Inputs Overview SPLK-1003 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Splunk admin is setting up the HTTP Event Collector (HEC) for a new application that will send security logs. The admin wants to ensure that the events are tagged with a specific sourcetype and are sent to a dedicated index. The application will send the data in JSON format. What should the admin configure on the HEC token to meet these requirements?

   • ASet the default index and default sourcetype on the HEC token.
   • BSet the default host and default source on the HEC token.
   • CSet the token to use a custom character set encoding.
   • DConfigure the token to use a specific port and protocol.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Splunk admin is troubleshooting an issue where events from a new input are not appearing in the expected index. The admin has verified that the input is configured with the correct index and that the data is being received. What should the admin check next?

   • ACheck the parsing phase to see if the index is being overridden by props.conf.
   • BCheck the HEC token settings to see if the index is being overridden.
   • CCheck the indexing phase to see if the index is being overridden by the indexer.
   • DCheck the input phase to see if the index is being overridden by inputs.conf.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the HTTP Event Collector (HEC) in Splunk?

   • ATo run scripts that collect data from external APIs
   • BTo listen on TCP/UDP ports for syslog data
   • CTo receive data from applications via HTTP/HTTPS POST requests
   • DTo monitor files and directories for changes
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of setting a custom sourcetype in Splunk?

   • ATo change the index where data is stored
   • BTo apply specific parsing rules and field extractions to that data
   • CTo identify the host that generated the data
   • DTo compress the data before indexing
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following lists the three phases of the Splunk indexing process in the correct order?

   • AInput, Indexing, Parsing
   • BInput, Parsing, Indexing
   • CParsing, Input, Indexing
   • DIndexing, Parsing, Input
   Reveal Solution Discussion Select an answer first