SPLK-1003 Practice Test 13 — 15 Questions

Question 1

When should you use the 'volume' configuration in indexes.conf?

Accepted Answer

To manage shared storage limits across multiple indexes.. The 'volume' stanza in indexes.conf is used to define a volume — a named storage location with a maximum size — that can be shared by multiple indexes. It lets administrators manage shared storage limits across indexes, ensuring that a group of indexes does not exceed the allocated disk space. This is the correct use case for volume configuration.

Answer

To increase search speed.

Answer

To replicate data between indexers.

Answer

To encrypt index data.

Question 2

What is the primary function of the Deployment Server?

Accepted Answer

Centralized management of configuration files. The Deployment Server in Splunk is a centralized configuration management component that distributes configuration files (such as inputs.conf, outputs.conf, and apps) to forwarders and other Splunk instances via deployment apps and server classes. It does not process, index, or search data — it only pushes configuration bundles to clients that poll it. This makes it the administrative control plane for managing large fleets of universal/heavy forwarders.

Answer

Indexing data

Answer

Parsing data

Answer

Performing searches

Question 3

What happens if the License Master becomes unreachable?

Accepted Answer

Indexing continues for 72 hours.. When a Splunk License Master becomes unreachable, indexers continue to index data for a grace period of 72 hours. This allows for temporary network issues or maintenance without immediate disruption. After 72 hours, if the License Master is still unreachable, indexing will stop.

Answer

Indexing continues indefinitely.

Answer

Indexing stops immediately.

Answer

Search heads stop working.

Question 4

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

Accepted Answer

Settings -> Apps -> Install app from file. In Splunk Web, apps and add-ons are installed via Settings > Apps > Install app from file, which opens a dialog to upload a .spl, .tar.gz, or .tgz package. This is the standard GUI method for installing a technology add-on on a standalone search head. The same path also allows browsing Splunkbase for apps.

Answer

Settings -> Forwarder Management

Answer

Settings -> Data Inputs -> Add new

Answer

Settings -> Server Settings -> System Settings

Question 5

A security analyst at your organization must be able to create and schedule saved searches and alerts, but must NOT be able to install apps or manage other users. You are assigning roles in Splunk Enterprise. Which built-in role should you assign to meet these requirements with least privilege?

Accepted Answer

power. The power role is designed for users who need to create and share searches, reports, and alerts but do not require administrative privileges. It includes the schedule_search capability and other search-related capabilities while excluding app installation and user management, making it the correct least-privilege choice for this scenario.

Answer

admin

Answer

can_delete

Answer

user

Question 6

A Universal Forwarder is failing to send data to the Indexer. The indexer shows no incoming traffic. Where is the first place you should check for errors?

Accepted Answer

$SPLUNK_HOME/var/log/splunk/splunkd.log. The splunkd.log on the Universal Forwarder is the primary log for troubleshooting forwarding issues, including connection errors, configuration problems, and pipeline errors. When a UF fails to send data, the first diagnostic step is to check $SPLUNK_HOME/var/log/splunk/splunkd.log for messages about outputs, TCP connection failures, or SSL errors.

Answer

The Splunk Web UI on the Indexer

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/indexes.conf

Question 7

Which TWO of the following describe the 'admin' role?

Accepted Answer

It is built-in and cannot be deleted.. Option B is correct because the 'admin' role is a built-in role in Splunk, and built-in roles cannot be deleted (though they can be modified or cloned). Option D is correct because the 'admin' role has all capabilities enabled by default, giving it full access to Splunk features and settings. Option A is incorrect because the 'admin' role is not restricted to searching only the 'main' index; it can search all indexes by default. Option C is incorrect because the 'admin' role is available on all Splunk licenses, not only Enterprise. Option E is incorrect because the 'admin' role does not have to be assigned to an LDAP group; it can be assigned to local users or groups as needed.

Answer

It is restricted to searching only the 'main' index.

Answer

It is only available on Enterprise licenses.

Answer

It must be assigned to an LDAP group.

Question 8

Which TWO items are contained within an 'authorize.conf' role stanza?

Accepted Answer

srchIndexesAllowed. In an authorize.conf role stanza, srchIndexesAllowed (option C) is correct because it defines the comma-separated list of indexes that users assigned to that role are permitted to search, controlling index-level access. Option D, capabilities, is also correct because a role stanza lists the specific capabilities (such as search, schedule_search, or admin_all_objects) granted to that role, which is the core purpose of role-based access control in Splunk. Option A is incorrect because user password hashes are stored in the authentication backend (e.g., passwd file or external identity provider), not in authorize.conf role stanzas. Option B is incorrect because UI theme settings are user preferences stored in user-prefs.conf or the user's profile, not in role definitions. Option E is incorrect because LDAP group mapping is configured in authentication.conf under the [roleMap_<authType>] stanza, not inside an authorize.conf role stanza.

Answer

User password hash

Answer

UI theme setting

Answer

LDAP Group mapping

Question 9

Which THREE capabilities are typically assigned to a 'Power User'?

Accepted Answer

rtsearch. In Splunk, the Power User role is a predefined role that inherits from the User role and adds capabilities for creating and sharing searches and knowledge objects. Option B (rtsearch) is correct because Power Users can run real-time searches, a capability not granted to the basic User role. Option C (edit_saved_searches) is correct because Power Users can create, edit, and manage their own saved searches. Option E (edit_shared_objects) is correct because Power Users can create and edit shared knowledge objects such as saved searches, reports, and dashboards that are shared within their apps. Option A (admin_all_objects) is not assigned to Power Users; it is reserved for administrators (e.g., the admin role) and grants full control over all objects. Option D (edit_tcp) is also not assigned to Power Users; it is an administrative capability for configuring TCP inputs and belongs to roles like admin.

Answer

admin_all_objects

Answer

edit_tcp

Question 10

Which THREE of the following configurations can be performed in props.conf?

Accepted Answer

Specifying timestamp extraction rules.. In Splunk, props.conf is the configuration file used to define settings that apply to events at index time and search time for a given sourcetype, host, or source. Option A is correct because timestamp extraction rules such as TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD, and TZ are configured in props.conf to tell Splunk how to parse event timestamps. Option B is correct because props.conf is precisely where sourcetype properties are defined, including settings like SHOULD_LINEMERGE, LINE_BREAKER, TRUNCATE, and category/description metadata. Option C is correct because field extraction regexes are defined in props.conf via TRANSFORMS- stanzas that reference regex-based transforms in transforms.conf, or via inline EXTRACT- regex definitions. Option D is incorrect because index retention periods are set in indexes.conf using settings such as frozenTimePeriodInSecs or via the index's retention policy, not in props.conf. Option E is incorrect because TCP input ports are configured in inputs.conf under [tcp://] or [splunktcp://] stanzas, not in props.conf.

Answer

Setting index retention periods.

Answer

Configuring TCP input ports.

Question 11

An administrator needs to identify which indexer is responsible for a license violation. Where should they check?

Accepted Answer

The License Master's usage report.. The License Master's usage report provides a breakdown of indexing volume per indexer (license slave), allowing the administrator to identify which indexer contributed to the license violation. This report aggregates usage data reported by each slave.

Answer

The license slave's internal logs.

Answer

The search head's search logs.

Answer

The forwarder's metrics.log.

Question 12

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. When a Universal Forwarder is added to a Deployment Server, the forwarder initiates a phone-home request (D) to the deployment server on port 8089, which is how the server learns the client exists and begins managing it. The Deployment Server then checks against server classes (A), evaluating the client's hostname, IP, or other attributes against the configured serverclass.conf filters to determine which server classes it matches. Based on those matches, the forwarder downloads assigned app bundles (E) from the deployment server and installs them locally. Option B is incorrect because adding a forwarder to a deployment server never triggers an OS reboot. Option C is incorrect because the indexer does not automatically index any app; indexing is driven by data inputs and forwarding configuration, not by deployment server membership.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 13

A Splunk administrator has configured a Deployment Server to manage forwarders. Which file on the forwarder must be configured to establish communication with the Deployment Server?

Accepted Answer

deploymentclient.conf. The deploymentclient.conf file on the universal forwarder specifies the Deployment Server's hostname/IP and management port (default 8089), enabling the forwarder to phone home and receive apps and configuration. Without this file, the forwarder has no knowledge of the Deployment Server.

Answer

inputs.conf

Answer

outputs.conf

Answer

serverclass.conf

Question 14

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

Accepted Answer

To specify the start of the timestamp. It specifies the regex pattern to locate the start of the timestamp in an event.

Answer

To set the time format

Answer

To define the timezone

Answer

To truncate the timestamp

Question 15

An administrator finds that search performance for a specific index is slow. What should they check regarding index buckets?

Accepted Answer

The number of buckets and their individual sizes.. Search performance in Splunk is heavily influenced by the number and size of index buckets. Too many small buckets increase the overhead of opening and searching each bucket, while excessively large buckets can slow down searches due to the volume of data scanned. Administrators should review bucket counts, sizes, and the rollover/retention policies in indexes.conf to optimize search efficiency.

Answer

The operating system's kernel version.

Answer

The indexer's CPU count.

Answer

The license master's time synchronization.