A consultant is troubleshooting why a new data source produces events with incorrect timestamps in Splunk. The raw data contains a timestamp in the format 'dd/MMM/yyyy:HH:mm:ss' but Splunk is using the current time instead. The consultant has already verified that the sourcetype is correctly assigned. Which step in the event processing pipeline should the consultant focus on to resolve this issue?

Input phase, where the data is read from the source

Search-time processing, where field extractions are applied

Parsing, specifically the timestamp extraction phase

Indexing phase, where events are written to buckets

Which step is part of the indexer's processing when writing events to an index?

Executing search queries against the index

Creating and managing buckets to store the events

Compressing raw data to reduce storage usage

Applying field extractions to raw data

A company is ingesting web server logs that contain a mix of access logs and error logs in the same file. The consultant needs to separate these into different source types so they can be parsed differently. Which configuration should be used?

Use inputs.conf to specify multiple source types for a single input

Use props.conf to set a single source type for the entire file

Use a search-time field extraction to differentiate the logs

Use transforms.conf with a REGEX to set the source type based on the log content

A consultant is ingesting logs from a system that outputs data in UTF-16 encoding. The logs appear garbled in Splunk. The consultant needs to ensure Splunk correctly interprets the character set. Which configuration should be applied?

Set the ENCODING attribute in inputs.conf for the input

Set the CHARSET attribute in props.conf for the sourcetype

Use transforms.conf to convert the character set

Change the sourcetype to a predefined UTF-16 sourcetype

SplunkCore Certified Consultant

Domain 5Objective 2

Describe Event Processing and Data Pipelines CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Indexing domain, which accounts for 14% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

14%of the exam

Questions 6–10

6foundation · easy
Which configuration file is used to define parsing rules for specific source types in Splunk?
Select an answer first
7application · medium
A consultant is troubleshooting why a new data source produces events with incorrect timestamps in Splunk. The raw data contains a timestamp in the format 'dd/MMM/yyyy:HH:mm:ss' but Splunk is using the current time instead. The consultant has already verified that the sourcetype is correctly assigned. Which step in the event processing pipeline should the consultant focus on to resolve this issue?
Select an answer first
8foundation · easy
Which step is part of the indexer's processing when writing events to an index?
Select an answer first
9application · medium
A company is ingesting web server logs that contain a mix of access logs and error logs in the same file. The consultant needs to separate these into different source types so they can be parsed differently. Which configuration should be used?
Select an answer first
10application · medium
A consultant is ingesting logs from a system that outputs data in UTF-16 encoding. The logs appear garbled in Splunk. The consultant needs to ensure Splunk correctly interprets the character set. Which configuration should be applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Describe Event Processing and Data Pipelines CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Questions 6–10

Which configuration file is used to define parsing rules for specific source types in Splunk?

Which step is part of the indexer's processing when writing events to an index?

A company is ingesting web server logs that contain a mix of access logs and error logs in the same file. The consultant needs to separate these into different source types so they can be parsed differently. Which configuration should be used?

A consultant is ingesting logs from a system that outputs data in UTF-16 encoding. The logs appear garbled in Splunk. The consultant needs to ensure Splunk correctly interprets the character set. Which configuration should be applied?

Keep studying — Indexing