SPLK-3003問題集、Splunk実際の試験問題

質問 1

Which statement is correct?

A. As a streaming command, streamstats performs better than stats since stats is just a reporting command.

B. Formatting commands such as fieldformat should occur as early as possible in the search to take full advantage of the often larger number of search peers.

C. In general, search commands that can be distributed to the search peers should occur as early as possible in a well-tuned search.

D. When trying to reduce a search result to unique elements, the dedup command is the only way to achieve this.

正解: C

質問 2

A customer with a large distributed environment has blacklisted a large lookup from the search bundle to decrease the bundle size using distsearch.conf.
After this change, when running searches utilizing the lookup that was blacklisted they see error messages in the Splunk Search UI stating the lookup file does not exist.
What can the customer do to resolve the issue?

A. The blacklisted lookup definition stanza needs to be modified to specify setting allow_caching=true.

B. The search needs to be modified to ensure the lookup command specified parameter blacklist=false.

C. The search needs to be modified to ensure the lookup command specifies parameter local=true.

D. The lookup cannot be blacklisted; the change must be reverted.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 3

What should be considered when running the following CLI commands with a goal of accelerating an index cluster migration to new hardware?

A. Data ingestion rate

B. SSL data encryption

C. Network latency and storage IOPS

D. Distance and location

正解: C

質問 4

In which of the following scenarios is a subsearch the most appropriate?

A. When filtering indexed fields.

B. When joining results from multiple indexes.

C. When dynamically filtering hosts.

D. When joining multiple large datasets.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 5

In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing configurations need to be installed for this to work?

A. All heavy forwarders.

B. All universal forwarders.

C. Only the indexers.

D. On all parsing Splunk instances.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 6

What does Splunk do when it indexes events?

A. Extracts the top 10 fields.

B. Extracts metadata fields such as host, source, sourcetype.

C. Performs parsing, merging, and typing processes on universal forwarders.

D. Create report acceleration summaries.

正解: B

質問 7

A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?

A. Open a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

B. Use a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.

C. Use a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.

D. Open a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.

正解: C

質問 8

What happens to the indexer cluster when the indexer Cluster Master (CM) runs out of disk space?

A. The indexer cluster will continue to operate as long as a replacement CM is deployed within 24 hours.

B. A warm standby CM needs to be brought online as soon as possible before an indexer has an outage.

C. The indexer cluster will continue to operate as long as no indexers fail.

D. If the indexer cluster has site failover configured in the CM, the second cluster master will take over.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 9

In a single indexer cluster, where should the Monitoring Console (MC) be installed?

A. Deployer sharing with master cluster.

B. Production Search Head

C. License master that has 50 clients or more.

D. Cluster master node

正解: D

解説: (PassTest メンバーにのみ表示されます)

Splunk Core Certified Consultant - SPLK-3003 模擬練習