Splunk Core Certified Consultant - SPLK-3003 Free Exam Questions

A. Temporary file

B. STDOUT/STDERR

C. TCP stream

D. UDP stream

A. To find all the denied, high severity events in the firewall index, and use those events to further search for lateral movement within the web index.

B. To search the firewall index for web logs that have been denied and are of high severity.

C. To return all the web_log events from the web index that occur two hours before and after all high severity, denied events found in the firewall index.

D. To return all the web_log events from the web index that occur two hours before and after the most recent high severity, denied event found in the firewall index.

A. The SHC will stop all scheduled search activity within the SHC.

B. The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.

C. The SHC will function as expected as the SHC deployer will become the new captain until the network communication is restored.

D. The SHC will function as expected as the minimum required number of nodes for a SHC is 3.

A. Modular inputs, HTTP Event Collector (HEC), inputs.conf monitor stanza

B. Actively listening on ports, monitoring (via a process), collecting data from remote systems/applications

C. Monitoring (via a process), collecting data (modular inputs) from remote systems/applications

D. splunktcp, splunktcp-ssl, HTTP Event Collector (HEC)

A. In general, search commands that can be distributed to the search peers should occur as early as possible in a well-tuned search.

B. When trying to reduce a search result to unique elements, the dedup command is the only way to achieve this.

C. Formatting commands such as fieldformat should occur as early as possible in the search to take full advantage of the often larger number of search peers.

D. As a streaming command, streamstats performs better than stats since stats is just a reporting command.

A.

B.

C.

D.

A. Script

B. Monitor

C. Batch

D. Fschange

A. distsearch.conf

B. alert_actions.conf

C. checklist.conf

D. healthcheck.conf

A. Create UDP input port 9997 on a UF.

B. Use a scripted input to monitor a log file.

C. Use the inputs.conf file.

D. Use the add data wizard in Splunk Web.