Inputs Overview SPLK-1003 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company needs to ingest data from a custom application that generates JSON events and sends them over HTTP. The application does not write to files and cannot be modified to use syslog. The Splunk admin needs to configure a way to receive this data with minimal changes to the application. Which input option should the admin use?

   • AConfigure a TCP input on a specific port.
   • BSet up a scripted input that pulls data from the application's API.
   • CUse the HTTP Event Collector (HEC) to receive the JSON events.
   • DMonitor a directory where the application writes logs.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which setting in inputs.conf is used to specify the character set encoding for a data input?

   • Asourcetype
   • Bhost
   • Ccharset
   • Dindex
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Splunk input option is best suited for collecting data from an external API that requires authentication and custom logic?

   • AWindows Event Log input
   • BScripted input
   • CNetwork input
   • DFile input
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During the input phase, what is the default behavior of Splunk regarding character set handling?

   • AIt ignores non-ASCII characters
   • BIt assumes the data is UTF-8 encoded
   • CIt converts all data to UTF-8
   • DIt detects the character set automatically
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the default behavior of Splunk regarding source type detection during the input phase?

   • AIt assigns the source type based on the host name
   • BIt requires the user to manually specify the source type for every input
   • CIt automatically assigns a source type based on the data's characteristics
   • DIt assigns the source type based on the file extension
   Reveal Solution Discussion Select an answer first