Online Access Free SPLK-1005 Practice Test

Which of the following is an accurate statement about the delete command?

• A.By default, only admins can run the delete command.
• B.Events are virtually deleted by marking them as deleted.
• C.The delete command removes events from disk.
• D.Deleting events reclaims disk space.

Windows Input types are collected in Splunk via a script which is configurable using the GUI.
What is this type of input called?

• A.Modular
• B.Batch
• C.Scripted
• D.Front-end

Li was asked to create a Splunk configuration to monitor syslog files stored on Linux servers at their organization. This configuration will be pushed out to multiple systems via a Splunk app using the on- prem deployment server.
The system administrators have provided Li with a directory listing for the logging locations on three syslog hosts, which are representative of the file structure for all systems collecting this data. An example from each system is shown below:

• A.
• B.
• C.
• D.

Which of the following methods is valid for creating index-time field extractions?

• A.Use the rex command to extract the desired field, and then save as a calculated field.
• B.Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.
• C.Use the CU app to define settings in fields.conf, and restart Splunk Cloud.
• D.Create a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.

In which of the following situations should Splunk Support be contacted?

• A.When an app on Splunkbase indicates Request Install.
• B.When a custom search needs tuning due to not performing as expected.
• C.When a new role that mirrors sc_admin is required.
• D.Before using the delete command.