Splunk SPLK-1003 Exam Questions & Answers

Correct Answer: D

The Data Preview feature should be used when validating the parsing of data. The Data Preview feature allows you to preview how Splunk software will index your data before you commit the data to an index.You can use the Data Preview

feature to check the following aspects of data parsing1:

Timestamp recognition: You can verify that Splunk software correctly identifies the timestamps of your events and assigns them to the _time field. Event breaking: You can verify that Splunk software correctly breaks your data stream into

individual events based on the line breaker and should linemerge settings.

Source type assignment: You can verify that Splunk software correctly assigns a source type to your data based on the props.conf file settings. You can also manually override the source type if needed. Field extraction: You can verify that

Splunk software correctly extracts fields from your events based on the transforms.conf file settings. You can also use the Interactive Field Extractor (IFX) to create custom field extractions. The Data Preview feature is available in Splunk Web

under Settings > Data inputs > Data preview.You can access the Data Preview feature when you add a new input or edit an existing input1.

The other options are incorrect because:

A. When extracting fields for ingested data. The Data Preview feature can be used to verify the field extraction for data that has not been ingested yet, but not for data that has already been indexed.To extract fields from ingested data, you can use the IFX or the rex command in the Search app2.

B. When previewing the data before searching. The Data Preview feature does not allow you to search the data, but only to view how it will be indexed. To preview thedata before searching, you can use the Search app and specify a time range or a sample ratio.

C. When reviewing data on the source host. The Data Preview feature does not access the data on the source host, but only the data that has been uploaded or monitored by Splunk software. To review data on the source host, you can use the Splunk Universal Forwarder or the Splunk Add-on for Unix and Linux.

Correct Answer: ABC

Reference:https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Setupuserauthent icationwithSplunk

Splunk authentication: Provides Admin, Power and User by default, and you can define your own roles using a list of capabilities. If you have an Enterprise license, Splunk authentication is enabled by default. See Set up user authentication with Splunk's built-in system for more information. LDAP: Splunk Enterprise supports authentication with its internal authentication services or your existing LDAP server. See Set up user authentication with LDAP for more information. Scripted authentication API: Use scripted authentication to integrate Splunk authentication with an external authentication system, such as RADIUS or PAM. See Set up user authentication with external systems for more information. Note: Authentication, including native authentication, LDAP, and scripted authentication, is not available in Splunk Free.

Correct Answer: D

https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/Distdeploylicenses#Clustered_ deployments_and_licensing_issues

Reference:https://community.splunk.com/t5/Deployment-Architecture/License-usage-in- Indexer-Cluster/m-p/493548