Self-assessment

You will be given 10 questions and answer to choose from. The pattern of the questions is the same as we discussed in Chapter 1. Post-assessment, refer to the sections related to anything you had difficulty answering questions about. Alternatively, you can refer to the Splunk documentation. All the best! Let’s get started.

1. Which conf file is required to define parsing settings for line breaking?
   1. outputs.conf
   2. line_breaker.conf
   3. props.conf
   4. server.conf
2. Does creating a conf file directly on the filesystem reload a Splunk configuration automatically?
   1. Yes
   2. No
3. How do you reload conf file changes on a standalone Splunk instance? (Select all that apply):
   1. Add the restart = true setting at the end of the conf file.
   2. Use a debug/refresh endpoint.
   3. Restart the Splunk instance.
   4. Do nothing – Splunk reloads them automatically.
4. As a data admin, you are tasked with adjusting the INDEXED_EXTRACTIONS settings for an app named MyApp, located in the /opt/splunkforwarder...