SPLK-1003 Splunk Exam Lab Questions

Scripted Authentication: An option for Splunk Enterprise authentication. You can use an authentication system that you have in place (such as PAM or RADIUS) by configuring authentication.conf to use a script instead of using LDAP or Splunk Enterprise default authentication.

The outputs.conf file defines how forwarders send data to receivers1. You can specify some output configurations at installation time (Windows universal forwarders only) or the CLI, but most advanced configuration settings require that you edit outputs.conf1.

The [tcpout:…] stanza specifies a group of forwarding targets that receive data over TCP2. You can define multiple groups with different names and settings2.

The server setting lists one or more receiving hosts for the group, separated by commas2. If you specify multiple hosts, the forwarder load balances the data across them2.

Therefore, option A is correct, because the forwarder will send data to both inputsl.mysplunkhfs.corp:9997 and inputs2.mysplunkhfs.corp:9997, even if 145.188.183.184:9097 is unreachable.

[tcp:// < remote server > : < port > ]

*Configures the input to listen on a specific TCP network port.

*If a < remote server > makes a connection to this instance, the input uses this stanza to configure itself.

*If you do not specify < remote server > , this stanza matches all connections on the specified port.

*Generates events with source set to " tcp: < port > " , for example: tcp:514

*If you do not specify a sourcetype, generates events with sourcetype set to " tcp-raw "