Configure Forwarders to Be Deployment Clients CLOUD-CERTIFIED-ADMIN Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Splunk admin manages a hybrid environment with 500 universal forwarders. Some forwarders are on-premises, and some are in a cloud environment. The on-premises forwarders receive updates from an on-premises deployment server. The cloud forwarders receive updates from a deployment server in the cloud. The admin needs to migrate all forwarders to a single, new deployment server in the cloud. The admin has already configured the new deployment server and created the necessary server classes. What is the most efficient way to migrate the on-premises forwarders?

   • AUse the old on-premises deployment server to push a new deploymentclient.conf to all forwarders, then restart them.
   • BCreate a new server class on the old deployment server that includes the new deployment server's URI.
   • CUpdate the deploymentclient.conf on each on-premises forwarder to point to the new deployment server and restart the forwarders.
   • DReinstall the universal forwarder on all on-premises machines with the new deployment server specified.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Splunk admin has a deployment server managing forwarders with different operating systems. The admin has an app that contains OS-specific configuration files. The admin wants to ensure that Windows forwarders receive the Windows version of the app and Linux forwarders receive the Linux version. What is the best approach?

   • APlace both versions of the app in the same server class and let the forwarders choose the correct one.
   • BCreate two server classes, one for Windows and one for Linux, and associate the appropriate app version with each class.
   • CConfigure the forwarders to pull the app directly from a file share based on their OS.
   • DUse a single app with conditional logic in the configuration files to detect the OS.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has 200 Windows universal forwarders that currently send data to a Splunk Cloud deployment. The forwarders were installed with the default configuration and are not managed by any deployment server. The Splunk admin needs to push a new app that parses a custom log format to all forwarders. The admin has already created the app and placed it in the deployment server's apps directory. What must the admin do to ensure the forwarders receive and enable this app?

   • AOn each forwarder, edit inputs.conf to add the deployment server URI and set the deployment client to enabled, then restart the forwarder.
   • BOn the deployment server, create a server class that includes the app and assign the forwarders to that class using their hostnames.
   • COn the deployment server, edit the forwarder's outputs.conf to include the deployment server's management port.
   • DOn each forwarder, place the app in the local apps directory and restart the Splunk service.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Splunk admin manages a fleet of Linux universal forwarders that are deployment clients of a single deployment server. The admin needs to deploy a new version of a custom app that adds a new stanza to props.conf. The admin has updated the app in the deployment server's apps directory. What is the most efficient way to ensure all forwarders receive the updated app?

   • AWait for the next deployment client polling cycle, which occurs every 60 seconds by default.
   • BManually copy the updated app to each forwarder's apps directory and restart each forwarder.
   • CRestart the deployment server to force it to immediately push the updated app to all clients.
   • DIncrease the deployment client's phoneHomeIntervalInSecs setting on the deployment server to speed up the update.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which configuration file and stanza are used to configure a forwarder as a deployment client?

   • AIn deploymentclient.conf, under the [deployment-client] stanza, set the targetUri to the deployment server's host and management port.
   • BIn server.conf, under the [general] stanza, set the deploymentServer to the deployment server's host and management port.
   • CIn inputs.conf, under the [monitor] stanza, set the deploymentServer to the deployment server's host and management port.
   • DIn outputs.conf, under the [tcpout] stanza, set the server to the deployment server's host and management port.
   Reveal Solution Discussion Select an answer first