Splunk Core Certified Consultant SPLK-3003 Reddit Questions

Page: 2 / 2

Question 8

Where are Splunk Data Model Acceleration (DMA) summaries stored?

Options:

In tstatsHomePath

In the .tsidx files.

In summaryHomePath

In journal.gz

Question 9

In a large cloud customer environment with many (>100) dynamically created endpoint systems, each with a UF already deployed, what is the best approach for associating these systems with an appropriate serverclass on the deployment server?

Options:

Work with the cloud orchestration team to create a common host-naming convention for these systems so a simple pattern can be used in the serverclass.conf whitelist attribute.

Create a CSV lookup file for each severclass, manually keep track of the endpoints within this CSV file, and leverage the whitelist.from_pathname attribute in serverclass.conf.

Work with the cloud orchestration team to dynamically insert an appropriate clientName setting into each endpoint’s local/deploymentclient.conf which can be matched by whitelist in serverclass.conf.

Using an installation bootstrap script run a CLI command to assign a clientName setting and permit

serverclass.conf whitelist simplification.

Question 10

A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?

Options:

Nothing. Decommissioning a site is not possible.

Create an alias for where the new data should be sent.

Remove the site from the list of available sites.

Remove the site from the list of available sites and create an alias for where the new data should be sent.

Question 11

Which event processing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested?