Inputs Overview SPLK-1003 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Splunk admin is configuring HEC for a new application that will send events with varying sourcetypes. The application will send a 'sourcetype' field in the JSON payload for each event. The admin wants to ensure that the sourcetype specified in the payload is used, rather than a default. What should the admin configure?

   • ASet the index to 'main' and rely on automatic sourcetype detection.
   • BConfigure the token to ignore the sourcetype field in the payload.
   • CLeave the default sourcetype blank on the HEC token.
   • DSet the default sourcetype to 'hec' on the HEC token.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk admin notices that events from a new input are being indexed with the wrong timestamp. The log files contain timestamps in the format '14/May/2024:10:30:00' but Splunk is extracting the date as '2024-05-14' correctly while the time is being set to the current time instead of '10:30:00'. The admin has verified that the input is configured correctly and the data is being parsed. In which phase of the indexing process should the admin focus their troubleshooting?

   • AIndexing phase, because the timestamp is written to the index at this stage.
   • BInput phase, because timestamp extraction is configured here.
   • CInput phase, because character set encoding is handled here and affects timestamps.
   • DParsing phase, because timestamp extraction and sourcetype detection occur here.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During which phase of the Splunk indexing process does Splunk break data into individual events and extract timestamps?

   • ASearch phase
   • BInput phase
   • CParsing phase
   • DIndexing phase
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Splunk admin is troubleshooting an issue where events are being indexed but the sourcetype is incorrect. The admin has verified that the input is configured correctly and the data is being received. In which phase of the indexing process should the admin look for the cause of the incorrect sourcetype?

   • AInput phase, because character set encoding affects sourcetype.
   • BIndexing phase, because sourcetype is written to the index here.
   • CInput phase, because sourcetype is assigned here.
   • DParsing phase, because sourcetype detection and overrides occur here.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is required to send data to Splunk using the HTTP Event Collector?

   • AA scripted input configured in Splunk
   • BA universal forwarder installed on the client
   • CA TCP port open on the Splunk server
   • DA valid HEC token
   Reveal Solution Discussion Select an answer first