Free SPLK-2001 sample questions

How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

• No need to do anything, it is turned on by default.
• When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1.
• When a new HEC token is created in Splunk Web, select the checkbox labeled “Enable indexer acknowledgement'.
• When the Global Settings for HEC are updated in Splunk Web, select the checkbox labeled “Enable indexer acknowledgement'.

After updating a dashboard in myApp, a Splunk admin moves myApp to a different Splunk instance. After logging in to the new instance, the dashboard is not seen. What could have happened? (Select all that apply.)

• The dashboard’s permissions were set to private.
• User role permissions are different on the new instance.
• The admin deleted the myApp/local directory before packaging.
• Changes were placed in: $SPLUNK_HOME/etc/apps/search/default/data/ui/nav

Which of the following statements define a namespace?

• The namespace is a combination of the user and the app.
• The namespace is a combination of the user, the app, and the role.
• The namespace is a combination of the user, the app, the role, and the sharing level.
• The namespace is a combination of the user, the app, the role, the sharing level, and the permissions.

Which of the following are characteristics of an add-on? (Select all that apply.)

• Requires navigation file.
• Occupies a unique namespace within Splunk.
• Can depend on add-ons for correct operation.
• Contains technology or components not intended for reuse by other apps.

Which of the following statements describe oneshot searches? (Select all that apply.)

• Are always executed asynchronously.
• Can specify csv as an output format.
• Stream all results upon search completion.
• Can use auto_cancel to set a timeout limit.

Which of the following options would be the best way to identify processor bottlenecks of a search?

• Using the REST API.
• Using the search job inspector.
• Using the Splunk Monitoring Console.
• Searching the Splunk logs using index=_internal.

Which of the following is true of a namespace?

• The namespace is a type of token filter.
• The namespace includes an app attribute which cannot be a wildcard.
• The namespace filters the knowledge objects returned by the REST API.
• The namespace does not filter knowledge objects returned by the REST API.

What must be done when calling the serviceNS endpoint?

• Authenticate with an admin user.
• Authenticate with the user of the required context.
• Specify the user and app context in the URI.
• Pass the user and app context in the request payload.

A developer is building a custom application for a logistics company. The app requires a dashboard that displays shipment statuses. The developer needs to initialize a token named `default_region` to the value "NorthAmerica" as soon as the dashboard loads, before any user interaction occurs. Which Simple XML element should be used to achieve this?

A security operations team needs to export a large volume of search results (approx. 500,000 events) from a Splunk search job using a Python script. They want to minimize memory usage on the client side by processing results as they stream. Which REST endpoint and output_mode combination is optimal for this requirement?

• Endpoint: /services/search/jobs; output_mode: atom
• Endpoint: /servicesNS/admin/search; output_mode: raw
• Endpoint: /services/search/jobs/export; output_mode: json
• Endpoint: /services/search/jobs/{sid}/results; output_mode: xml

A developer is creating a KV Store collection named `device_inventory` to store hardware asset details. The collection must support a hierarchy of users where only the `admin` role can write data, but `power` users can read it. Which configuration file must be modified to define the collection structure, and which file handles the access control list (ACL)? (Select TWO)

• metadata/local.meta
• inputs.conf
• transforms.conf
• collections.conf
• authorize.conf

While developing a dashboard for a financial application, you need to pass a token named `account_id` to a drilldown URL. The `account_id` value might contain spaces or special characters that could break the URL structure. Which token filter should be applied to ensuring the value is properly URL-encoded?

• $account_id|u$
• $account_id|h$
• $account_id|s$
• $account_id|n$