SPLK-1003 Practice Test 11 — 15 Questions

Question 1

A Splunk administrator is configuring a Universal Forwarder to send data to an indexer cluster. The forwarder must use SSL/TLS for encryption and authenticate the indexers. The administrator has obtained the CA certificate and the forwarder's certificate and private key. Which configuration file on the Universal Forwarder should be modified to enable SSL and specify the certificate paths?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

outputs.conf. To enable SSL/TLS for a Universal Forwarder sending data to indexers, the outputs.conf file must be configured. It includes stanzas for specifying the indexer destinations and SSL parameters such as sslCertPath, sslRootCAPath, and sslVerifyServerCert. This ensures encrypted communication and mutual authentication. Other configuration files like inputs.conf, server.conf, and web.conf serve different purposes and do not control outbound forwarding SSL settings.

Answer

inputs.conf

Answer

web.conf

Answer

server.conf

Question 2

An administrator needs to configure a new index that will store data for 30 days and then delete it. The data is not required for compliance or archiving. Which setting in indexes.conf should be used to automatically delete data after 30 days?

Accepted Answer

frozenTimePeriodInSecs = 2592000. The requirement is to delete data after 30 days. The correct setting is frozenTimePeriodInSecs, which defines the age at which buckets are frozen. When a bucket is frozen, if no archiving is configured, it is deleted. Setting it to 2592000 seconds (30 days) achieves the desired retention. Other settings control size limits or bucket rolling, not time-based deletion.

Answer

maxTotalDataSizeMB = 2592000

Answer

maxDataSize = 2592000

Answer

retentionPeriod = 30

Question 3

A Splunk administrator needs to allow a new role to search only the web and security indexes while preventing access to all other indexes. Which setting in authorize.conf accomplishes this for the role?

Accepted Answer

srchIndexesAllowed = web;security. Index-level access for a role is governed by srchIndexesAllowed in authorize.conf, which lists the indexes the role may search. Specifying web and security restricts the role to those two indexes and denies everything else. The default and disallowed settings adjust search scope or subtract from a broader list, and srchFilter adds result constraints rather than granting index permissions.

Answer

srchIndexesDisallowed = *

Answer

srchIndexesDefault = web;security

Answer

srchFilter = index=web OR index=security

Question 4

An administrator manages a Splunk Enterprise indexer cluster with three peer nodes and a replication factor of 2. A new index named 'audit_secure' is created with search factor 1 and replication factor 2. After a peer node fails and is offline for several hours, searches against 'audit_secure' return incomplete results. Which action should the administrator take to restore full searchability of the index?

Accepted Answer

Bring the failed peer back online or replace it so the cluster can restore the searchable copies of the buckets.. In an indexer cluster, the search factor determines how many searchable copies exist and the replication factor determines how many raw copies exist. With search factor 1, only one peer holds a searchable copy of each bucket. If that peer is offline, searches are incomplete until the cluster can rebuild searchability, which requires the peer to return or be replaced. Changing settings or running search commands does not substitute for restoring peer availability.

Answer

Manually copy the bucket directories from another peer's replicated copies into the search head's index directory.

Answer

Run a search with the 'fixsearch' argument on the cluster master to force searchability across all peers.

Answer

Increase the search factor to 2 using the CLI on the master node so the cluster immediately creates additional searchable copies.

Question 5

A Splunk administrator is configuring a Universal Forwarder to send data to an indexer cluster. The forwarder must use SSL/TLS for encryption and authenticate the indexers. The administrator has obtained the CA certificate and the forwarder's certificate and private key. Which configuration file on the Universal Forwarder should be modified to enable SSL and specify the certificate paths?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

frozenTimePeriodInSecs. frozenTimePeriodInSecs is the correct setting because it specifies the time in seconds after which buckets are frozen. By setting it to 2 years (63072000 seconds) and configuring a frozen archive path, the administrator can automate the archiving and deletion of data older than 2 years, meeting the retention policy.

Answer

maxTotalDataSizeMB

Answer

thawedPath

Answer

coldPath

Question 6

A Splunk Enterprise administrator is configuring license pooling for a distributed environment. The environment has a License Manager, four indexers, and a search head. The administrator wants to allocate license volume to two departments: Finance and Engineering. Each department has two indexers. The total license is 500 GB. The administrator creates two pools: Finance with 200 GB and Engineering with 200 GB. The remaining 100 GB stays in the default pool. Which two statements are true about this configuration? (Choose two.)

Accepted Answer

Indexers assigned to the Finance pool will only index data up to 200 GB per day before a violation is recorded for that pool.. License pools allow partitioning of the total license volume. Each pool has a fixed quota, and indexers assigned to it are limited to that quota. The default pool contains all unassigned indexers and its quota is the remainder of the total license after custom pool quotas. Pools do not share unused quota, and search heads do not need to be in pools because they do not index data.

Answer

If the Finance pool exceeds its 200 GB quota, the Engineering pool can use the unused portion of the Finance quota.

Answer

License pools can only be created if the total license volume is at least 1 TB.

Answer

The search head must be assigned to a license pool to ensure it does not consume license volume.

Question 7

Which TWO of the following are required to successfully add an indexer to a license pool?

Accepted Answer

The indexer must be configured to point to the license master.. Option B is correct because an indexer can only join a license pool if it is configured as a license slave pointing to the license master (via the license master URI in server.conf or the CLI), which establishes the licensing relationship. Option E is correct because the license pool itself, including its name and quota, must be defined on the License Master before any indexer can be assigned to it. Option A is incorrect because license keys are not unique per pool; a single enterprise license key is used across the deployment and pools are logical groupings within it. Option C is incorrect because an indexer being added to a pool does not need to be a license master; it acts as a license slave. Option D is incorrect because there is no subnet requirement — indexers can be in different subnets as long as they can reach the license master over the network.

Answer

The license key must be unique per pool.

Answer

The indexer must be a license master.

Answer

The indexer must be in the same subnet as the master.

Question 8

A new Splunk administrator is reviewing user roles and notices that the 'admin' role has the 'edit_roles' capability. What does this capability allow a user to do?

Accepted Answer

Create, edit, and delete roles, as well as assign capabilities to roles.. The edit_roles capability is specifically designed to manage roles within Splunk, including creating, editing, and deleting roles, and assigning capabilities to them. It does not cover user account management, authentication settings, or license management, which are handled by other distinct capabilities. Understanding these boundaries is essential for proper role-based access control.

Answer

Change license group assignments and manage license usage.

Answer

Edit user account details such as full name, email, and password.

Answer

Modify authentication settings such as LDAP or SAML configuration.

Question 9

Which of the following is a valid method to restart the Splunk service on a Linux system?

Accepted Answer

/opt/splunk/bin/splunk restart. The Splunk CLI provides the 'splunk restart' command, which cleanly stops and starts splunkd and all dependent processes. On a default Linux install, the binary lives at $SPLUNK_HOME/bin/splunk, so /opt/splunk/bin/splunk restart is the canonical method. This command handles process ordering and preserves configuration state, unlike manual kill or init-script approaches.

Answer

service splunk stop && service splunk start

Answer

/opt/splunk/bin/splunk reload

Answer

kill -9 $(pidof splunkd)

Question 10

A Splunk administrator is troubleshooting why some users are unable to log in after LDAP authentication was configured. The LDAP server is reachable, and the bind account credentials are correct. Which two settings should be verified to ensure that user searches are successful? (Choose two.)

Accepted Answer

User Filter. For LDAP authentication to succeed, Splunk must locate the user's DN in the directory. This depends on the User Base DN, which sets the search scope, and the User Filter, which identifies the user object. If either is incorrect, the user search fails, and authentication cannot proceed. Group Base DN, bind password, and role mapping affect other aspects but not the initial user search.

Answer

Bind DN password

Answer

Role mapping configuration

Answer

Group Base DN

Question 11

A Splunk administrator is troubleshooting an LDAP authentication issue where users are unable to log in. The administrator confirms that the LDAP server is reachable and the bind credentials are correct. Which Splunk log file should the administrator review to find detailed error messages about the LDAP authentication failure?

Accepted Answer

splunkd.log. The splunkd.log file records all authentication-related events, including LDAP bind attempts and failures. It provides detailed error messages that can help identify issues such as incorrect group mappings, invalid user filters, or connection problems. Administrators should search splunkd.log for keywords like 'LDAP' or 'authentication' to pinpoint the cause of the failure.

Answer

web_service.log

Answer

audit.log

Answer

metrics.log

Question 12

A Splunk admin needs to ensure that a custom sourcetype is recognized by all indexers in a distributed environment. The sourcetype definition exists in $SPLUNK_HOME/etc/system/local/props.conf on the search head. Indexers are not recognizing the sourcetype. What is the most likely cause?

Accepted Answer

The props.conf on the search head is not automatically distributed to indexers.. Splunk configuration files are not automatically synchronized between search heads and indexers. A sourcetype defined only on the search head remains unknown to indexers unless the same props.conf is deployed to them. The correct resolution is to distribute the configuration through a deployment server, a search head cluster app bundle, or manual placement, ensuring indexers have the definition locally.

Answer

The props.conf stanza is missing the 'SHOULD_LINEMERGE' attribute.

Answer

The search head must be restarted before indexers can see the sourcetype.

Answer

The indexers require a transforms.conf entry to recognize any custom sourcetype.

Question 13

An admin needs to change the default retention period for an index without affecting other indexes. The change should persist across restarts. Which configuration file should be edited?

Accepted Answer

$SPLUNK_HOME/etc/system/local/indexes.conf. Index behavior, including retention, is configured in indexes.conf. To change retention for a single index while keeping the change persistent, the admin edits the index's stanza in system/local/indexes.conf and sets the appropriate retention attribute. Other indexes are untouched because the stanza is index-specific. This is the standard and supported method in Splunk Enterprise.

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf

Answer

$SPLUNK_HOME/etc/system/local/transforms.conf

Answer

$SPLUNK_HOME/etc/system/local/props.conf

Question 14

A Splunk administrator is using a Heavy Forwarder to collect data from a remote network segment and forward it to an indexer cluster. The administrator notices that some events are being duplicated in the index. After investigation, it is found that the Heavy Forwarder is configured to use both a file monitor input and a scripted input that reads from the same file. Which of the following is the most likely cause of the duplication?

Accepted Answer

The file monitor input and the scripted input are both reading the same file, causing each event to be ingested twice.. Duplicate events occur when the same data is ingested by two separate inputs. In this case, both a file monitor input and a scripted input are reading the same file, so each event is processed twice. The other options describe replication or load balancing, which do not cause duplicate indexing under normal circumstances. The fix is to remove or reconfigure one of the inputs.

Answer

The indexer cluster is replicating data across multiple peers, and the search head is returning results from all replicas.

Answer

The Heavy Forwarder's outputs.conf is configured to send data to two different indexers, causing duplication.

Answer

The Heavy Forwarder is configured with a universal forwarder load balancing setting that duplicates data.

Question 15

Which TWO of the following are true regarding the Deployment Server?

Accepted Answer

It manages configurations for deployment clients.. Option A is correct because the Deployment Server's core function is to push configuration content (apps, configuration files, and deployment apps) to its deployment clients, which poll it for updates. Option B is correct because the Deployment Server groups deployment clients into server classes, and each server class maps to specific apps/configurations that determine what each client receives. Option C is incorrect because deployment clients can be on any subnet or network reachable by the Deployment Server; there is no same-subnet restriction. Option D is incorrect because the Deployment Server is optional — it is not required in all Splunk deployments (e.g., single-instance or manually managed environments). Option E is incorrect because indexing raw logs is the role of indexers, not the Deployment Server.

Answer

It can only manage forwarders on the same subnet.

Answer

It is a required component for all Splunk deployments.

Answer

It is responsible for indexing raw logs.