SPLK-3003 Splunk Core Certified Consultant Questions and Answers

Search head cluster members, deployer, indexers, cluster master

Search head cluster members, deployment server, deployer, indexers, cluster master

All splunk nodes, including forwarders, must declare site membership

Search head cluster members, indexers, cluster master

Open a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.

Open a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

Use a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.

Use a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.

All replicated copies will be rolled to frozen; original copies will remain.

Replicated copies of the bucket will remain on all other indexers and the Cluster Master (CM) assigns a new primary bucket.

The bucket rolls to frozen on all clustered indexers simultaneously.

Nothing. Replicated copies of the bucket will remain on all other indexers until a local retention rule causes it to roll.

The updated dashboard will not be deployed globally to all users, due to the conflict with the power user’s modified version of the dashboard.

Applying the search head cluster bundle will fail due to the conflict.

The updated dashboard will be available to the power user.

The updated dashboard will not be available to the power user; they will see their modified version.

frozenTimePeriodInSecs, maxDataSize, maxVolumeDataSizeMB, maxHotBuckets

maxDataSize, maxTotalDataSizeMB, maxHotBuckets, maxGlobalDataSizeMB

maxDataSize, frozenTimePeriodInSecs, maxVolumeDataSizeMB

frozenTimePeriodInSecs, maxWarmDBCount, homePath.maxDataSizeMB, maxHotSpanSecs

Subsearches have to be initiated with the | subsearch command.

Subsearches can only be utilized with | inputlookup command.

Subsearches have a default result output limit of 10000.

There are no specific limitations when using subsearches.

index=www status=200 uri=/cart/checkout | append [search index = sales] | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

(index=www status=200 uri=/cart/checkout) OR (index=sales) | stats count, sum (revenue) as total_revenue by session_id | table total_revenue session_id

index=www | append [search index = sales] | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

(index=www) OR (index=sales) | search (index=www status=200 uri=/cart/checkout) OR (index=sales) | stats count, sum(revenue) as total_revenue by session_id | table total_revenue session_id

In tstatsHomePath

In the .tsidx files.

In summaryHomePath

In journal.gz

list monitor

oneshot

btprobe

tailingprocessor