Free Practice Questions for Splunk SPLK-1003 Exam

https://docs.splunk.com/Documentation/Splunk/8.0.1/Troubleshooting/Usebtooltotroubleshootconfigurations

" The btool command simulates the merging process using the on-disk conf files and creates a report showing the merged settings. "

" The report does not necessarily represent what ' s loaded in memory. If a conf file change is made that requires a service restart, the btool report shows the change even though that change isn ' t active. "

- etc/system/local/ has better precedence at index time - for identical settings in the same file, the last one overwrite others, see :https://community.splunk.com/t5/Getting-Data-In/What-is-the-precedence-for-identical-stanzas-within-a-single/m-p/283566

https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/UsetheHTTPEventCollector

" The HTTP Event Collector (HEC) lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. HEC uses a token-based authentication model. You can generate a token and then configure a logging library or HTTP client with the token to send data to HEC in a specific format. This process eliminates the need for a Splunk forwarder when you send application events. "

" Where to place the scripts for scripted inputs. The script that you refer to in $SCRIPT can reside in only one of the following places on the host file system:

$SPLUNK_HOME/etc/system/bin

$SPLUNK_HOME/etc/apps/ < your_App > /bin

$SPLUNK_HOME/bin/scripts

As a best practice, put your script in the bin/ directory that is nearest to the inputs.conf file that calls your script on the host file system. "

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

" You can group your search peers to facilitate searching on a subset of them. Groups of search peers are known as " distributed search groups. " You specify distributed search groups in the distsearch.conf file "

According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED

https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture

Scroll down to section titled, How the cluster handles concurrent search quotas, " Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_Searches_per_cpu and related settings in limits.conf. "

https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Anonymizedata

Scrolling down to the section titled " Define the sed script in props.conf shows the correct syntax of an example which validates that the number/character /1 immediately preceded the /g