SPLK-3001 Practice Test

Which tool Is used to update indexers In E5?

A.

Index Updater

B.

Distributed Configuration Management

C.

indexes.conf

D.

Splunk_TA_ForIndexeres. spl

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

A.

indexes.conf, props.conf, transforms.conf

B.

web.conf, props.conf, transforms.conf

C.

inputs.conf, props.conf, transforms.conf

D.

eventtypes.conf, indexes.conf, tags.conf

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

A.

Install ES on the existing search head.

B.

Add a new search head and install ES on it.

C.

Increase the number of CPUs and amount of memory on the search head, then install ES.

D.

Delete the non-CIM-compliant apps from the search head, then install ES.

Which of these Is a benefit of data normalization?

A.

Reports run faster because normalized data models can be optimized for better
performance.

B.

Dashboards take longer to build.

C.

Searches can be built no matter the specific source technology for a normalized data type.

D.

Forwarder-based inputs are more efficient.

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

A.

Use new app names each time content is exported.

B.

Do not use the .spl extension when naming an export.

C.

Always include existing and new content for each export.

D.

Either use new app names or always include both existing and new content.