Splunk · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?
It errors out if the input is not found
It prevents the input from running
Setting disabled=1 in an inputs.conf stanza stops Splunk from starting or continuing that input, so no data is collected from it. The stanza remains in the configuration for later re-enabling, but the input itself does not run.
It deletes the input
It hides the input from the UI
You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?
The system/local value
The configuration with the most recent timestamp
The app/local value
Splunk merges configuration by precedence, and app/local sits above system/local in the layer order. Because the app context is more specific than the system context, its inputs.conf stanza overrides the identical setting defined under system/local, so the app value wins.
The configuration alphabetically first
Which configuration file is used to define index-time field extractions and line-breaking rules?
indexes.conf
transforms.conf
inputs.conf
props.conf
props.conf governs index-time parsing: it holds LINE_BREAKER, SHOULD_LINEMERGE and TRANSFORMS settings that split events and route extracted fields before indexing. transforms.conf only defines the regex and destination; props.conf binds those transforms to the sourcetype, satisfying the stem's index-time extraction and line-breaking requirement.
You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?
$SPLUNK_HOME/etc/system/default/
$SPLUNK_HOME/etc/apps/app_name/local/
The local directory inside the app overrides default settings without modifying shipped files, satisfying the requirement to avoid editing the default directory. Splunk merges configuration with local taking precedence, so your changes persist through upgrades and remain scoped to that specific app.
$SPLUNK_HOME/etc/users/admin/
$SPLUNK_HOME/etc/apps/app_name/default/
If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?
The App/default value
The app with the highest priority in app.conf
They are merged alphabetically
The System/local value
System-level configuration in `$SPLUNK_HOME/etc/system/local/` takes precedence over an app's `default` directory, because Splunk's precedence order ranks system local above app default. This satisfies the stem's conflict: the same stanza and key in both files resolves to the system/local value.
You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?
transforms.conf
Routing regexes are defined in transforms.conf, where a stanza with REGEX and DEST_KEY (typically _MetaData:Index) performs the index assignment. props.conf merely references that transform via TRANSFORMS-<class>, so it cannot hold the regex itself. This satisfies the stem's requirement to define the routing regex.
indexes.conf
props.conf
inputs.conf
Want more Configuration Files practice?
Practice this domainWhich Splunk component is primarily responsible for parsing and indexing incoming data streams?
Indexer
The indexer performs parsing and indexing of incoming data streams, satisfying the stem's requirement for the component primarily responsible for these tasks. It receives raw data from forwarders, breaks it into events, applies timestamp recognition and transforms, then writes the results to disk-based buckets for searching.
Deployment Server
Universal Forwarder
Search Head
When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?
The indexer is not configured in the search head cluster.
Another process is already using the port.
Port 9997 can only be bound by one process at a time. If another service already holds that port, splunkd cannot bind and fails to start listening, which is the most likely cause of the binding failure described.
The license is expired.
The indexer is missing a forwarder license.
An administrator needs to change the default maximum size of an index. Which file should be modified?
server.conf
indexes.conf
`indexes.conf` defines per-index settings, including `maxTotalDataSizeMB`, the parameter governing an index's maximum size on disk. Editing it in `$SPLUNK_HOME/etc/system/local/` overrides the default without being lost on upgrade, satisfying the requirement to change the default maximum index size.
props.conf
limits.conf
You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?
$SPLUNK_HOME/etc/system/default/
$SPLUNK_HOME/etc/manager/local/
$SPLUNK_HOME/etc/system/local/
Placing outputs.conf in $SPLUNK_HOME/etc/system/local/ gives the forwarder its own configuration, overriding any app-level defaults. This satisfies the stem's requirement to define outputs.conf so the forwarder balances traffic across all indexers via its configured indexer list.
$SPLUNK_HOME/etc/apps/search/local/
You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?
outputs.conf
inputs.conf
indexes.conf
props.conf
BREAK_ONLY_BEFORE is a line-breaking attribute used by the line merger during index-time parsing. It belongs in props.conf, within the stanza for the relevant source type or host, so the indexer groups multiline events correctly before indexing.
An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?
Settings -> Forwarder Management
Settings -> Data Inputs -> Add new
Settings -> Apps -> Install app from file
Splunk Web's Settings menu exposes Apps, where "Install app from file" uploads a local package directly. This path works on a standalone Search Head without a deployment server or cluster manager, satisfying the stem's constraint of installing the add-on locally on that single instance.
Settings -> Server Settings -> System Settings
Want more Splunk Admin Basics practice?
Practice this domainWhich file stores the definitions of roles and their associated capabilities?
authorize.conf
`authorize.conf` defines roles and their capability assignments, mapping each role to specific capabilities via the `[role_<name>]` stanzas and `capabilities` or `importRoles` settings. This directly satisfies the stem's requirement for the file storing role definitions and their associated capabilities, unlike `authentication.conf` or `web.conf`.
indexes.conf
authentication.conf
limits.conf
What is the default role assigned to a new user account if no other role is specified?
admin
power
user
Splunk assigns the built-in **user** role by default when no role is specified during account creation, satisfying the stem's "no other role specified" constraint. This role grants search capabilities over assigned indexes but withholds administrative privileges such as configuration changes, ensuring least privilege until an administrator explicitly elevates the account.
can_delete
A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?
Both index1 and index2.
Splunk unions `srchIndexesAllowed` across all inherited roles, so the user's effective index permissions are the combined set: index1 from RoleA plus index2 from RoleB. No intersection or precedence applies here, satisfying the stem's requirement that both roles are inherited simultaneously.
Only index1.
Only index2.
No indexes.
If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?
delete
The delete capability governs use of the delete command, which removes indexed events. Removing it from the role's capability set blocks that user from running delete, directly satisfying the stem's requirement to prevent the command.
edit_search
can_delete_data
admin_all_objects
You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?
server.conf
SAML Configuration in Splunk Web.
Attribute-to-field mappings such as email to realName are defined in the SAML configuration under Settings > Authentication Method in Splunk Web, where the identity provider's attribute names are bound to Splunk user fields. This is the only place that mapping takes effect.
authorize.conf
web.conf
Which menu path in Splunk Web is used to manage existing user roles?
Settings > Access controls > Roles
Settings > Access controls > Roles opens the role management page in Splunk Web, where existing roles are listed, edited, and assigned capabilities. This exact menu path satisfies the stem's requirement for managing existing user roles.
Settings > Authentication method
Settings > Server settings
Settings > Access controls > Users
Want more User And Authentication Management practice?
Practice this domainWhat is the primary function of the Deployment Server?
Indexing data
Centralized management of configuration files
The Deployment Server centrally distributes configuration files and apps to forwarders through server classes, satisfying the requirement for managing many distributed instances from one point. It pushes updated configurations to clients via phone-home, rather than relying on manual edits per host, which is precisely the centralised management role described.
Parsing data
Performing searches
A Universal Forwarder is failing to send data to the Indexer. The indexer shows no incoming traffic. Where is the first place you should check for errors?
$SPLUNK_HOME/var/log/splunk/splunkd.log
The Universal Forwarder's own splunkd.log records connection failures, parsing errors and output pipeline issues before any data leaves the host. Since the indexer shows no incoming traffic, the fault lies on the forwarder side, so checking $SPLUNK_HOME/var/log/splunk/splunkd.log first isolates whether the forwarder is failing to connect or failing to read its inputs.
The Splunk Web UI on the Indexer
$SPLUNK_HOME/etc/system/local/inputs.conf
$SPLUNK_HOME/etc/apps/search/local/indexes.conf
You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?
props.conf and transforms.conf
Filtering before indexing requires the parsing phase on the Heavy Forwarder, where `props.conf` triggers a transform and `transforms.conf` defines the regex-based `DEST_KEY` or nullQueue action. This satisfies the stem's constraint that sensitive data never reaches the Indexer, since filtering happens in the ingestion pipeline rather than at search time.
outputs.conf
server.conf
inputs.conf
You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?
$SPLUNK_HOME/var/run/
/opt/scripts/
/tmp/
$SPLUNK_HOME/etc/apps/my_app/bin/
Scripts referenced by scripted inputs must live in an app's bin directory so Splunk resolves the relative path and runs them with the correct environment. Storing it under $SPLUNK_HOME/etc/apps/my_app/bin/ satisfies the Universal Forwarder's requirement that the script be packaged within an app.
Which capability is exclusive to a Heavy Forwarder compared to a Universal Forwarder?
Collecting local files
Parsing data
Heavy Forwarders run the full Splunk parsing pipeline, including index-time transformations, field extraction and line breaking, before forwarding. Universal Forwarders only collect and send raw data, leaving parsing to the indexer, which is the exclusive capability here.
Connecting to a Deployment Server
Forwarding data
Which protocol is the default used by Splunk Universal Forwarders to communicate with Indexers?
Syslog
S2S (Splunk-to-Splunk)
Splunk-to-Splunk (S2S) is the proprietary protocol Universal Forwarders use by default to send data to indexers, operating over TCP port 9997. It carries raw events plus metadata and handles acknowledgement and compression, unlike syslog or HTTP Event Collector, which serve different ingestion paths.
HTTP
SNMP
Want more Getting Data IN And Forwarder Management practice?
Practice this domainWhat happens to data when a bucket rolls to 'frozen'?
It is archived to the coldPath.
It is moved to a read-only state.
It is moved to the warmPath.
It is deleted by default.
When a bucket rolls to frozen, Splunk deletes it by default unless a frozenTimePeriodInSecs archive path is configured, so the data is removed from the index. This satisfies the stem's question about default frozen-bucket behaviour.
Which Splunk component is responsible for orchestrating the transition of buckets from warm to cold?
Indexer
The indexer manages bucket lifecycle, including the warm-to-cold transition, by rolling buckets once they exceed the home path's size or age limits. This satisfies the stem's requirement for the orchestrating component, as indexers own all bucket states and execute the roll and freeze operations locally.
License Master
Search Head
Deployment Server
You are configuring a new index for high-volume data. To optimize ingestion performance, where should you place the hot buckets?
On a network-attached storage (NAS) with high latency.
In the coldPath directory.
On high-performance local storage (SSD).
Hot buckets are actively written and searched, so they demand the lowest-latency I/O. Placing them on local SSD satisfies the high-volume ingestion constraint, since network or slow spinning storage would bottleneck indexing throughput and search performance.
On the same partition as the OS.
A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?
The buckets are in the warm state.
The index is corrupted.
The user does not have read access to the cold bucket.
The index reached the maxTotalDataSizeMB limit.
Retention is governed by whichever limit triggers first: age or total index size. When maxTotalDataSizeMB is reached, Splunk freezes and deletes the oldest buckets regardless of the five-year retention period, so three-year-old data is removed prematurely.
You need to ensure that an index does not exceed 500GB of total disk space. Which configuration setting in indexes.conf should you modify?
maxTotalDataSizeMB
`maxTotalDataSizeMB` caps an index's on-disk footprint by triggering deletion of the oldest buckets once the threshold is crossed. Setting it to 512000 enforces the 500GB ceiling, satisfying the stem's disk-space constraint. Other settings govern retention by age or per-bucket sizing, not total index size.
maxDataSize
frozenTimePeriodInSecs
homePath.maxDataSizeMB
Which file in the index directory contains the bucket's metadata?
rawdata
journal.gz
index.conf
bucket.meta
The bucket.meta file within a Splunk index bucket directory stores that bucket's metadata, including its state and time range information. This satisfies the requirement to identify the specific file holding bucket-level metadata, distinguishing it from the raw journal and tsidx files.
Want more Indexes And Data Management practice?
Practice this domainA customer wants to split their 1TB license into two 500GB pools for different departments. How is this achieved?
By using different license keys on indexers.
By creating two license pools on the License Master.
Splunk's licensing model supports partitioning a single licence volume into multiple pools, each capped by its own quota. Creating two 500GB pools on the Licence Master allocates the 1TB total across departments, which is exactly the mechanism the scenario requires.
By creating two separate License Masters.
By modifying the license file directly.
A Splunk administrator observes that the license master is reporting an 'indexer-slave' mismatch. Which configuration file should the admin check on the license slave?
outputs.conf
server.conf
The indexer-slave mismatch concerns the licence slave's identity and master connection, both governed by server.conf. The [license] stanza's master_uri and the [general] serverName settings there determine what the slave reports, so that file must be checked.
inputs.conf
indexes.conf
A Splunk administrator needs to identify how much data is being indexed across multiple indexers to ensure they do not exceed their daily license quota. Where should the admin look first?
Settings > Licensing
Settings > Licensing displays the licence usage report, aggregating daily indexed volume across all indexers against the pool's quota. This directly satisfies the requirement to monitor consumption versus the daily licence limit, since the licence manager tracks global usage rather than per-indexer local metrics.
Settings > Distributed Search
Settings > Indexer Clustering
Settings > Forwarder Management
Where does an administrator configure the License Master URL for an indexer?
In the license.conf file.
In the server.conf file.
The License Master URL is set through `master_uri` in the `[license]` stanza of server.conf, which indexers read to locate the licence manager. This satisfies the requirement for configuring the License Master URL on an indexer, since the setting resides in server.conf rather than outputs.conf or the web interface.
In the web.conf file.
In the Splunk Web UI under Licensing.
What happens if the License Master becomes unreachable?
Indexing continues for 72 hours.
Splunk's licence enforcement permits indexing to continue for a 72-hour grace period when the Licence Master is unreachable, after which indexing is blocked. This satisfies the scenario's constraint of temporary Licence Master unavailability without immediate data loss.
Indexing continues indefinitely.
Indexing stops immediately.
Search heads stop working.
An administrator needs to identify which indexer is responsible for a license violation. Where should they check?
The license slave's internal logs.
The search head's search logs.
The License Master's usage report.
The License Master's usage report attributes indexed volume to each peer by host and source, exposing the specific indexer breaching the daily licence quota. This directly satisfies the requirement to identify the responsible indexer, since the report aggregates per-indexer usage rather than cluster-wide totals.
The forwarder's metrics.log.
Want more License Management practice?
Practice this domainThe SPLK-1003 exam has 56 questions and must be completed in 60 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Configuration Files, Splunk Admin Basics, User And Authentication Management, Getting Data IN And Forwarder Management, Indexes And Data Management, License Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-1003 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.