forwarder

Answer: C

Question 3

What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

Options :

A : host=server1
index=unixinfo

B : host=server1
index=searchinfo

C : host=searchsvr1
index=searchinfo

D : host=unixsvr1
index=unixinfo

Answer: A

Question 4

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?