Exam 3: Splunk Certified Developer

Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)

How often does Splunk recheck the LDAP server?

After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list --debug . What will the output be?

What options are available when creating custom roles? (Select all that apply.)

Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Which of the following is a valid distributed search group?

Which of the following are required when defining an index in indexes.conf ? (Choose all that apply.)

Which of the following authentication types requires scripting in Splunk?

Which of the following apply to how distributed search works? (Choose all that apply.)

Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

What conf file needs to be edited to set up distributed search groups?

Which of the following statements describe deployment management? (Choose all that apply.)

The priority of layered Splunk configuration files depends on the file's:

Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?

Which of the following apply to how distributed search works? (Select all that apply.)

Which valid bucket types are searchable? (Choose all that apply.)