What is the default character encoding used by Splunk during the input phase?

1. A. UTF-8
2. B. UTF-16
3. C. EBCDIC
4. D. ISO 8859

Correct Answer: A
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Configurecharactersetencoding

In which phase of the index time process does the license metering occur?

1. A. Input phase
2. B. Parsing phase
3. C. Indexing phase
4. D. Licensing phase

Correct Answer: C
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

How do you remove missing forwarders from the Monitoring Console?

1. A. By restarting Splunk.
2. B. By rescanning active forwarders.
3. C. By reloading the deployment server.
4. D. By rebuilding the forwarder asset table.

Correct Answer: D
Reference: https://answers.splunk.com/answers/447096/how-to-remove-missing-forwarders-from-the-distribu.html

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

1. A. Deployer
2. B. Cluster master
3. C. Deployment server
4. D. Search head cluster master

Correct Answer: A
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges

In which Splunk configuration is the SEDCMD used?

1. A. props.conf
2. B. inputs.conf
3. C. indexes.conf
4. D. transforms.conf

Correct Answer: A
Reference: https://answers.splunk.com/answers/212128/why-sedcmd-configured-in-propsconf-is-working-duri.html