SPLK-1003 Practice Test 14 — 15 Questions

Question 1

A Splunk administrator needs to ensure that a specific sourcetype is assigned to data coming from a particular source path. The administrator wants to define the sourcetype at the forwarder before data leaves the host. Which configuration file should be edited on the universal forwarder?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

inputs.conf. inputs.conf is the correct file for assigning a sourcetype to a specific data input on a universal forwarder. Each input stanza supports a sourcetype attribute that labels the incoming data before it is forwarded. This approach is efficient because the sourcetype is set at the source, avoiding indexer-side guessing.

Answer

props.conf

Answer

transforms.conf

Answer

outputs.conf

Question 2

An administrator needs to create a new index called 'finance' on a Splunk Enterprise indexer cluster. The index must store data in a dedicated volume with a custom path. Which configuration file and stanza should be edited to define the volume?

Accepted Answer

indexes.conf, [volume:finance_volume]. To define a custom storage volume for an index, you must create a [volume:<name>] stanza in indexes.conf. This stanza specifies the path and optional size limits. The index stanza can then reference this volume via homePath or coldPath. Other files like server.conf or inputs.conf do not handle volume definitions.

Answer

indexes.conf, [finance] with path setting

Answer

server.conf, [volume:finance_volume]

Answer

inputs.conf, [volume:finance_volume]

Question 3

A Splunk administrator needs to configure a Universal Forwarder to send data to an indexer using SSL. Which file must be edited to specify the SSL certificate and enable SSL for the output?

Accepted Answer

outputs.conf. To enable SSL for a Universal Forwarder's output, you must edit outputs.conf. This file allows you to specify the client certificate and enable SSL verification. Other configuration files like inputs.conf, server.conf, and web.conf do not control the SSL settings for forwarding data to indexers.

Answer

server.conf

Answer

inputs.conf

Answer

web.conf

Question 4

A Splunk administrator is troubleshooting a license warning that appeared during a period of unusually high log volume. They want to understand the built-in protections that apply before search becomes disabled. Which two statements accurately describe Splunk Enterprise license warning and violation behavior? (Choose two.)

Accepted Answer

Search is disabled only after the number of violations in a rolling 30-day window exceeds the permitted threshold.. License enforcement follows a progression: exceeding the licensed daily peak triggers a warning, and sustained overage records a violation. Search is disabled only when the count of violations in a rolling 30-day window exceeds the permitted number. These two behaviors explain why a warning alone does not stop indexing or search and why administrators track cumulative violations rather than reacting to a single event.

Answer

Violation counts reset to zero at the start of each calendar month regardless of when they occurred.

Answer

Indexing stops immediately when a license warning is issued to prevent further overage.

Answer

A 72-hour grace period applies after a violation, during which searches continue to function while the overage is resolved.

Question 5

A Splunk administrator is configuring a Universal Forwarder to collect data from a Windows server. The forwarder must monitor the Windows Event Logs and also monitor a set of files in a custom directory. Which TWO inputs should be configured in inputs.conf to accomplish this? (Choose two.)

Accepted Answer

[WinEventLog://Security]. To monitor Windows Event Logs, a [WinEventLog://] stanza is required, such as [WinEventLog://Security]. To monitor files in a custom directory, a [monitor://] stanza is used, like [monitor://C:\CustomLogs\*.log]. These two inputs together satisfy the data collection requirements.

Answer

[script://C:\Scripts\collect.bat]

Answer

[tcp://514]

Answer

[udp://514]

Question 6

A Splunk administrator is troubleshooting a search head cluster where users report that scheduled searches are not running consistently across all members. The administrator suspects that the captain is not properly managing the search artifacts. Which command should be used to verify the captain's status and the replication of search artifacts?

Accepted Answer

splunk show shcluster-status. The splunk show shcluster-status command provides comprehensive details about the search head cluster, including the captain's identity, the replication status of search artifacts, and the overall health of the cluster. This information is critical for diagnosing why scheduled searches may not run consistently across all members.

Answer

splunk show kvstore-status

Answer

splunk list shcluster-members

Answer

splunk list cluster-config

Question 7

An administrator is troubleshooting why a custom field extraction defined in props.conf is not being applied to events. The extraction uses a REPORT-class stanza that references a transform in transforms.conf. After running btool props list --debug, the administrator sees the REPORT setting is active. What is the next most likely configuration issue to investigate?

Accepted Answer

The transforms.conf stanza name referenced by REPORT does not match the actual stanza name in transforms.conf.. After confirming that the REPORT setting is present and active in the merged props.conf, the next likely failure point is the transforms.conf stanza it references. If the stanza name in transforms.conf does not exactly match the name used in the REPORT setting, the field extraction will not run. Verifying that correspondence is the correct next diagnostic step.

Answer

The indexer requires a full restart rather than a configuration reload to apply REPORT settings.

Answer

The props.conf file must be placed in $SPLUNK_HOME/etc/system/default for REPORT settings to function.

Answer

The sourcetype in props.conf must be prefixed with 'sourcetype:' for REPORT to be recognized.

Question 8

After installing a new app on a search head, users report that the app's dashboards do not appear in their navigation. The administrator wants to check the app's configuration to see how its navigation is defined. Where are the local configuration files for an installed app located?

Accepted Answer

$SPLUNK_HOME/etc/apps//local. Each installed app keeps its configuration under $SPLUNK_HOME/etc/apps/, with local overrides in the local subdirectory and shipped defaults in default. To diagnose missing dashboards or navigation, the administrator examines the app's local configuration, which takes precedence over default settings. System-level configuration is separate and does not hold app-specific files.

Answer

$SPLUNK_HOME/var/lib/splunk/<app_name>

Answer

$SPLUNK_HOME/etc/system/local

Answer

$SPLUNK_HOME/etc/apps/<app_name>/default

Question 9

An administrator is configuring an index that receives data from a syslog receiver. The index must retain data for 90 days, but the storage team requires that the index not consume more than 500 GB of disk space. When the 500 GB limit is reached, the oldest data must be deleted. Which indexes.conf setting should be used to enforce the disk space limit?

Accepted Answer

maxTotalDataSizeMB. The requirement is to cap total index size at 500 GB and delete oldest data when exceeded. maxTotalDataSizeMB is the correct setting because it limits the total size of all buckets in the index across all paths. When the limit is reached, Splunk freezes and removes the oldest buckets, ensuring the disk space constraint is met. Other settings control retention by time or individual bucket size, not overall index size.

Answer

homePath.maxDataSizeMB

Answer

maxDataSize

Answer

frozenTimePeriodInSecs

Question 10

You are configuring a new index for high-volume data. To optimize ingestion performance, where should you place the hot buckets?

Accepted Answer

On high-performance local storage (SSD).. Hot buckets are actively being written to and searched, so they require the highest I/O performance. Placing them on high-performance local storage (SSD) ensures fast indexing and search performance. This is the recommended practice for optimizing ingestion and search in high-volume environments.

Answer

On a network-attached storage (NAS) with high latency.

Answer

In the coldPath directory.

Answer

On the same partition as the OS.

Question 11

A Splunk admin is reviewing an inputs.conf file and notices a stanza with the attribute 'disabled = 1'. What does this attribute accomplish in this context?

Accepted Answer

It prevents the input from being loaded and started by Splunk.. The 'disabled' attribute in inputs.conf acts as an on/off switch for individual input stanzas. When set to 1, Splunk does not start that input, effectively pausing data collection without deleting the configuration. When set to 0 or omitted, the input is active. This allows admins to temporarily disable inputs during troubleshooting or maintenance and re-enable them later.

Answer

It marks the input as read-only so it cannot be edited through the CLI.

Answer

It causes the input to send data only to the default index.

Answer

It reduces the input's priority so other inputs consume resources first.

Question 12

A Splunk administrator notices that searches are being blocked on all indexers in the deployment. The license manager shows that the enterprise license is valid and not expired. Which condition most likely explains why search is blocked?

Accepted Answer

The deployment exceeded the permitted number of license violations within the past 30 days.. License enforcement blocks search when the number of violations in the rolling 30-day window exceeds what the license permits. A valid, unexpired license can still be associated with excessive violations if indexed volume repeatedly exceeded the daily limit. That combination explains deployment-wide search blocking and directs the administrator to review violation history and usage trends.

Answer

The search head has exhausted its maximum number of concurrent searches.

Answer

An indexer's splunkd is running as a non-root user.

Answer

The license manager's disk is more than 90 percent full.

Question 13

A company is using a Trial license. How does this affect their ability to add more indexers?

Accepted Answer

They are limited to the total volume specified in the trial key.. A Splunk Trial license is a single, volume-based license that grants a fixed daily indexing quota (typically 500MB/day) for a limited period (60 days). It does not restrict the number of indexers or disable distributed indexing — you can deploy as many indexers as you want, but their combined ingest is capped by the trial key's total volume. The limitation is volume, not topology.

Answer

They can add unlimited indexers.

Answer

Trial licenses do not support distributed indexing.

Answer

They can only have one indexer.

Question 14

An administrator is configuring a new index called 'finance' on a Splunk Enterprise indexer. The index must store raw events for 90 days and then delete them permanently. The administrator sets frozenTimePeriodInSecs = 7776000 in indexes.conf under the [finance] stanza. After 90 days, the administrator notices that the data is still searchable. What is the most likely cause?

Accepted Answer

The index is configured with a coldToFrozenDir or coldToFrozenScript, causing buckets to be archived instead of deleted.. The frozenTimePeriodInSecs setting defines when buckets are eligible to be frozen, but if coldToFrozenDir or coldToFrozenScript is configured, buckets are archived instead of deleted. The administrator expects permanent deletion, but the archive configuration causes data to persist. To enforce deletion, the administrator must remove the coldToFrozenDir or coldToFrozenScript setting or manage the archive separately.

Answer

The index is configured as a summary index, which automatically extends retention beyond frozenTimePeriodInSecs.

Answer

The search head has a saved search that reindexes frozen buckets back into the index automatically.

Answer

The indexer is part of a cluster, and the cluster manager overrides frozenTimePeriodInSecs with its own retention setting.

Question 15

A Splunk administrator is diagnosing why a universal forwarder is not sending data to the indexers even though the inputs are configured and the service is running. The administrator suspects the forwarder is not loading the expected outputs configuration. Which command should the administrator run to list the active configuration settings the forwarder is currently using?

Accepted Answer

splunk btool outputs list --debug. The btool utility merges default, local, and app-level configuration into the effective settings an instance uses, and the debug flag identifies the source file for each value. Running it against outputs shows exactly which forwarding destinations are active and where they were defined, which is the fastest way to diagnose a forwarder that is not sending data.

Answer

splunk diag

Answer

splunk list forward-server

Answer

splunk show config outputs