Splunk · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?
It errors out if the input is not found
It prevents the input from running
Setting disabled=1 effectively turns off the data input.
It deletes the input
It hides the input from the UI
You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?
The file with the largest size
It randomly chooses one
The file sorted alphabetically by name
Splunk sorts files alphabetically and applies them in order when precedence is tied.
The file created most recently
You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?
The system/local value
The configuration with the most recent timestamp
The app/local value
App-level configurations take precedence over system-level configurations.
The configuration alphabetically first
Which configuration file is used to define index-time field extractions and line-breaking rules?
indexes.conf
transforms.conf
inputs.conf
props.conf
props.conf defines the parsing logic for data.
You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?
$SPLUNK_HOME/etc/system/default/
$SPLUNK_HOME/etc/apps/app_name/local/
The local directory is specifically designed for configuration overrides.
$SPLUNK_HOME/etc/users/admin/
$SPLUNK_HOME/etc/apps/app_name/default/
If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?
The App/default value
The app with the highest priority in app.conf
They are merged alphabetically
The System/local value
System/local overrides settings defined in application default directories.
Want more Configuration Files practice?
Practice this domainWhich Splunk component is primarily responsible for parsing and indexing incoming data streams?
Indexer
The indexer is the core component that indexes data.
Deployment Server
Universal Forwarder
Search Head
A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?
splunk list inputs
splunk search "index=* sourcetype=your_type" | head 10
This verifies that data is successfully hitting the indexer and is searchable.
splunk status
splunk show conf
When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?
The indexer is not configured in the search head cluster.
Another process is already using the port.
Port conflicts are the primary reason for failure to bind to a network port.
The license is expired.
The indexer is missing a forwarder license.
An administrator needs to change the default maximum size of an index. Which file should be modified?
server.conf
indexes.conf
indexes.conf is used to define index-specific settings.
props.conf
limits.conf
You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?
$SPLUNK_HOME/etc/system/default/
$SPLUNK_HOME/etc/manager/local/
$SPLUNK_HOME/etc/system/local/
This is the correct location for global configuration overrides on a forwarder.
$SPLUNK_HOME/etc/apps/search/local/
You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?
outputs.conf
inputs.conf
indexes.conf
props.conf
props.conf is where parsing rules like multiline handling are defined.
Want more Splunk Admin Basics practice?
Practice this domainWhat is the primary function of the Deployment Server?
Indexing data
Centralized management of configuration files
It pushes apps and configs to forwarder clients.
Parsing data
Performing searches
To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?
[script://./bin/my.py]
[monitor:///var/log/]
[tcp://9997]
This stanza defines a network listener for data input.
[winhost://]
A Universal Forwarder is failing to send data to the Indexer. The indexer shows no incoming traffic. Where is the first place you should check for errors?
$SPLUNK_HOME/var/log/splunk/splunkd.log
This log contains the primary diagnostic information for the forwarder.
The Splunk Web UI on the Indexer
$SPLUNK_HOME/etc/system/local/inputs.conf
$SPLUNK_HOME/etc/apps/search/local/indexes.conf
You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?
Use an Intermediate Forwarder for the 50 machines.
Modify the global serverclass.conf without a class.
Manually copy the app to the forwarders.
Create two server classes and use machine class filters.
Server classes are designed to group forwarders for specific app deployment.
You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?
props.conf and transforms.conf
Routing and filtering are configured using these files on a Heavy Forwarder.
outputs.conf
server.conf
inputs.conf
You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?
$SPLUNK_HOME/var/run/
/opt/scripts/
/tmp/
$SPLUNK_HOME/etc/apps/my_app/bin/
Storing in the app directory allows for proper bundling and distribution.
Want more Getting Data IN And Forwarder Management practice?
Practice this domainWhat happens to data when a bucket rolls to 'frozen'?
It is archived to the coldPath.
It is moved to a read-only state.
It is moved to the warmPath.
It is deleted by default.
Splunk automatically deletes frozen data unless configured otherwise.
Which Splunk component is responsible for orchestrating the transition of buckets from warm to cold?
Indexer
The indexer manages the lifecycle of its own local buckets.
License Master
Search Head
Deployment Server
You are configuring a new index for high-volume data. To optimize ingestion performance, where should you place the hot buckets?
On a network-attached storage (NAS) with high latency.
In the coldPath directory.
On high-performance local storage (SSD).
SSDs provide the IOPS required for high-volume ingestion.
On the same partition as the OS.
An administrator needs to manually move a bucket to frozen state immediately for compliance reasons. What is the best method?
Delete the bucket folder from the OS.
Update the retention policy to 0 seconds and restart.
Setting the retention to 0 forces the indexer to roll buckets to frozen on the next maintenance cycle.
Rename the bucket folder to start with 'frozen'.
Use the 'splunk edit index' command.
You need to ensure that Data Models are accelerated. Where are the acceleration summaries stored?
In the system/bin directory.
Within the index itself in a sub-directory.
Summaries reside in the _summary directory within the index.
On the Search Head in a separate index.
In the Splunk KV Store.
A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?
The buckets are in the warm state.
The index is corrupted.
The user does not have read access to the cold bucket.
The index reached the maxTotalDataSizeMB limit.
If the disk space limit is reached, Splunk rolls buckets to frozen regardless of the time policy.
Want more Indexes And Data Management practice?
Practice this domainAn administrator has configured a License Pool and assigned specific indexers to it. However, the indexers are still consuming from the 'default' pool. What is the most likely cause?
License pools only apply to search heads.
The indexers have not been restarted.
The indexers are using a trial license.
The license_pool attribute in server.conf was not mapped correctly to the License Master.
The slave must point to the Master and be assigned to the pool.
A customer wants to split their 1TB license into two 500GB pools for different departments. How is this achieved?
By using different license keys on indexers.
By creating two license pools on the License Master.
Pools allow for quota management by assigning indexers to specific groups.
By creating two separate License Masters.
By modifying the license file directly.
When a Splunk license violation occurs, how long does the warning period last before search is blocked?
30 days
3 days
7 days
14 days
The license warning period lasts for 14 days.
A Splunk administrator observes that the license master is reporting an 'indexer-slave' mismatch. Which configuration file should the admin check on the license slave?
outputs.conf
server.conf
The [license] stanza in server.conf defines master connectivity.
inputs.conf
indexes.conf
A company is migrating from an Enterprise license to a Free license. What is the most significant functional impact on their Splunk deployment?
Distributed search is enabled by default.
The maximum daily indexing volume is increased.
Data retention is extended to 90 days.
Authentication and roles are disabled.
The Free license removes access control and authentication features.
What happens to Splunk search capabilities when the license limit is reached for the first time in a 30-day period?
Data indexing is halted.
Search is immediately disabled.
Search continues to function.
The first violation provides a warning but no immediate shutdown.
The Splunk service stops.
Want more License Management practice?
Practice this domainWhich file stores the definitions of roles and their associated capabilities?
authorize.conf
Roles and capabilities reside in authorize.conf.
indexes.conf
authentication.conf
limits.conf
What is the default role assigned to a new user account if no other role is specified?
admin
power
user
'user' is the standard default role.
can_delete
A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?
Both index1 and index2.
Splunk additive permission logic merges index access across all inherited roles.
Only index1.
Only index2.
No indexes.
If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?
delete
The 'delete' capability is specifically required to use the delete command.
edit_search
can_delete_data
admin_all_objects
You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?
server.conf
SAML Configuration in Splunk Web.
The UI provides fields for mapping IdP attributes to Splunk user attributes.
authorize.conf
web.conf
An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?
In authorize.conf under the [role_power] stanza.
In user-prefs.conf.
In authentication.conf within the [roleMap_LDAP_name] stanza.
The role mapping between LDAP groups and Splunk roles is defined in authentication.conf.
In distsearch.conf.
Want more User And Authentication Management practice?
Practice this domainThe SPLK-1003 exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Configuration Files, Splunk Admin Basics, Getting Data IN And Forwarder Management, Indexes And Data Management, License Management, User And Authentication Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-1003 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.