Splunk Enterprise Certified Admin SPLK-1003 questions with correct answers

Which setting in allows data retention to be controlled by time? CORRECT ANSWER frozenTimePeriodInSecs The universal forwarder has which capabilities when sending data? (2 answers) CORRECT ANSWER Compressing data Indexer acknowledgement In case of a conflict between a whitelist and a blacklist input setting, which one is used? CORRECT ANSWER Blacklist In which Splunk configuration is the SEDCMD used? CORRECT ANSWER Which of the following are supported configuration methods to add inputs on a forwarder? (2 answers) CORRECT ANSWER CLI Edit Which parent directory contains the configuration files in Splunk? CORRECT ANSWER $SPLUNK_HOME/etc What are two native ways to filter and process incoming events before they're indexed by Splunk? (hint: SEDCMD