QUESTION: 9

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Deployer
Cluster master
Deployment server
Search head cluster master

Answer(s): A

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges

Reveal Solution Next Question

QUESTION: 10

Where should apps be located on the deployment server that the clients pull from?

$SPLUNK_HOME/etc/apps
$SPLUNK_HOME/etc/search
$SPLUNK_HOME/etc/master-apps
$SPLUNK_HOME/etc/deployment-apps

Answer(s): A

Reference:

https://answers.splunk.com/answers/371099/how-to-configure-deployment-apps-to-push-to-client.html

Reveal Solution Next Question

This file has been manually created on a universal forwarder:

/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:

/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog

Which file is now monitored?

/var/log/messages
/var/log/maillog
/var/log/maillog and /var/log/messages
none of the above

Answer(s): A

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Exampleaddaninputtoforwarders

Reveal Solution Next Question

QUESTION: 12

In which phase of the index time process does the license metering occur?

Input phase
Parsing phase
Indexing phase
Licensing phase

Answer(s): C

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

Reveal Solution Next Question

Free SPLK-1003 Exam Braindumps (page: 3)

QUESTION: 9

Reference:

QUESTION: 10

Reference:

QUESTION: 11

Reference:

QUESTION: 12

Reference: