Which of the following should be included in a deployment plan?

A.

Business continuity and disaster recovery plans.

B.

Current logging details and data source inventory.

C.

Current and future topology diagrams of the IT environment.

D.

A comprehensive list of stakeholders, either direct or indirect

Which of the following is a good practice for a search head cluster deployer?

A.

The deployer only distributes configurations to search head cluster members when they “phone home”.

B.

The deployer must be used to distribute non-replicable configurations to search head cluster members.

C.

The deployer must distribute configurations to search head cluster members to be valid configurations.

D.

The deployer only distributes configurations to search head cluster members with splunk apply
shcluster-bundle.

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

A.

Configure syslog to send the data to multiple Splunk indexers.

B.

Use a Splunk indexer to collect a network input on port 514 directly.

C.

Use a Splunk forwarder to collect the input on port 514 and forward the data.

D.

Configure syslog to write logs and use a Splunk forwarder to collect the logs.

In the deployment planning process, when should a person identify who gets to see network data?

A.

Deployment schedule

B.

Topology diagramming

C.

Data source inventory

D.

Data policy definition

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

A.

adhoc_searchhead = true (on all members)

B.

adhoc_searchhead = true (on the current captain)

C.

captain_is_adhoc_searchhead = true (on all members)

D.

captain_is_adhoc_searchhead = true (on the current captain)

Configurations from the deployer are merged into which location on the search head cluster member?

A.

SPLUNK_HOME/etc/system/local

B.

SPLUNK_HOME/etc/apps/APP_HOME/local

C.

SPLUNK_HOME/etc/apps/search/default

D.

SPLUNK_HOME/etc/apps/APP_HOME/default

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

A.

REPORT

B.

LINE_BREAKER

C.

ANNOTATE_PUNCT

D.

SHOULD_LINEMERGE

Which Splunk Enterprise offering has its own license?

A.

Splunk Cloud Forwarder

B.

Splunk Heavy Forwarder

C.

Splunk Universal Forwarder

D.

Splunk Forwarder Management

Which of the following commands is used to clear the KV store?

A.

splunk clean kvstore

B.

splunk clear kvstore

C.

splunk delete kvstore

D.

splunk reinitialize kvstore

Which search will show all deployment client messages from the client (UF)?

A.

index=_audit component=DC* host=<ds> | stats count by message

B.

index=_audit component=DC* host=<uf> | stats count by message

C.

index=_internal component= DC* host=<uf> | stats count by message

D.

index=_internal component=DS* host=<ds> | stats count by message

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

A.

Adding search peers increases the maximum size of search results.

B.

Adding RAM to an existing search heads provides additional search capacity.

C.

Adding search peers increases the search throughput as search load increases.

D.

Adding search heads provides additional CPU cores to run more concurrent searches.

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

A.

System local directory.

B.

System default directory.

C.

App local directories, in ASCII order.

D.

App default directories, in ASCII order.