最新的Splunk Enterprise Certified Admin - SPLK-1003免費考試真題
Where are forwarder apps and add-ons stored?
正確答案: D
說明：（僅 Fast2test 成員可見）
A sourcetype has been explicitly set in inputs.conf. How can the sourcetype be fine- tuned in props.confduring the Input phase?
正確答案: D
說明：（僅 Fast2test 成員可見）
Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?
正確答案: A
說明：（僅 Fast2test 成員可見）
What happens when the same username exists in Splunk as well as through LDAP?
正確答案: A
說明：（僅 Fast2test 成員可見）
A Universal Forwarder has the following active stanza in inputs . conf:
[monitor: //var/log]
disabled = O
host = 460352847
An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?
[monitor: //var/log]
disabled = O
host = 460352847
An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?
正確答案: A
說明：（僅 Fast2test 成員可見）
When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?
正確答案: D
說明：（僅 Fast2test 成員可見）
Which of the following is true when authenticating users to Splunk using LDAP?
正確答案: C
說明：（僅 Fast2test 成員可見）
An index stores its data in buckets. Which default directories does Splunk use to store buckets?
(Choose all that apply.)
(Choose all that apply.)
正確答案: B,D