Exam 3: Splunk Certified Developer

How do you remove missing forwarders from the Monitoring Console?

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

What is the valid option for a [monitor] stanza in inputs.conf ?

Which Splunk component performs indexing and responds to search requests from the search head?

In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Which Splunk component requires a Forwarder license?

In which Splunk configuration is the SEDCMD used?

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Which of the following are supported options when configuring optional network inputs?

An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

With authentication methods are natively supported within Splunk Enterprise? (Select all that apply.)

Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)

How does the Monitoring Console monitor forwarders?

If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Which of the following are methods for adding inputs in Splunk? (Choose all that apply.)

Which layers are involved in Splunk configuration file layering? (Choose all that apply.)

How is data handled by Splunk during the input phase of the data ingestion process?

Which of the following must be done to define user permissions when integrating Splunk with LDAP?