Splunk Exam SPLK-1003 Topic 10 Question 71 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 71
Topic #: 10

[All SPLK-1003 Questions]

The following stanzas in inputs. conf are currently being used by a deployment client:

[udp: //145.175.118.177:1001

Connection_host = dns

sourcetype = syslog

Which of the following statements is true of data that is received via this input?

AIf Splunk is restarted, data will be queued and then sent when Splunk has restarted.

BLocal firewall ports do not need to be opened on the deployment client since the port is defined in inputs.conf.

CThe host value associated with data received will be the IP address that sent the data.

DIf Splunk is restarted, data may be lost.

Show Suggested Answer

Suggested Answer: C

by Eden at May 24, 2023, 03:15 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rodolfo

25 days ago

Haha, option A made me chuckle. Queuing data and then sending it when Splunk restarts? That sounds more like a wishful thinking than a true statement!

upvoted 0 times

...

Janae

28 days ago

This is a tricky one! I'd say the funniest answer is probably option A - 'If Splunk is restarted, data will be queued and then sent when Splunk has restarted.' That's a bit of a stretch, isn't it?

upvoted 0 times

...

Peggie

29 days ago

Option C sounds good to me. Since the connection_host is set to 'dns', the host value associated with the data should be the IP address that sent the data, not the Splunk server's IP.

upvoted 0 times

Margarita

9 days ago

I agree, option C seems to be the correct choice.

upvoted 0 times

...

Hyman

2 months ago

I'm leaning towards B) Local firewall ports do not need to be opened on the deployment client since the port is defined in inputs.conf. It just makes sense to me.

upvoted 0 times

...

Eden

2 months ago

I disagree, I believe the correct answer is D) If Splunk is restarted, data may be lost because it's not guaranteed to be queued.

upvoted 0 times

...

Adell

2 months ago

I think the answer is A) If Splunk is restarted, data will be queued and then sent when Splunk has restarted.

upvoted 0 times

...

Avery

2 months ago

I'm leaning towards B. Local firewall ports don't need to be opened.

upvoted 0 times

...

Laticia

2 months ago

I'm not sure about option B. Even though the port is defined in inputs.conf, I think you'd still need to open the firewall ports on the deployment client to allow the traffic to flow through.

upvoted 0 times