Which additional component is required for a search head cluster?
Answer(s): A
https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/SHCdeploymentoverviewThe deployer. This is a Splunk Enterprise instance that distributes apps and other configurations to the cluster members. It stands outside the cluster and cannot run on the same instance as a cluster member. It can, however, under some circumstances, reside on the same instance as other Splunk Enterprise components, such as a deployment server or an indexer cluster master node.
When are knowledge bundles distributed to search peers?
Answer(s): D
"The search head replicates the knowledge bundle periodically in the background or when initiating a search. " "As part of the distributed search process, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching accorss indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf."
https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Whatsearchheadssend
Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?
--reset Reset the fishbucket for the given key or file in the btree. Resetting the checkpoint for an active monitor input reindexes data, resulting in increased license use. https://docs.splunk.com/Documentation/Splunk/8.1.1/Troubleshooting/Commandlinetoolsforusewi thSupport
http://docshare02.docshare.tips/files/4773/47733589.pdf
If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?
https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html "Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf"Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a-forwarder/td- p/93310
How can native authentication be disabled in Splunk?
Answer(s): B
https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Secureyouradminaccount
Post your Comments and Discuss Splunk SPLK-1003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-1003 content, but please register or login to continue.