Online Access Free SPLK-1005 Exam Questions

Due to internal security policies, a Splunk Cloud administrator cannot send data directly to Splunk Cloud from certain data sources. Additional parsing and API-based data sources also need to be sent to Splunk Cloud. What forwarder type should the Splunk Cloud administrator use to satisfy these requirements within their environment?

• A.Heavy forwarder as an intermediate forwarder
• B.Universal forwarder as an intermediate forwarder
• C.Light forwarder as an intermediate forwarder
• D.Syslog-ng server with a universal forwarder

Given the following set of files, which of the monitor stanzas below will result in Splunk monitoring all of the files ending with .log?
Files:
/var/log/www1/secure.log
/var/log/www1/access.log
/var/log/www2/logs/secure.log
/var/log/www2/access.log
/var/log/www2/access.log.1

• A.[monitor:///var/log/*/*]
• B.[monitor:///var/log/*/*.log]
• C.[monitor:///var/log/.../*]
• D.[monitor:///var/log/.../*.log]

When using Splunk Universal Forwarders, which of the following is true?

• A.Any number of Universal Forwarders may connect directly to Splunk Cloud.
• B.Universal Forwarders must send data to an Intermediate Forwarder.
• C.No more than six Universal Forwarders may connect directly to Splunk Cloud.
• D.There must be one Intermediate Forwarder for every three Universal Forwarders.

Which of the following is a correct statement about Universal Forwarders?

• A.The default output bandwidth is 500KBps.
• B.A Universal Forwarder can be an Intermediate Forwarder.
• C.A Universal Forwarder must connect to Splunk Cloud via a Heavy Forwarder.
• D.The Universal Forwarder must be able to contact the license master.

When should Splunk Cloud Support be contacted?

• A.When unable to resolve issues or perform problem isolation.
• B.For scripted input troubleshooting.
• C.For all configuration changes.
• D.For resizing, license changes, or any purchases.