SPLK-1003 Practice Test 1 — 10 Questions

Question 1

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When a user inherits multiple roles, the permissions are additive — the user receives the union of all granted permissions. RoleA allows index1 and RoleB allows index2, so the user can search both index1 and index2. Splunk does not require a single role to grant all access; it merges srchIndexesAllowed across all effective roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 2

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Accepted Answer

transforms.conf. In Splunk, regex-based routing to different indexes is achieved by defining a transform with a REGEX and a DEST_KEY that points to the index metadata field (_MetaData:Index). This transform is defined in transforms.conf. The transform is then referenced from props.conf using a rule class (e.g., TRANSFORMS- = ). Therefore, transforms.conf is the file that must be configured to define the routing regex.

Answer

indexes.conf

Answer

props.conf

Answer

inputs.conf

Question 3

An administrator is configuring a new indexer to join an existing Splunk Enterprise deployment. The license master is at splunk-license.example.com:8089. The administrator runs the CLI command 'splunk edit licenser-localslave -master_uri https://splunk-license.example.com:8089'. What is the effect of this command?

Accepted Answer

It designates the indexer as a license slave and points it to the specified license master.. The command 'splunk edit licenser-localslave' with the -master_uri parameter configures the local instance as a license slave and points it to the license master. This is the correct way to add an indexer to a license master's management. It ensures the indexer reports its indexing volume and adheres to the license terms.

Answer

It configures the indexer to act as a license master for the deployment.

Answer

It enables the indexer to use the free license by contacting the license master.

Answer

It adds the specified license master to the indexer's search head pool.

Question 4

A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)

Accepted Answer

Providing the interface for knowledge object management such as saved searches and dashboards. Search heads orchestrate distributed searches by dispatching map phases to indexers and merging the reduce results, and they also host the user interface plus the knowledge object store. Raw data storage belongs to indexers, data collection to forwarders, and license administration to the license manager, so those functions are excluded from the search head role.

Answer

Collecting data from endpoints and forwarding it into the pipeline

Answer

Managing the license pool and issuing license warnings to peers

Answer

Storing raw event data in buckets on disk

Question 5

What is the primary function of the 'thawed' bucket state?

Accepted Answer

It is used to store restored frozen data.. The 'thawed' bucket state in Splunk is used to hold data that has been restored from a frozen archive. When an admin rebuilds a frozen bucket (e.g., from cold storage or backup), the restored bucket is placed in the thawed state so it can be re-indexed and made searchable again. It is not a normal lifecycle state for live data.

Answer

It is the default state for new data.

Answer

It is for data that is being deleted.

Answer

It is a cache for warm buckets.

Question 6

A company has a 1 TB per day Enterprise license shared across two pools: one for a security team indexing 600 GB per day and one for an IT operations team indexing 300 GB per day. The security team's pool is configured with a 500 GB per day quota. What happens when the security team's indexers exceed 500 GB in a single day while the IT operations pool remains under its quota?

Accepted Answer

The security pool records a violation against its pool, while the IT operations pool continues indexing under its own quota.. License pools partition the total license so each group's usage is measured against its own quota. When the security pool exceeds 500 GB in a day, the violation is attributed to that pool, while the IT operations pool stays within its allocation and continues indexing normally. This isolation is the primary reason to configure pools for separate teams.

Answer

The entire deployment immediately stops indexing until the next license window begins.

Answer

The security team's indexers are disabled and must be manually re-enabled by an administrator after the quota resets.

Answer

The overflow is automatically reallocated to the IT operations pool's unused quota to avoid a violation.

Question 7

An administrator receives reports that searches are returning warnings about license violations and that search has been partially restricted. The administrator wants to identify which indexers contributed the most indexing volume in the last 24 hours to determine the source of the overage. Which approach provides this information?

Accepted Answer

Run a search over the _internal index for license_usage.log events and use the splunk_server field to break down volume by indexer.. license_usage.log is written to the _internal index and records usage per reporting indexer, with splunk_server identifying the host. Searching that source and aggregating by splunk_server yields a ranked list of indexers by volume for the last 24 hours, which is the most direct way to find the hosts responsible for a license overage.

Answer

Query the license manager's REST endpoint /services/licenser/usage and aggregate results by pool name.

Answer

Inspect the indexer's metrics.log for per-sourcetype throughput and rank sourcetypes by volume.

Answer

Open the Monitoring Console License Usage view and read the Indexing Volume by Indexer panel for the last 24 hours.

Question 8

A Splunk administrator is configuring a Deployment Server to manage a large number of Universal Forwarders. The administrator notices that some forwarders are not receiving updated configurations. Upon investigation, the administrator finds that the forwarders have different 'serverName' values in server.conf than their actual hostnames. What is the most likely cause of the forwarders not receiving the updated configurations?

Accepted Answer

The Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass.. The most likely cause is that the Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass and thus will not receive the updated configurations. The serverName is the client name that the forwarder reports to the Deployment Server. If it differs from the actual hostname, any serverclass filters based on hostname will fail to match.

Answer

The Deployment Server will ignore forwarders with duplicate serverName values, causing them not to receive configurations.

Answer

The forwarders will not be able to download apps because the serverName is used to determine the app directory path.

Answer

The forwarders cannot connect to the Deployment Server because the serverName is used for authentication.

Question 9

An administrator wants a set of index-time field extractions and custom source types to be available only to a specific department's users while remaining hidden from all other users on the same search head. Which configuration approach accomplishes this?

Accepted Answer

Place the props.conf and transforms.conf stanzas in the department's app and grant that app read access only to the department's role.. App-level permissions are the correct mechanism for scoping configurations to a subset of users. A dedicated app containing the props.conf and transforms.conf stanzas, with read access granted only to the department role, ensures the knowledge objects are applied for that role and hidden from everyone else. Global locations such as system/local or the search app apply to all users and cannot provide this isolation.

Answer

Define the extractions in the search-time props.conf of the search head and rely on field-level permissions.

Answer

Add the stanzas to the etc/apps/search app and use a search filter to remove the fields for unauthorized users.

Answer

Create the stanzas in etc/system/local on the search head so they override every other app.

Question 10

If a search head cluster member cannot access an indexer's bucket, what should you verify first?

Accepted Answer

The replication status and indexer clustering state.. When a search head cluster member cannot access an indexer's bucket, the most likely cause is a problem with the indexer clustering or replication state, such as a bucket not being properly replicated or a peer being down. Verifying replication status and indexer clustering state ensures that buckets are searchable and available. This is the first step because it directly addresses data availability across the cluster.

Answer

The indexer's license status.

Answer

The OS version of the search head.

Answer

The search head's RAM.