In case of a conflict between a whitelist and a blacklist input setting, which one is used?
A. Blacklist
B. Whitelist
C. They cancel each other out.
D. Whichever is entered into the configuration first.
"It is not necessary to define both an allow list and a deny list in a configuration stanza. The settings are independent. If you do define both filters and a file matches them both, Splunk Enterprise does not index that file, as the blacklist filter overrides the whitelist filter."
On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?
A. The blacklist takes precedence over the whitelist.
B. The whitelist takes precedence over the blacklist.
C. Wildcards are not supported in any client filters.
D. Machine type filters are applied before the whitelist and blacklist.
What options are available when creating custom roles? (select all that apply)
A. Restrict search terms
B. Whitelist search terms
C. Limit the number of concurrent search jobs
D. Allow or restrict indexes that can be searched.
"Set limits for concurrent scheduled searches. You must have the edit_search_concurrency_all and edit_search_concurrency_scheduled capabilities to configure these settings."
When running a real-time search, search results are pulled from which Splunk component?
A. Heavy forwarders and search peers
B. Heavy forwarders
C. Search heads
D. Search peers
Explanation:
Using the Splunk reference URLhttps://docs.splunk.com/Splexicon:Searchpeer
"search peer is a splunk platform instance that responds to search requests from a search
head. The term "search peer" is usally synonymous with the indexer role in a distributed
search topology. However, other instance types also have access to indexed data,
particularly internal diagnostic data, and thus function as search peers when they respond
to search requests for that data."
Where should apps be located on the deployment server that the clients pull from?
A. $SFLUNK_KOME/etc/apps
B. $SPLUNK_HCME/etc/sear:ch
C. $SPLUNK_HCME/etc/master-apps
D. $SPLUNK HCME/etc/deployment-apps
The Splunk administrator wants to ensure data is distributed evenly amongst the indexers.
To do this, he runs
the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?
A. host
B. index
C. linecount
D. splunk_server
The splunk server field contains the name of the Splunk server containing the event. Useful in a distributed Splunk environment. Example: Restrict a search to the main index on a server named remote. splunk_server=remote index=main 404
| Page 4 out of 31 Pages |
| Previous |
Contact Us - Privacy Policy ... Copyright © - All Rights Reserved