SPLK-1005 Exam - Free Actual Q&As, Page 1

SPLK-1005 Actual Exam Questions

Last updated on Dec. 10, 2024.

Vendor:Splunk

Exam Code:SPLK-1005

Exam Name:Splunk Cloud Certified Admin

Exam Questions:60

Question #1 Topic 1

When monitoring directories that contain mixed file types, which setting should be omitted from inputs.conf and instead be overridden in props.conf?

Correct Answer: A 🗳️

Question #2 Topic 1

How are HTTP Event Collector (HEC) tokens configured in a managed Splunk Cloud environment?

A. Any token will be accepted by HEC, the data may just end up in the wrong index.
B. A token is generated when configuring a HEC input, which should be provided to the application developers.
C. Obtain a token from the organization’s application developers and apply it in Settings > Data Inputs > HTTP Event Collector > New Token.
D. Open a support case for each new data input and a token will be provided.

Correct Answer: B 🗳️

Question #3 Topic 1

The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

A. The value of the TZ attribute in props.conf for the access_combined sourcetype.
B. The value of the TZ attribute in props.conf for the my.webserver.example host.
C. The time zone of the Heavy/Intermediate Forwarder with the monitor input.
D. The time zone indicator in the raw event data.