Question 1

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data
is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the
index?

Options :

A : Buy a bigger Splunk license.

B : Add 2.5 TB each day for the next 5 days.

C : Add all 10 TB in a single 24 hour period.

D : Add 200 GB of historical data each day for 50 days.

Answer: C

Question 2

Which Splunk component does a search head primarily communicate with?

Options :

A : Indexer

B : Forwarder

C : Cluster master

D : Deployment server

Answer: A

Question 3

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?