SPLK-1003 Practice Test 11 — 15 Questions

Question 1

You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?

Accepted Answer

props.conf and transforms.conf. Filtering data happens on the Heavy Forwarder within props.conf and transforms.conf.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 2

A Universal Forwarder reports as 'missing' in the Deployment Server. What is the most common cause?

Accepted Answer

Network firewall or connectivity issue.. A missing forwarder usually indicates a network connectivity issue between the client and the deployment server.

Answer

The forwarder name is too long.

Answer

The index is full.

Answer

The license has expired.

Question 3

Which THREE factors can impact the performance of a Universal Forwarder?

Accepted Answer

Network bandwidth limits. Performance can be impacted by network bandwidth, CPU usage from heavy parsing if misconfigured, and I/O wait on disk.

Answer

Browser type used for access

Answer

The number of users logged in

Question 4

Which of the following is a primary reason to choose a Heavy Forwarder over a Universal Forwarder?

Accepted Answer

Ability to perform index-time parsing. Heavy Forwarders are required when you need to parse data, mask sensitive information, or route data based on content before it reaches the indexer.

Answer

Easier installation

Answer

Native indexing capability

Answer

Lower CPU utilization

Question 5

Which THREE pieces of information can be obtained using the 'splunk fsck' command?

Accepted Answer

Time range of events in a bucket.. fsck is used to repair buckets, check for integrity, and view bucket-level metadata like event counts and time ranges.

Answer

The current user's role.

Answer

Network latency to the indexer.

Question 6

In props.conf, what does the 'REPORT-' prefix signify?

Accepted Answer

It defines a search-time extraction. REPORT- is used to associate a report-time extraction (often defined in transforms.conf) with a sourcetype.

Answer

It triggers an alert

Answer

It defines an index-time extraction

Answer

It defines a line-breaking rule

Question 7

To ensure a Universal Forwarder is using the correct index, where is the 'index' attribute defined?

Accepted Answer

inputs.conf. The index for a data source is defined in inputs.conf.

Answer

props.conf

Answer

outputs.conf

Answer

server.conf

Question 8

What is the effect of setting 'autoLBFrequency' in outputs.conf on a forwarder?

Accepted Answer

Defines the interval for load balancing indexers.. This setting determines how often the forwarder evaluates its load-balancing configuration to redistribute data across multiple indexers.

Answer

Limits the number of simultaneous connections.

Answer

Sets the maximum throughput speed.

Answer

Configures the compression ratio.

Question 9

Which THREE attributes can be used in serverclass.conf to define target clients?

Accepted Answer

whitelist. Filters can be applied using hostnames, IP addresses, or machine classes.

Answer

portFilter

Answer

indexFilter

Question 10

You need to ensure that a Universal Forwarder continues to collect data during a network outage between the forwarder and the indexer. Which feature should be enabled in outputs.conf?

Accepted Answer

Persistent queues. Persistent queuing allows the forwarder to store data locally on disk when the receiving indexer is unreachable.

Answer

Forwarder queue buffering

Answer

Indexer acknowledgment

Answer

Auto-load balancing

Question 11

What happens to Splunk search capabilities when the license limit is reached for the first time in a 30-day period?

Accepted Answer

Search continues to function.. A violation occurs, but search is not blocked on the first occurrence within a rolling 30-day window.

Answer

Data indexing is halted.

Answer

Search is immediately disabled.

Answer

The Splunk service stops.

Question 12

You need to ensure that an index does not exceed 500GB of total disk space. Which configuration setting in indexes.conf should you modify?

Accepted Answer

maxTotalDataSizeMB. maxTotalDataSizeMB is the correct setting to limit the total size of an index on disk.

Answer

maxDataSize

Answer

frozenTimePeriodInSecs

Answer

homePath.maxDataSizeMB

Question 13

Which TWO attributes in props.conf are commonly used to handle multiline events?

Accepted Answer

BREAK_ONLY_BEFORE. BREAK_ONLY_BEFORE and SHOULD_LINEMERGE are used for multiline event processing.

Answer

INDEXED_EXTRACTION

Answer

TIME_FORMAT

Answer

TRANSFORMS-routing

Question 14

You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?

Accepted Answer

Create two server classes and use machine class filters.. Serverclass.conf allows targeting clients using filters based on machine name or other attributes.

Answer

Use an Intermediate Forwarder for the 50 machines.

Answer

Modify the global serverclass.conf without a class.

Answer

Manually copy the app to the forwarders.

Question 15

How do you restart the Splunk service on a Linux-based Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/bin/splunk restart. The standard command is 'splunk restart'.

Answer

service splunk stop

Answer

kill -9 $(pgrep splunk)

Answer

reboot