Discuss Splunk SPLK-1003 Exam Topic 1 Question 97

When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

AOn Universal Forwarder, $SPLUNK_HOME/etc/apps

BOn Deployment Server, $SPLUNK_HOME/etc/apps

COn Deployment Server, $SPLUNK_HOME/etc/deployment-apps

DOn Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps

Suggested Answer: C

The correct answer is C. On Deployment Server, $SPLUNK_HOME/etc/deployment-apps.

A deployment server is a Splunk Enterprise instance that acts as a centralized configuration manager for any number of other instances, called ''deployment clients''. A deployment client can be a universal forwarder, a non-clustered indexer, or a search head1.

A deployment app is a directory that contains any content that you want to download to a set of deployment clients. The content can include a Splunk Enterprise app, a set of Splunk Enterprise configurations, or other content, such as scripts, images, and supporting files2.

You create a deployment app by creating a directory for it on the deployment server. The default location is $SPLUNK_HOME/etc/deployment-apps, but this is configurable through the repositoryLocation attribute in serverclass.conf. Underneath this location, each app must have its own subdirectory. The name of the subdirectory serves as the app name in the forwarder management interface2.

The other options are incorrect because:

A) On Universal Forwarder, $SPLUNK_HOME/etc/apps. This is the location where the deployment app resides after it is downloaded from the deployment server to the universal forwarder. It is not the location of the app before it is deployed2.

B) On Deployment Server, $SPLUNK_HOME/etc/apps. This is the location where the apps that are specific to the deployment server itself reside. It is not the location where the deployment apps for the clients are stored2.

D) On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps. This is not a valid location for any app on a universal forwarder. The universal forwarder does not act as a deployment server and does not store deployment apps3.

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

38 comments · newest first

Franklyn 10 months ago

I always get confused with these locations! Thanks for clarifying!

Lilli 11 months ago

Nope, definitely C! That's the standard practice.

Sylvia 11 months ago

Wait, are you sure? I thought it was A.

Paris 11 months ago

Totally agree, C is the correct answer!

Avery 11 months ago

It's C, right? Deployment apps go in $SPLUNK_HOME/etc/deployment-apps.

Shawn 12 months ago

I'm a bit confused; I thought the app was supposed to be on the Universal Forwarder itself, but that doesn't seem right for deployment.

Bette 12 months ago

I practiced a similar question, and I believe the correct answer is C, where the app is on the Deployment Server in the $SPLUNK_HOME/etc/deployment-apps directory.

Donte 12 months ago

I remember something about the apps being stored on the Deployment Server, but I can't recall if it's in the apps or deployment-apps folder.

Melissia 1 year ago

I think the app needs to be on the Deployment Server in the deployment-apps directory, but I'm not entirely sure if that's correct.

Shawnda 1 year ago

I'm pretty confident that the correct answer is C. The deployment server is where the apps are staged before being pushed out to the Universal Forwarders, and they need to be in the deployment-apps folder specifically.

Kathryn 1 year ago

I'm a little confused by this question. Is the app being deployed directly to the Universal Forwarder, or is it going through the deployment server first? I want to make sure I understand the process before I answer.

Trevor 1 year ago

Okay, I've got this. The apps need to be in the $SPLUNK_HOME/etc/deployment-apps folder on the deployment server before they can be deployed to the Universal Forwarders. That's the correct location, so the answer is C.

Katie 1 year ago

I think the correct answer is C. The deployment server is where the apps are stored before they are deployed to the Universal Forwarders.

Jacklyn 1 year ago

Hmm, I'm not sure about this one. I know the apps need to be on the deployment server, but I can't remember if they go in the regular apps folder or the deployment-apps folder. I'll have to think this through carefully.

Lashandra 1 year ago

Ah, I remember this from the training! The correct answer is C, "set cluster member state down in Clish". That's the proper way to manually failover a Multi-Version Cluster during an upgrade. Glad I brushed up on that before the exam.

Susana 2 years ago

That's a good point, Fausto. Having the app on the Universal Forwarder ensures that it is ready for deployment without any delays.

Mabel 2 years ago

I'm going to have to go with C. The Deployment Server is where the app needs to be before it gets deployed. It's like a pre-deployment staging area.

Florencia 2 years ago

↳ replying to Mabel

I see. So, it's important to have the app in the right location before deploying it to the Universal Forwarders.

Theodora 2 years ago

↳ replying to Mabel

Exactly. It helps keep everything organized and makes the deployment process smoother.

Keneth 2 years ago

↳ replying to Mabel

That makes sense. It's like a central location for all the apps before they get deployed.

Cherry 2 years ago

↳ replying to Mabel

C) On Deployment Server, $SPLUNK_HOME/etc/deployment-apps

Fausto 2 years ago

But wouldn't it make more sense for the app to be on the Universal Forwarder first, before deploying it from the Deployment Server?

Desiree 2 years ago

I believe the app should be on the Deployment Server, so the answer is B) On Deployment Server, $SPLUNK_HOME/etc/apps.

Susana 2 years ago

I agree with Fausto, the app should be on the Universal Forwarder before deployment.

Fausto 2 years ago

I think the correct answer is A) On Universal Forwarder, $SPLUNK_HOME/etc/apps.

Vicki 2 years ago

This is a trick question! The app should be on both the Deployment Server and the Universal Forwarder. Gotta cover all the bases, am I right?

Jamal 2 years ago

↳ replying to Vicki

C) On Deployment Server, $SPLUNK_HOME/etc/deployment-apps

Maricela 2 years ago

↳ replying to Vicki

B) On Deployment Server, $SPLUNK_HOME/etc/apps

Margery 2 years ago

↳ replying to Vicki

A) On Universal Forwarder, $SPLUNK_HOME/etc/apps

Tayna 2 years ago

I'm going with B. The app has to be in the apps directory on the Deployment Server. Why would it be on the Universal Forwarder?

Arlene 2 years ago

D has to be the right answer. The app should be in the deployment-apps directory on the Universal Forwarder, right?

Luz 2 years ago

↳ replying to Arlene

D) On Universal Forwarder, $SPLUNK_HOME/etc/deployment-apps

Raina 2 years ago

↳ replying to Arlene

C) On Deployment Server, $SPLUNK_HOME/etc/deployment-apps

Gerry 2 years ago

↳ replying to Arlene

B) On Deployment Server, $SPLUNK_HOME/etc/apps

Novella 2 years ago

↳ replying to Arlene

A) On Universal Forwarder, $SPLUNK_HOME/etc/apps

Lisandra 2 years ago

I'm pretty sure the correct answer is C. The app needs to be on the Deployment Server, not the Universal Forwarder.

Mari 2 years ago

↳ replying to Lisandra

Yes, the correct location for the app before deployment is on the Deployment Server in $SPLUNK_HOME/etc/deployment-apps.

Goldie 2 years ago

↳ replying to Lisandra

I think you're right, the app should be on the Deployment Server before it is deployed.

Splunk SPLK-1003 Exam - Topic 1 Question 97 Discussion