SPLK-1003 Practice Test 16 — 15 Questions

Question 1

What happens to data when a bucket rolls to 'frozen'?

Accepted Answer

It is deleted by default.. When a Splunk bucket rolls to 'frozen', the data is deleted by default unless a frozen archive path (coldToFrozenDir or coldToFrozenScript) is configured. This is a critical data retention behavior: frozen buckets are removed from the indexer's managed storage. Without explicit archiving, the data is permanently lost.

Answer

It is archived to the coldPath.

Answer

It is moved to a read-only state.

Answer

It is moved to the warmPath.

Question 2

What is the effect of setting 'autoLBFrequency' in outputs.conf on a forwarder?

Accepted Answer

Defines the interval for load balancing indexers.. The autoLBFrequency setting in outputs.conf controls how often a forwarder re-evaluates and redistributes its data streams across the configured indexer group when auto load balancing is enabled. It defines the time interval (in seconds) at which the forwarder recalculates which indexer each stream should be sent to, effectively rebalancing the load. This is distinct from connection limits or throughput caps, which are governed by other settings like maxConnections or throughput settings.

Answer

Limits the number of simultaneous connections.

Answer

Sets the maximum throughput speed.

Answer

Configures the compression ratio.

Question 3

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

Accepted Answer

The object permissions for the dashboard are not set to 'Global' or the user's role.. The most likely cause for a user with the 'user' role being unable to view a specific dashboard is that the object permissions for the dashboard are not set to 'Global' or to the user's role. In Splunk, dashboards (and other knowledge objects) have permissions that control which roles can view or edit them. If the dashboard is private or shared only with specific roles that do not include 'user', the user cannot see it. The 'user' role does not need 'admin' role to view dashboards. Index permissions (B) would affect search results but not the ability to view the dashboard itself. Having too many roles (C) is not a cause.

Answer

The user does not have the 'admin' role.

Answer

The index used in the search is not allowed.

Answer

The user has too many roles assigned.

Question 4

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Accepted Answer

It invokes a named transform from transforms.conf. TRANSFORMS-routing in props.conf invokes a named transform defined in transforms.conf, which can then route events to a specific index, sourcetype, or drop them. The transform is referenced by its stanza name, and the routing action is defined within that transform (e.g., using DEST_KEY and REGEX). This is the standard mechanism for index routing and event filtering.

Answer

It routes the data to a specific app

Answer

It triggers an alert

Answer

It changes the sourcetype

Question 5

An administrator has a Splunk Enterprise deployment with a single license master managing five indexers. The daily indexing volume is 200 GB. The administrator needs to add a new indexer that will index 50 GB per day. What must be done to ensure the new indexer can index data without causing a license violation?

Accepted Answer

Install a new license key on the license master that includes the additional 50 GB of daily indexing volume.. To add indexing capacity, the license volume must be increased by installing a new license key on the license master that covers the additional data. The license master enforces the total daily indexing volume across all indexers. Adding an indexer without increasing the license capacity would exceed the licensed volume and trigger a violation.

Answer

Add the new indexer to the existing license pool and increase the license volume by 50 GB.

Answer

Set the new indexer to use the free license, which allows unlimited indexing for 60 days.

Answer

Configure the new indexer to use a separate license master with its own license key.

Question 6

A Splunk administrator is setting up a new indexer and needs to specify the maximum size that the index can grow to before Splunk begins deleting the oldest data. Which setting in indexes.conf should be used?

Accepted Answer

maxTotalDataSizeMB. The maxTotalDataSizeMB setting in indexes.conf defines the maximum total size of an index in megabytes. When the index size exceeds this limit, Splunk deletes the oldest buckets to reduce the size. This is the correct parameter for size-based retention. The other options either control time-based retention or limit specific paths, not the overall index size.

Answer

homePath.maxDataSizeMB

Answer

coldPath.maxDataSizeMB

Answer

frozenTimePeriodInSecs

Question 7

Where are the local configuration files for an installed app located?

Accepted Answer

$SPLUNK_HOME/etc/apps//local/. Local configuration files for an installed app reside in $SPLUNK_HOME/etc/apps//local/. This directory holds administrator-created or app-updated settings that override the app's default configurations. It is the app-scoped counterpart to system/local.

Answer

/var/log/splunk/

Answer

$SPLUNK_HOME/etc/system/local/

Answer

$SPLUNK_HOME/etc/apps/<app_name>/default/

Question 8

Which THREE types of bucket states exist in a healthy Splunk indexer?

Accepted Answer

Warm. In a healthy Splunk indexer, buckets progress through defined lifecycle states, and the three valid states among the options are Hot (E), Warm (A), and Cold (D). Hot (E) buckets are the newest, actively written-to buckets that hold the most recent, searchable data and reside on fast storage. Warm (A) buckets are rolled over from hot once they reach a size or time threshold; they are still searchable but no longer receive new data. Cold (D) buckets are older, rolled from warm, and are typically moved to slower/cheaper storage while remaining searchable. The unmarked options do not belong because 'Evaporated' (B) is not a Splunk bucket state — the terminal state is 'frozen' (and optionally archived/thawed) — and 'Simmer' (C) is not a recognized Splunk bucket state at all.

Answer

Evaporated

Answer

Simmer

Question 9

Which protocol is the default used by Splunk Universal Forwarders to communicate with Indexers?

Accepted Answer

S2S (Splunk-to-Splunk). Splunk Universal Forwarders use the Splunk-to-Splunk (S2S) protocol by default to send data to indexers. S2S is a proprietary, secure, TCP-based protocol that operates on port 9997 and supports SSL/TLS encryption, compression, and acknowledgment. It is purpose-built for forwarding raw data and metadata between Splunk components, unlike generic protocols such as syslog or HTTP.

Answer

Syslog

Answer

HTTP

Answer

SNMP

Question 10

A Splunk administrator is reviewing the roles and capabilities assigned to users in a distributed deployment. Which two statements accurately describe how roles and capabilities work in Splunk Enterprise? (Choose two.)

Accepted Answer

Capabilities are individual permissions, such as search or edit_user, that can be added to a role.. Roles are containers for capabilities and index permissions, and users can hold multiple roles whose permissions combine. Capabilities are the granular permissions added to roles. Index access is also defined within roles. This structure lets administrators compose access precisely, avoid granting excessive rights, and manage permissions centrally rather than per user.

Answer

Capabilities assigned to a role are inherited only if the user also has the admin role.

Answer

A user can be assigned only one role at a time in Splunk Enterprise.

Answer

Index permissions are granted directly to users and are not part of roles.

Question 11

A Splunk administrator is troubleshooting an indexer that is not receiving data from a universal forwarder. The administrator suspects that the issue is related to the index configuration. Which TWO actions should the administrator take to verify that the index is properly configured to receive data? (Choose two.)

Accepted Answer

Check that the index is enabled in indexes.conf.. To verify that an index is properly configured to receive data, the administrator should check that the index is enabled in indexes.conf and that its homePath and coldPath are writable. These are essential for data ingestion. Other checks, like forwarder configuration or searchability, are secondary and do not directly confirm the index's ability to receive data.

Answer

Check that the index's maxDataSize is set to auto_high_volume.

Answer

Verify that the forwarder's outputs.conf points to the correct indexer.

Answer

Confirm that the index appears in the search app's index list.

Question 12

A Splunk administrator is planning to deploy a Universal Forwarder to a large number of Linux servers. The administrator needs to ensure that the forwarders can be centrally managed and that configuration changes can be pushed without manual intervention. Which two actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Configure the forwarders to use a Deployment Server by setting the deploymentServer attribute in deploymentclient.conf.. To centrally manage Universal Forwarders, the administrator must configure the forwarders to point to a Deployment Server via deploymentclient.conf and create server classes on the Deployment Server that assign apps to those forwarders. These two actions enable automatic configuration updates without manual intervention. The other options are either inefficient or incorrect for centralized management.

Answer

Configure each forwarder to use a Heavy Forwarder as an intermediary for configuration management.

Answer

Install a full Splunk Enterprise instance on each server to act as a Deployment Server.

Answer

Manually copy the configuration files to each forwarder using a script.

Question 13

An administrator is configuring a new index named 'finance' in indexes.conf on a standalone Splunk Enterprise indexer. Company policy requires that no single index may store more than 100 GB of raw data on disk, and the oldest data must be removed automatically once that limit is reached. Which setting should the administrator configure to enforce this hard cap?

Accepted Answer

maxTotalDataSizeMB = 102400. A hard total-size cap on an index is enforced with maxTotalDataSizeMB in indexes.conf. When the index exceeds this value, Splunk rolls the oldest buckets to frozen, which deletes them unless a frozen archive is configured. The other settings control bucket roll size, hot/warm path limits, or time-based retention and therefore do not satisfy a 100 GB aggregate storage ceiling.

Answer

maxDataSize = 102400

Answer

frozenTimePeriodInSecs = 102400

Answer

homePath.maxDataSizeMB = 102400

Question 14

An administrator is troubleshooting a parsing issue where multiline events, such as Java stack traces, are being split into separate events. The administrator wants to adjust the line-breaking behavior. Which configuration file and stanza should be modified?

Accepted Answer

props.conf, using the LINE_BREAKER setting within the appropriate source type stanza. Event boundary detection and multiline grouping are controlled by props.conf, specifically through LINE_BREAKER and related settings applied to a source type, host, or source. Adjusting the regular expression lets the administrator merge stack trace lines into single events. Other configuration files handle inputs, outputs, or field transforms and cannot change how event boundaries are determined.

Answer

transforms.conf, using the REGEX setting within a stanza referenced by a transform

Answer

outputs.conf, using the line_breaker setting within the tcpout stanza

Answer

inputs.conf, using the multiline_event_breaker setting within the monitor stanza

Question 15

A Splunk admin wants to implement license pooling to ensure that certain indexers do not consume more than a fixed portion of the total license. What is the correct order of operations?

Accepted Answer

Define the pool on the Master, then assign slaves to the pool.. License pooling in Splunk requires the pool to be defined on the license master first, then indexers (slaves) are assigned to that pool. The master maintains the pool definitions in its license configuration, and assignment is done by specifying the pool name on each slave. This order ensures the pool exists before slaves reference it.

Answer

Assign slaves to the pool, then create the pool on the Master.

Answer

Modify server.conf on slaves, then restart the Master.

Answer

Create a separate license file for each pool.