Scripted and WMI Inputs SPLK-1003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a typical data source that a WMI input can collect?

   • AJSON output from a REST API
   • BApache web server access logs
   • CSyslog messages from a Linux firewall
   • DCPU usage and memory statistics from a Windows server
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Splunk administrator created a scripted input that runs a Python script to collect data from an API. The script outputs JSON data to standard output. The administrator notices that the data is being indexed as a single event with the entire JSON payload, rather than being broken into individual events. The administrator wants each JSON object to be a separate event. What should the administrator do?

   • AConfigure the source type with a line-breaking regex that splits on JSON object boundaries
   • BIncrease the MAX_EVENTS setting in props.conf
   • CModify the script to output each JSON object on a separate line
   • DUse the HTTP Event Collector instead of a scripted input
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When creating a scripted input in Splunk Web, which of the following settings must you specify?

   • AThe hostname of the server that will run the script
   • BThe full path to the script and the interval at which to run it
   • CThe username and password for the script to use
   • DThe port number that the script will listen on
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the role of a WMI namespace in a WMI input?

   • AIt defines the scope of the WMI query, such as root\cimv2
   • BIt sets the source type for the collected data
   • CIt determines the index where the data will be stored
   • DIt specifies the username for WMI authentication
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Windows administrator created a PowerShell script that collects disk space information and writes the results to standard output. When the script is run manually, it displays the data correctly. However, after configuring it as a scripted input in Splunk, no events are appearing. The script also writes diagnostic messages to standard error. What is the most likely reason the scripted input is not producing events?

   • AThe script is not executable by the Splunk service account
   • BThe script writes its output to standard error instead of standard output
   • CThe script requires an interactive session to run
   • DThe script output format is not recognized by Splunk
   Reveal Solution Discussion Select an answer first