Use btool to Examine Configuration Settings/ Splunk Indexes/ Describe Index Structure/ List Types of Index Buckets/ Check Index Data Integrity/ Describe Indexes.conf Options
Describe the Fishbucket/ Apply a Data Retention Policy/ Splunk User Management/ Describe User Roles in Splunk/ Create a Custom Role/ Add Splunk Users
Splunk Authentication Management/ Integrate Splunk with LDAP/ List Other User Authentication Options/ Describe the Steps to Enable Multifactor Authentication in Splunk
Describe the Basic Settings for an Input/ List Splunk Forwarder Types/ Configure the Forwarder/ Add an Input to UF Using CLI
Describe How Distributed Search Works/ Explain the Roles of the Search Head and Search Peers/ Configure a Distributed Search Group/ List Search Head Scaling Options
List the Three Phases of the Splunk Indexing Process/ List Splunk Input Options
Identify Additional Forwarder Options/ Explain the Use of Deployment Management/ Describe Splunk Deployment Server/ Manage Forwarders Using Deployment Apps
Configure Deployment Clients/ Create File and Directory Monitor Inputs/ Use Optional Settings for Monitor Inputs/ Describe Optional Settings for Network Inputs
Deploy a Remote Monitor Input/ Network and Scripted Inputs/ Create Network (TCP and UDP) Inputs/ Identify Windows Input Types and Uses/ Create a Basic Scripted Input
Describe HTTP Event Collector/ Understand the Default Processing that Occurs During Input Phase/ Configure Input Phase Options, Such as Sourcetype Fine-Tuning and Character Set Encoding
Parsing Phase and Data/ Understand the Default Processing that Occurs During Parsing/ Optimize and Configure Event Line Breaking/ Explain How Timestamps and Time Zones are Extracted or Assigned to Events
Manipulating Raw Data/ Use Data Preview to Validate Event Creation During the Parsing Phase/ Explain How Data Transformations are Defined and Invoked
Mask or Delete Raw Data as it is being Indexed/ Override Sourcetype or Host Based Upon Event Values/ Route Events to Specific Indexes Based on Event Content