Splunk Core Certified Consultant - SPLK-3003 Exam Practice Test

A. Work with the cloud orchestration team to dynamically insert an appropriate clientName setting into each endpoint's local/deploymentclient.conf which can be matched by whitelist in serverclass.conf.

B. Work with the cloud orchestration team to create a common host-naming convention for these systems so a simple pattern can be used in the serverclass.conf whitelist attribute.

C. Using an installation bootstrap script run a CLI command to assign a clientName setting and permit serverclass.conf whitelist simplification.

D. Create a CSV lookup file for each severclass, manually keep track of the endpoints within this CSV file, and leverage the whitelist.from_pathname attribute in serverclass.conf.

A. The indexer cluster will continue to operate as long as a replacement CM is deployed within 24 hours.

B. A warm standby CM needs to be brought online as soon as possible before an indexer has an outage.

C. If the indexer cluster has site failover configured in the CM, the second cluster master will take over.

D. The indexer cluster will continue to operate as long as no indexers fail.

A. The MC assigns all possible roles by default.

B. The MC uses a REST endpoint to query the server.

C. Roles are manually assigned within the MC.

D. Roles are read from distsearch.conf.

A. Search Job Inspector provides a Search Health Check capability that provides an optimized SPL query the customer should try instead.

B. Search Job Inspector cannot be used to help troubleshoot the slow performing search; customer should review index=_introspection instead.

C. The customer is using the transaction SPL search command, which is known to be slow.

D. Search Job Inspector provides statistics to show how much time and the number of events each indexer has processed.

A. Disable the indexing ports on the old indexers.

B. Disable replication ports on the old indexers.

C. Put the old indexers into automatic detention.

D. Put the old indexers into manual detention.

A. Use the add data wizard in Splunk Web.

B. Create UDP input port 9997 on a UF.

C. Use a scripted input to monitor a log file.

D. Use the inputs.conf file.

A. (index=www status=200 uri=/cart/checkout) OR (index=sales) | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

B. (index=www) OR (index=sales) | search (index=www status=200 uri=/cart/checkout) OR (index=sales) | stats count, sum (revenue) as total_revenue by session_id | table total_revenue session_id

C. index=www | append [search index = sales] | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

D. index=www status=200 uri=/cart/checkout | append [search index = sales] | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

A. authentication.conf, authorize.conf, ldap.conf

B. authorize.conf, authentication.conf

C. authentication.conf

D. authentication.conf, ldap.conf

A. healthcheck.conf

B. distsearch.conf

C. checklist.conf

D. alert_actions.conf