SplunkCore Certified Consultant
Domain 4Objective 4
Describe Ways to Troubleshoot Data Inputs CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)
Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)
22questions here
5free pages
6concepts
15%of the exam
Questions 6–10
- 6
A TCP data input is not receiving data. Which of the following is a common cause?
Select an answer first - 7
A consultant is troubleshooting an issue where events from a specific log file are being indexed with the wrong host. The forwarder's inputs.conf has `host = server1`, but the events show `host = server2`. The consultant sends a test event using `tcp` to the forwarder's port, and the test event also shows `host = server2`. What is the most likely cause?
Select an answer first - 8
A user reports that events from a new data input appear in Splunk but are not showing up in the expected index. Which common data input issue is most likely the cause?
Select an answer first - 9
Which Splunk internal log is most useful for diagnosing why a specific data input is failing to collect data?
Select an answer first - 10
Which internal log would you examine to check the queue size and throughput of a data input?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.