In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Whichever is entered into the configuration first.

Where should apps be located on the deployment server that the clients pull from?

$SPLUNK_HOME/etc/deployment-apps

Free SPLK-1003 Sample Questions

Question 1
Which setting in indexes.conf allows data retention to be controlled by time?
Answer and explanation
Correct answer: D
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/SmartStoredataretention

Open in simulator
Question 2
The universal forwarder has which capabilities when sending data? (Choose all that apply.)
Answer and explanation
Correct answer: D
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders

Open in simulator
Question 3
In case of a conflict between a whitelist and a blacklist input setting, which one is used?
Answer and explanation
Correct answer: A
Reference: https://www.google.com/url?sa=trct=jq=esrc=ssource=webcd=8ved=2ahUKEwj0r6Lso6b kAhUqxYUKHbWlDz4QFjAHegQIAxACurl=http%3A%2F%2Fsplunk.training%2Fshowpdf.asp%3 Fdata%3D789BB6B10C1B4376B548D711B4377F3F4B511B437805A8EC11B437742EA8F11B4 3779B6FA211B4376EA657C11B4376FC19B311B4377E2407E11B43730AF97411B4377F3F4B5 11B437742EA8F11B43779B6FA211B43771F822111B437731365811B43730AF97411B437789B B6B11B4376B548D711B4377F3F4B511B437805A8EC11B437742EA8F11B43779B6FA211B437 6EA657C11B4376FC19B311B4377E2407E11B43732E61E211B4377F3F4B511B437742EA8F11 B43779B6FA211B43771F822111B437731365811B43746D0DC011B4377549EC611B4377BED8 1011B437789BB6B11B4376D8B14511B437731365811B4376B548D711B4377F3F4B511B4376F C19B311B43732E61E211B4376D8B14511B4377AD23D911B437789BB6B11B43730AF97411B4 373989B2C11B437386E6F511B437386E6F511B4373DF6C0811B43737532BE11B4373BC039A 11B437351CA5011B43737532BE11B43730AF97411B4375BD6DD511B43730AF97411B437564 E8C211B43730AF97411B437%257C2318D1%257C11649Ausg=AOvVaw2e9s-JweivuCkqTb4Y9uW

Open in simulator
Question 4
In which Splunk configuration is the SEDCMD used?
Answer and explanation
Correct answer: A
Reference: https://answers.splunk.com/answers/212128/why-sedcmd-configured-in-propsconf-is-workingduri.html

Open in simulator
Question 5
Multiple answers
Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
Answer and explanation
Correct answers: A, B
A,B -- Reference: https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/HowtoforwarddatatoSplunkEnt erprise#Define_inputs_on_the_universal_forwarder_with_configuration_files

Open in simulator
Question 6
Which parent directory contains the configuration files in Splunk?
Answer and explanation
Correct answer: A
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Configurationfiledirectories

Open in simulator
Question 7
Which forwarder type can parse data prior to forwarding?
Answer and explanation
Correct answer: D
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders

Open in simulator
Question 8
Which Splunk component consolidates the individual results and prepares reports in a distributed environment?
Answer and explanation
Correct answer: A
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Advancedindexingstrategy

Open in simulator
Question 9
Which Splunk component distributes apps and certain other configuration updates to search head cluster members?
Answer and explanation
Correct answer: A
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchan ges

Open in simulator
Question 10
Where should apps be located on the deployment server that the clients pull from?
Answer and explanation
Correct answer: A
Reference: https://answers.splunk.com/answers/371099/how-to-configure-deployment-apps-to-push-toclient.html

Open in simulator

Splunk Enterprise Certified Admin Free Sample Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Lifetime One

Two

Pro Four

Premium Twelve

SPLK-1003 Sample Questions

Trusted by professionals at