Question 1

Configurations from the deployer are merged into which location on the search head cluster member?

Options :

A : SPLUNK_HOME/etc/system/local

B : SPLUNK_HOME/etc/apps/APP_HOME/local

C : SPLUNK_HOME/etc/apps/search/default

D : SPLUNK_HOME/etc/apps/APP_HOME/default

Answer: A

Question 2

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Options :

A : Rolling restart completes.

B : Master node rejoins the cluster.

C : Captain joins or rejoins cluster.

D : A peer node joins or rejoins the cluster.

Answer: A,B,D

Question 3

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

Options :

A : The field was extracted as a private knowledge object.

B : The events are tagged as communicate, but are missing the network tag.

C : The Typing Queue, which does regular expression replacements, is blocked.

D : The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Answer: D

Question 4

A search head cluster member contains the following in its server .conf. What is the Splunk server name of this member?

Options :

A : node1

B : shc4

C : idxc2

D : node3

Answer: D

Question 5

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor

has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

Options :

A : Identify number of scheduled or real-time searches.

B : Validate if this Technical Add-On enables event data for a data model.

C : Identify the maximum number of forwarders Technical Add-On can support.

D : Verify if Technical Add-On needs to be installed onto both a search head or indexer.

Answer: A,C