Splunk Enterprise Certified Architect v1.0

Which of the following are true statements about Splunk indexer clustering?

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

At which default interval does metrics.log generate a periodic report regarding license utilization?

Which of the following is a good practice for a search head cluster deployer?

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Which Splunk internal index contains license-related events?

Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

Which search will show all deployment client messages from the client (UF)?

Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

Configurations from the deployer are merged into which location on the search head cluster member?

When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?