When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?
Answer(s): B
https://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdat a#Include_or_exclude_specific_incoming_data
What is required when adding a native user to Splunk? (select all that apply)
Answer(s): A,B
According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED
What are the minimum required settings when creating a network input in Splunk?
Answer(s): A
https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf[tcp://<remote server>:<port>]*Configures the input to listen on a specific TCP network port. *If a <remote server> makes a connection to this instance, the input uses this stanza to configure itself.*If you do not specify <remote server>, this stanza matches all connections on the specified port. *Generates events with source set to "tcp:<port>", for example: tcp:514*If you do not specify a sourcetype, generates events with sourcetype set to "tcp-raw"
Which Splunk component requires a Forwarder license?
Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?
https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Perform_se lective_indexing_and_forwardingSpecifies a comma-separated list of tcpout group names. Use this setting to selectively forward your data to specific indexers by specifying the tcpout groups that the forwarder should use when forwarding the data. Define the tcpout group names in the outputs.conf file in [tcpout:<tcpout_group_name>] stanzas. The groups present in defaultGroup in [tcpout] stanza in the outputs.conf file.
Post your Comments and Discuss Splunk SPLK-1003 exam prep with other Community members: