A Splunk administrator needs to collect WMI data from a Windows server that is behind a firewall. The firewall only allows traffic on port 135 and dynamic ports 49152-65535. The administrator is configuring a WMI input on a universal forwarder to collect data from this remote server. What should the administrator verify to ensure the WMI input will work?

The forwarder has the correct WMI credentials for the remote server

The remote server has WMI enabled and the Winmgmt service is running

The firewall allows outbound traffic from the forwarder to the remote server on port 135 and the dynamic port range

The remote server is configured to use a fixed WMI port

A company has a custom in-house application that writes operational metrics to a proprietary binary file format. The application does not have a native Splunk integration. The Splunk administrator needs to ingest these metrics into Splunk for monitoring and alerting. Which approach should the administrator use?

Configure a monitor input to watch the binary file and index it directly

Use the HTTP Event Collector to send the binary file contents to Splunk

Create a scripted input that runs a script to read the binary file and output the metrics in a text format to standard output

Use a WMI input to query the application's binary file directly

A company has a legacy application that writes data to a text file in a custom format. The application runs on a schedule and the data needs to be ingested into Splunk. The administrator wants to use a scripted input to process the file. Which approach should the administrator take?

Configure a monitor input to watch the file and index it directly

Use the HTTP Event Collector to send the file contents to Splunk

Use a WMI input to query the file contents

Create a script that reads the file, transforms the data, and outputs it to standard output, then configure it as a scripted input

A Splunk administrator created a scripted input that runs a Perl script to collect database statistics. The script outputs data in a multi-line format with each line containing a key-value pair. The administrator notices that the data is being indexed as a single event instead of multiple events. What is the most likely cause?

The source type is not configured correctly

The script is outputting data to standard error

The script is not outputting a newline character at the end of each line

What is the primary purpose of a scripted input in Splunk?

To monitor files and directories on a local or remote filesystem

To collect Windows management data using WMI queries

To receive data over a network port from a TCP or UDP sender

To collect data from external sources by running a script that outputs data to standard output

SplunkEnterprise Certified Admin

Domain 3Objective 5

Scripted and WMI Inputs SPLK-1003 Practice Questions (Page 4)

Part of the Getting Data In domain, which makes up ~17% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

8concepts

Questions 16–20

16expert · hard
A Splunk administrator needs to collect WMI data from a Windows server that is behind a firewall. The firewall only allows traffic on port 135 and dynamic ports 49152-65535. The administrator is configuring a WMI input on a universal forwarder to collect data from this remote server. What should the administrator verify to ensure the WMI input will work?
Select an answer first
17application · medium
A company has a custom in-house application that writes operational metrics to a proprietary binary file format. The application does not have a native Splunk integration. The Splunk administrator needs to ingest these metrics into Splunk for monitoring and alerting. Which approach should the administrator use?
Select an answer first
18application · medium
A company has a legacy application that writes data to a text file in a custom format. The application runs on a schedule and the data needs to be ingested into Splunk. The administrator wants to use a scripted input to process the file. Which approach should the administrator take?
Select an answer first
19application · medium
A Splunk administrator created a scripted input that runs a Perl script to collect database statistics. The script outputs data in a multi-line format with each line containing a key-value pair. The administrator notices that the data is being indexed as a single event instead of multiple events. What is the most likely cause?
Select an answer first
20foundation · easy
What is the primary purpose of a scripted input in Splunk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1003” is a trademark of its owner, used for identification only.

Scripted and WMI Inputs SPLK-1003 Practice Questions (Page 4)

Questions 16–20

A company has a legacy application that writes data to a text file in a custom format. The application runs on a schedule and the data needs to be ingested into Splunk. The administrator wants to use a scripted input to process the file. Which approach should the administrator take?

What is the primary purpose of a scripted input in Splunk?

Keep studying — Getting Data In