Self-assessment

This section will test you on what you have learned in this chapter. You will be given 10 questions with answers to choose from. The question pattern is the same as what we discussed in Chapter 1, in the Introducing the exam’s test pattern section. After the assessment, refer to the sections where you had difficulty answering questions; alternatively, you could refer to the official Splunk documentation. All the best!

1. The UF can store indexed data. Is this statement true or false?
   1. True.
   2. False.
2. Choose the statements that apply to UFs:
   1. The UF is a lightweight software binary that’s typically installed on the source machine.
   2. The UF requires a separate license from Splunk Inc.
   3. The UF can input data and optionally parse structured data (such as CSV, PSV, XML, or JSON).
   4. The UF resends the whole file from the beginning if it gets rebooted.
3. Choose the statements that apply to DSs:
   1. The DS is a Splunk instance and by default, it is enabled.
   2. Apps for forwarders...