Question 1

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

Options :

A : The field was extracted as a private knowledge object.

B : The events are tagged as communicate, but are missing the network tag.

C : The Typing Queue, which does regular expression replacements, is blocked.

D : The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Answer: D

Question 2

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the

SHOULD_LINEMERGE attribute should be set to what?

Options :

A : Auto

B : None

C : True

D : False

Answer: C

Question 3

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor

has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

Options :

A : Identify number of scheduled or real-time searches.

B : Validate if this Technical Add-On enables event data for a data model.

C : Identify the maximum number of forwarders Technical Add-On can support.

D : Verify if Technical Add-On needs to be installed onto both a search head or indexer.

Answer: A,C

Question 4

Which Splunk Enterprise offering has its own license?

Options :

A : Splunk Cloud Forwarder

B : Splunk Heavy Forwarder

C :

Splunk Universal Forwarder

D : Splunk Forwarder Management

Answer: C

Question 5

What is the expected minimum amount of storage required for data across an indexer cluster with the

following input and parameters?

• Raw data = 15 GB per day

• Index files = 35 GB per day

• Replication Factor (RF) = 2

• Search Factor (SF) = 2

Options :

A : 85 GB per day

B : 50 GB per day

C : 100 GB per day

D : 65 GB per day

Answer: C