QUESTION: 37

In which of the following scenarios is a subsearch the most appropriate?

When joining results from multiple indexes.
When dynamically filtering hosts.
When filtering indexed fields.
When joining multiple large datasets.

Answer(s): A

A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles – security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role.

If a new user is created and assigned to the operations role only, which indexes will the user have access to search?

operations, network, _internal, _audit
operations
No Indexes
operations, network

Answer(s): A

Reveal Solution Next Question

QUESTION: 39

A customer would like Splunk to delete files after they’ve been ingested. The Universal Forwarder has read/ write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?

Script
Batch
Monitor
Fschange

Answer(s): B

Reference:

https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-universal-forwarder-read-a/td-p/172752

Reveal Solution Next Question

QUESTION: 40

In which directory should base config app(s) be placed to initialize an indexer?

$SPLUNK_HOME/etc/<app_name>
$SPLUNK_HOME/etc/apps
$SPLUNK_HOME/etc/system/local
$SPLUNK_HOME/etc/slave-apps

Answer(s): B

Reference:

https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Manageappdeployment

Reveal Solution Next Question

Free SPLK-3003 Exam Braindumps (page: 10)

QUESTION: 37

QUESTION: 38

QUESTION: 39

Reference:

QUESTION: 40

Reference: