SPLK-1003 Practice Test 1 — 10 Questions

Question 1

How can you increase the amount of raw data stored in a single bucket before it rolls?

Accepted Answer

Modify 'maxDataSize'.. The 'maxDataSize' setting dictates the size threshold for rolling a bucket from hot to warm.

Answer

Modify 'maxTotalDataSizeMB'.

Answer

Modify 'frozenTimePeriodInSecs'.

Answer

Modify 'homePath'.

Question 2

What happens to data when a bucket rolls to 'frozen'?

Accepted Answer

It is deleted by default.. By default, when a bucket rolls to frozen, it is deleted unless a coldToFrozenScript is configured.

Answer

It is archived to the coldPath.

Answer

It is moved to a read-only state.

Answer

It is moved to the warmPath.

Question 3

You are configuring a new index for high-volume data. To optimize ingestion performance, where should you place the hot buckets?

Accepted Answer

On high-performance local storage (SSD).. Hot buckets should be placed on high-performance storage, such as SSDs, because they are constantly being written to.

Answer

On a network-attached storage (NAS) with high latency.

Answer

In the coldPath directory.

Answer

On the same partition as the OS.

Question 4

A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?

Accepted Answer

The index reached the maxTotalDataSizeMB limit.. The frozenTimePeriodInSecs is the primary retention limit; if it is set correctly, check the maxTotalDataSizeMB, which might trigger rolling to frozen earlier if the disk fills up.

Answer

The buckets are in the warm state.

Answer

The index is corrupted.

Answer

The user does not have read access to the cold bucket.

Question 5

Which TWO actions should be taken before manually moving an index to a new storage volume?

Accepted Answer

Verify the file system permissions of the new path.. You must stop the Splunk service and ensure the filesystem permissions are correct for the new directory.

Answer

Modify the indexes.conf file.

Answer

Clear the license master cache.

Answer

Delete the existing index.

Question 6

A bucket in the 'warm' state is currently locked. What process is likely happening?

Accepted Answer

The bucket is being rolled.. During bucket rolling (from hot to warm or warm to cold), the bucket is temporarily locked to ensure data integrity during the file system move.

Answer

The bucket is being searched.

Answer

The bucket is being indexed.

Answer

The bucket is undergoing a summary rebuild.

Question 7

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When precedence is tied, Splunk uses a deterministic method based on the filename, sorting alphabetically.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 8

Which TWO of the following are valid ways to define field extractions?

Accepted Answer

Using the EXTRACT- prefix in props.conf. Field extractions can be defined using inline regex in props.conf or via transforms.conf.

Answer

Directly in inputs.conf

Answer

Using the INDEXED-EXTRACTION attribute in transforms.conf

Answer

Using a CSV file in etc/system/local

Question 9

You need to ensure that Data Models are accelerated. Where are the acceleration summaries stored?

Accepted Answer

Within the index itself in a sub-directory.. Data model acceleration summaries are stored in the indexer where the data resides, specifically within the index's bucket structure.

Answer

In the system/bin directory.

Answer

On the Search Head in a separate index.

Answer

In the Splunk KV Store.

Question 10

An administrator needs to manually move a bucket to frozen state immediately for compliance reasons. What is the best method?

Accepted Answer

Update the retention policy to 0 seconds and restart.. The 'splunk enable/disable/remove' commands don't support manual freezing; the 'splunk revert' or manual bucket removal is not supported, but modifying the frozenTimePeriodInSecs is the formal way to trigger a policy change.

Answer

Delete the bucket folder from the OS.

Answer

Rename the bucket folder to start with 'frozen'.

Answer

Use the 'splunk edit index' command.