Exam 5: Splunk Enterprise Security Certified Admin

Configurations from the deployer are merged into which location on the search head cluster member?

The frequency in which a deployment client contacts the deployment server is controlled by what?

Which of the following is an indexer clustering requirement?

Which search will show all deployment client messages from the client (UF)?

Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

What is a Splunk Job? (Select all that apply.)

Which of the following commands is used to clear the KV store?

Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

At which default interval does metrics.log generate a periodic report regarding license utilization?

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

Which of the following are client filters available in serverclass.conf ? (Select all that apply.)

Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

Which server.conf attribute should be added to the master node's file when decommissioning a site in an indexer cluster?

Which CLI command converts a Splunk instance to a license slave?

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

To improve Splunk performance, parallelIngestionPipeline s setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)