Question 1

Which items below are configured in inputs.conf ? (Select all that apply.)

Accepted Answer

A)  A modular input written in Python. 
B)  A file input monitoring a JSON file. 
C)  A custom search command written in Python. 
D)  An HTTP Event Collector as receiver of data from an app. 
A)  A modular input written in Python. 
B)  A file input monitoring a JSON file. 
C)  A custom search command written in Python. 
D)  An HTTP Event Collector as receiver of data from an app.

Question 2

Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

Accepted Answer

A)  earliest=01/01/2019:00:00:00 
B)  earliest=01/01/2019T00:00:00 
C)  earliest=2019-01-01 00:00:00 
D)  earliest=2019-01-01T00:00:00 
A)  earliest=01/01/2019:00:00:00 
B)  earliest=01/01/2019T00:00:00 
C)  earliest=2019-01-01 00:00:00 
D)  earliest=2019-01-01T00:00:00

Question 3

Which of the following ensures that quotation marks surround the value referenced by the token?

Accepted Answer

A)  $token_name|s$ 
B)  "$token_name$" 
C)  ($token_name$) 
D)  \"$token_name$\" 
A)  $token_name|s$ 
B)  "$token_name$" 
C)  ($token_name$) 
D)  \"$token_name$\"

Question 4

Given the following two files defining app navigation, which navigation options will be displayed to the end user? (Select all that apply.) $SPLUNK_HOME/etc/apps/app_name/default/data/ui/nav/default.xml $SPLUNK_HOME/etc/apps/app_name/local/data/ui/nav/default/xml

Accepted Answer

A)  Search 
B)  Reports 
C)  Datasets 
D)  Dashboards 
A)  Search 
B)  Reports 
C)  Datasets 
D)  Dashboards

Question 5

Which event handler uses the <selection> element to support pan and zoom functionality?

Accepted Answer

A)  Visualization event handler 
B)  Form input event handler 
C)  Condition event handler 
D)  Search event handler 
A)  Visualization event handler 
B)  Form input event handler 
C)  Condition event handler 
D)  Search event handler

Question 6

A KV store collection can be associated with a namespace for which of the following users?

Accepted Answer

A)  Nobody 
B)  Users in the admin role. 
C)  Users in the admin and power roles. 
D)  Users in the admin, power, and splunk-system-user roles. 
A)  Nobody 
B)  Users in the admin role. 
C)  Users in the admin and power roles. 
D)  Users in the admin, power, and splunk-system-user roles.

Question 7

Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

Accepted Answer

A)  stats 
B)  tstats 
C)  tscollect 
D)  transaction 
A)  stats 
B)  tstats 
C)  tscollect 
D)  transaction

Question 8

Which of the following are security best practices for Splunk app development? (Select all that apply.)

Accepted Answer

A)  Store passwords in clear text in .conf files. Store passwords in clear text in .conf files. 
B)  Implement security in software development lifecycle. 
C)  Manually test application with the controls listed in the OWASP Security Testing Guide. 
D)  Use a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities. 
A)  Store passwords in clear text in .conf files. Store passwords in clear text in .conf files. 
B)  Implement security in software development lifecycle. 
C)  Manually test application with the controls listed in the OWASP Security Testing Guide. 
D)  Use a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities.

Question 9

When output_mode is not used, which element of a feed is a human readable name for a returned entry?

Accepted Answer

A)  Author 
B)  Title 
C)  Link 
D)  Id 
A)  Author 
B)  Title 
C)  Link 
D)  Id

Question 10

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

Accepted Answer

A)  Use a generating search. 
B)  Remove unneeded fields. 
C)  Truncate the data, using selective functions. 
D)  Summarize data, using analytic commands. 
A)  Use a generating search. 
B)  Remove unneeded fields. 
C)  Truncate the data, using selective functions. 
D)  Summarize data, using analytic commands.

Question 11

Which of the following will unset a token named my_token ?

Accepted Answer

A) $my_token$ B) C) false D) disabled A) $my_token$ B) C) false D) disabled

Question 12

Which of the following is a security best practice?

Accepted Answer

A)  Enable XSS. 
B)  Eliminate all escape characters. 
C)  Ensure the app passes App Certification. 
D)  Ensure components have no Common Vulnerabilities and Exposures (CV
E)  vulnerabilities. 
A)  Enable XSS. 
B)  Eliminate all escape characters. 
C)  Ensure the app passes App Certification. 
D)  Ensure components have no Common Vulnerabilities and Exposures (CV
E)  vulnerabilities.

Question 13

Which of the following are types of event handlers? (Select all that apply.)

Accepted Answer

A)  Search 
B)  Set token 
C)  Form input 
D)  Visualization 
A)  Search 
B)  Set token 
C)  Form input 
D)  Visualization

Question 14

How can hiding or showing a panel by clicking on a chart or a table on the same form be performed?

Accepted Answer

A)  By using vent drilldown. 
B)  By using workflow action. 
C)  By using contextual drilldown. 
D)  By using visualization drilldown. 
A)  By using vent drilldown. 
B)  By using workflow action. 
C)  By using contextual drilldown. 
D)  By using visualization drilldown.

Question 15

Searching "index=_internal metrics | head 3" from Splunk Web returned the following events: 04-12-2018 18:39:43.514 +0200 INFO Metrics - group=thruput, name=thruput, instantaneous_kbps=0.9651774014563425, instantaneous_eps=5.645638802094809, average_kbps=1.198995639527069, total_k_processed=2676, kb=29.91796875, ev=175, load_average=3.85888671875 04-12-2018 18:39:43.514 +0200 INFO Metrics - group_thruput, name_syslog_output, instantaneous_kbps=0, instantaneous_eps_0, average_kbps=0, total_k_processed=0, kb=0, ev=0 04-12-2018 18:39:43.513 +0200 INFO Metrics - group_thruput, name_index_thruput, instantaneous_kbps=0.9651773703189551, instantaneous_eps=4.87137960922438, average_kbps=1.1985932324065556, total_k_processed=2675, kb=29.91796875, ev=151 When the same search is required from a REST API call, which fields will be given? (Select all that apply.)

Accepted Answer

A)  _raw 
B)  name 
C)  sourcetype 
D)  instantaneous_kbps 
A)  _raw 
B)  name 
C)  sourcetype 
D)  instantaneous_kbps

Question 16

Which of the following Simple XML elements configure panel link buttons? (Select all that apply.)

Accepted Answer

A) Open In Search B) C) D) A) Open In Search B) C) D)

Question 17

Log files related to Splunk REST calls can be found in which indexes? (Select all that apply.)

Accepted Answer

A)  _audit 
B)  _internal 
C)  _thefishbucket 
D)  _blocksignature 
A)  _audit 
B)  _internal 
C)  _thefishbucket 
D)  _blocksignature

Question 18

Which type of command is tstats ?

Accepted Answer

A)  Generating 
B)  Transforming 
C)  Centralized streaming 
D)  Distributable streaming 
A)  Generating 
B)  Transforming 
C)  Centralized streaming 
D)  Distributable streaming

Question 19

Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

Accepted Answer

A)  Multiple tokens can be created for use with different sourcetypes and indexes. 
B)  The edit token http admin role capability is required to create a token. The edit token http admin role capability is required to create a token. 
C)  To create a token, send a POST request to services/collector endpoint. To create a token, send a POST request to services/collector endpoint. 
D)  Tokens can be edited using the data/inputs/http/{tokenName} endpoint. Tokens can be edited using the data/inputs/http/{tokenName} 
A)  Multiple tokens can be created for use with different sourcetypes and indexes. 
B)  The edit token http admin role capability is required to create a token. The edit token http admin role capability is required to create a token. 
C)  To create a token, send a POST request to services/collector endpoint. To create a token, send a POST request to services/collector endpoint. 
D)  Tokens can be edited using the data/inputs/http/{tokenName} endpoint. Tokens can be edited using the data/inputs/http/{tokenName}

Question 20

When added to an app's default.meta file, which of the following makes one of its views available to other apps?

Accepted Answer

A)  export = app 
B)  export = none 
C)  export = view 
D)  export = system 
A)  export = app 
B)  export = none 
C)  export = view 
D)  export = system

Which items below are configured in inputs.conf ? (Select all that apply.)

Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

Which of the following ensures that quotation marks surround the value referenced by the token?

Which event handler uses the <selection> element to support pan and zoom functionality?

A KV store collection can be associated with a namespace for which of the following users?

Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

Which of the following are security best practices for Splunk app development? (Select all that apply.)

When output_mode is not used, which element of a feed is a human readable name for a returned entry?

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

Which of the following will unset a token named my_token ?

Which of the following is a security best practice?

Which of the following are types of event handlers? (Select all that apply.)

How can hiding or showing a panel by clicking on a chart or a table on the same form be performed?

Which of the following Simple XML elements configure panel link buttons? (Select all that apply.)

Log files related to Splunk REST calls can be found in which indexes? (Select all that apply.)

Which type of command is tstats ?

Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

When added to an app's default.meta file, which of the following makes one of its views available to other apps?

Splunk Core Certified User

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters

Exam 4: Splunk Enterprise Certified Architect

Which items below are configured in inputs.conf ? (Select all that apply.)

Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

Which of the following ensures that quotation marks surround the value referenced by the token?

Which event handler uses the <selection> element to support pan and zoom functionality?

A KV store collection can be associated with a namespace for which of the following users?

Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

Which of the following are security best practices for Splunk app development? (Select all that apply.)

When output_mode is not used, which element of a feed is a human readable name for a returned entry?

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

Which of the following will unset a token named my_token ?

Which of the following is a security best practice?

Which of the following are types of event handlers? (Select all that apply.)

How can hiding or showing a panel by clicking on a chart or a table on the same form be performed?

Which of the following Simple XML elements configure panel link buttons? (Select all that apply.)

Log files related to Splunk REST calls can be found in which indexes? (Select all that apply.)

Which type of command is tstats ?

Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

When added to an app's default.meta file, which of the following makes one of its views available to other apps?

Splunk Core Certified User

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters