What is the name of the object that stores events inside of an index?
A. Container
B. Bucket
C. Data layer
D. Indexer
Explanation: A bucket is the object that stores events inside of an index. According to the Splunk documentation1, “An index is a collection of directories, also called buckets, that contain index files. Each bucket represents a specific time range.” A bucket can be in one of several states, such as hot, warm, cold, frozen, or thawed1. Buckets are managed by indexers or clusters of indexers1.
Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)
A. _license
B. _lnternal
C. _external
D. _thefishbucket
Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)
A. CLI
B. Edit inputs . conf
C. Edit forwarder.conf
D. Forwarder Management
Explanation:
https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/HowtoforwarddatatoSplunkEnterprise
"You can collect data on the universal forwarder using several methods. Define inputs on the universal forwarder with the CLI. You can use the CLI to define inputs on the universal forwarder. After you define the inputs, the universal forwarder collects data based on those definitions as long as it has access to the data that you want to monitor. Define inputs on the universal forwarder with configuration files. If the input you want to configure does not have a CLI argument for it, you can configure inputs with configuration files. Create an inputs.conf file in the directory, $SPLUNK_HOME/etc/system/local
Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?
A. Any OS platform
B. Linux platform only
C. Windows platform only
D. None of the above.
Explanation: "The forwarder/indexer relationship can be considered platform agnostic (within the sphere of supported platforms) because they exchange their data handshake (and the data, if you wish) over TCP.
When working with an indexer cluster, what changes with the global precedence when comparing to a standalone deployment?
A. Nothing changes
B. The peer-apps local directory becomes the highest priority
C. The app local directories move to second in the priority list.
D. The system default directory' becomes the highest priority.
Explanation:
The app local directories move to second in the priority list. This is explained in the Splunk
documentation, which states:
In a clustered environment, the precedence of configuration files changes slightly from that
of a standalone deployment. The app local directories move to second in the priority list,
after the peer-apps local directory. This means that any configuration files in the app local
directories on the individual peers are overridden by configuration files of the same name
and type in the peer-apps local directory on the master node.
Which Splunk component performs indexing and responds to search requests from the search head?
A. Forwarder
B. Search peer
C. License master
D. Search head cluster
"A Splunk platform instance that responses to search requests from a search head. The term "Search peer" is usually synonymous with the indexer role in a distributed search topology..."
| Page 3 out of 31 Pages |
| Previous |
Contact Us - Privacy Policy ... Copyright © - All Rights Reserved