Splunk Core Certified User - 340 Questions

1. A new Splunk administrator wants to understand the core components of a Splunk deployment. Which component is responsible for storing indexed data and executing searches against that data?

2. A company has thousands of servers generating log data and wants to send that data to Splunk with minimal resource usage on the source machines. Which Splunk component is BEST suited for this task?

3. A Splunk architect is designing a large enterprise deployment and needs to filter sensitive data, route events to specific indexes based on sourcetype, and perform data transformation before the data reaches the Indexer. Which Splunk component is capable of ALL these functions?

4. A Splunk user opens Splunk Web and wants to start searching their data. Which default app should they navigate to in order to run ad-hoc SPL searches?

5. A Splunk user types a search in the search bar without specifying any index. Which index does Splunk search by default?