Question 1

Which artifact is required in the request header when creating an HTTP event?

Options :

A : ackID

B : Token

C : Manifest

D : Host name

Answer: B

Question 2

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

Options :

A :

B :

C :

D :

Answer: B

Question 3

What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Options :

A : REGEX, DEST. FORMAT

B : REGEX. SRC_KEY, FORMAT

C : REGEX, DEST_KEY, FORMAT

D : REGEX, DEST_KEY FORMATTING

Answer: C

Question 4

Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations
found in props.conf to be validated all through the UI?

Options :

A : Apps

B : Search

C : Data preview

D : Forwarder inputs

Answer: C

Question 5

Which Splunk component does a search head primarily communicate with?

Options :

A : Indexer

B : Forwarder

C : Cluster master

D : Deployment server

Answer: A

Higher Test Marks with Free Online SPLK-1003 Exam Practice

Buying Options: