SPLK-3001

Which indexes are searched by default for CIM data models?A . notable and defaultB . summary and notableC . _internal and summaryD . All indexesView AnswerAnswer: D Explanation: Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?A . thawedPathB . tstatsHomePathC . summaryHomePathD . warmToColdScriptView AnswerAnswer: B Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

The option to create a Short ID for a notable event is located where?A . The Additional Fields.B . The Event Details.C . The Contributing Events.D . The Description.View AnswerAnswer: B Explanation: https://docs.splunk.com/Documentation/ES/6.4.1/User/Takeactiononanotableevent

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?A . Save the settings.B . Apply the correct tags.C . Run the correct search.D . Visit the CIM dashboard.View AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

Which of the following is a key feature of a glass table?A . Rigidity.B . Customization.C . Interactive investigations.D . Strong data for later retrieval.View AnswerAnswer: B

A newly built custom dashboard needs to be available to a team of security analysts In ES . How is It possible to Integrate the new dashboard?A . Add links on the ES home page to the new dashboard.B . Create a new role Inherited from es_analyst, make the dashboard...

When investigating, what is the best way to store a newly-found IOC?A . Paste it into Notepad.B . Click the “Add IOC” button.C . Click the “Add Artifact” button.D . Add it in a text note to the investigation.View AnswerAnswer: C

Which of these Is a benefit of data normalization?A . Reports run faster because normalized data models can be optimized for better performance.B . Dashboards take longer to build.C . Searches can be built no matter the specific source technology for a normalized data type.D . Forwarder-based inputs are more...

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance . What is the best practice for installing ES?A . Install ES on...

What kind of value is in the red box in this picture? A . A risk score.B . A source ranking.C . An event priority.D . An IP address rating.View AnswerAnswer: A Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/FormateventsforHTTPEventCollector