SPLK-1003 Practice Test 17 — 15 Questions

Question 1

An administrator needs to configure a Splunk indexer to retain data for 90 days and then delete it. The administrator also wants to ensure that the index does not exceed 500 GB in size. Which configuration file and settings should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

indexes.conf with frozenTimePeriodInSecs and maxTotalDataSizeMB. indexes.conf is the correct file for defining index retention and size limits. frozenTimePeriodInSecs controls how long data is kept before being frozen, and maxTotalDataSizeMB caps the index size. Both settings are essential for meeting the 90-day and 500 GB requirements.

Answer

transforms.conf with retentionPeriod and maxSize

Answer

inputs.conf with retentionDays and maxVolume

Answer

props.conf with maxDataSize and frozenTimePeriodInSecs

Question 2

A Splunk administrator is building a new index called 'web_preview' on a single indexer to ingest temporary test data. The data should be searchable immediately but must be deleted automatically after 7 days without any manual intervention. Which indexes.conf setting should the administrator configure to meet the 7-day retention requirement?

Accepted Answer

frozenTimePeriodInSecs = 604800. Age-based retention in indexes.conf is governed by frozenTimePeriodInSecs, expressed in seconds. Seven days equals 604800 seconds, so buckets older than that roll to frozen and are deleted when no frozen archive destination is configured. Size limits and hot-bucket roll settings do not enforce a time-based lifecycle, so they cannot satisfy the 7-day deletion requirement.

Answer

retirePeriodInSecs = 604800

Answer

maxTotalDataSizeMB = 604800

Answer

maxHotSpanSecs = 604800

Question 3

A Splunk administrator is configuring a new forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific port and that the connection is encrypted. Which file should be edited to set the default target group and enable SSL, and what is the correct stanza name?

Accepted Answer

$SPLUNK_HOME/etc/system/local/outputs.conf with stanza [tcpout]. To configure a forwarder's output, you edit outputs.conf. The [tcpout] stanza sets global defaults, such as the default group and SSL parameters. Within it, you can specify defaultGroup and ssl settings. To define the actual indexers, you create a target group stanza like [tcpout:myindexers] with server and ssl settings. The question asks for the default target group and SSL, which are set in [tcpout].

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf with stanza [tcpout]

Answer

$SPLUNK_HOME/etc/system/local/outputs.conf with stanza [tcpout:myindexers]

Answer

$SPLUNK_HOME/etc/system/local/server.conf with stanza [tcpout]

Question 4

A user reports that they can log in to Splunk Web but cannot see the 'Settings' menu or access the 'Users' page. You check their roles and find they have the 'user' role. Which capability must you add to a custom role to allow them to manage users?

Accepted Answer

edit_user. To manage users, a role must include the edit_user capability. This capability grants access to the Users page and allows creating, editing, and deleting user accounts. The list_users capability only allows viewing, while edit_roles and edit_authentication govern other aspects of administration.

Answer

list_users

Answer

edit_authentication

Answer

edit_roles

Question 5

A Universal Forwarder reports as 'missing' in the Deployment Server. What is the most common cause?

Accepted Answer

Network firewall or connectivity issue.. The most common cause of a Universal Forwarder showing as 'missing' in the Deployment Server is a network firewall or connectivity issue blocking communication on the management port (default 8089). The Deployment Server relies on the forwarder's phone-home to the deployment server; if that traffic is blocked, the forwarder appears missing.

Answer

The forwarder name is too long.

Answer

The index is full.

Answer

The license has expired.

Question 6

An administrator is preparing to deploy a new Splunk Enterprise indexer in a distributed environment. To ensure the indexer can receive data from forwarders on the default Splunk receiving port, which port must be open on the indexer's firewall?

Accepted Answer

9997. The correct port for receiving data from forwarders is 9997, which is the default Splunk-to-Splunk receiving port. When an indexer is configured to receive data, it listens on this port for incoming connections from forwarders. The management port 8089 is for REST API and deployment, while 8000 is for Splunk Web. Port 8080 is not a standard Splunk port.

Answer

8080

Answer

8089

Answer

8000

Question 7

An administrator manages a distributed Splunk Enterprise environment with a License Manager and several indexers. They need to ensure that a specific indexer, which handles sensitive data, cannot consume more than 200 GB of the total 1 TB license. Other indexers should be able to use the remaining license volume. What should the administrator do?

Accepted Answer

Create a license pool with a 200 GB quota, assign the specific indexer to that pool, and assign all other indexers to the default pool.. License pools are the correct mechanism to allocate a specific portion of the total license to a group of indexers. By creating a pool with a 200 GB quota and assigning the sensitive indexer to it, the administrator ensures that indexer cannot exceed 200 GB. Other indexers remain in the default pool and share the remaining 800 GB. This meets the requirement precisely.

Answer

Enable license enforcement on the sensitive indexer and set a daily volume limit of 200 GB in indexes.conf.

Answer

Configure the sensitive indexer to use a separate license file with a 200 GB quota.

Answer

Set the maxKBps on the sensitive indexer to limit its ingestion rate to 200 GB per day.

Question 8

An administrator notices that a scheduled saved search owned by a service account stopped firing after the account's password was changed in the authentication system. The saved search has no alert action and is not part of a report acceleration. What is the most likely cause and the correct way to restore execution?

Accepted Answer

The saved search owner's credentials are invalid, so the administrator must update the stored credentials or change ownership to a valid account.. Scheduled saved searches execute with the permissions and identity of their owner. When the owner's password changes or the account is disabled, the scheduler can no longer authenticate that context and the search stops firing without an obvious alert. Updating the stored credentials or transferring ownership to a valid account restores normal execution, which is why the credential-focused remedy is correct.

Answer

The saved search's cron schedule was invalidated by the password change, so the administrator must recreate the schedule expression.

Answer

The search head lost its license connection, so the administrator must re-point the license manager before searches resume.

Answer

The search head's scheduler queue is full, so the administrator must increase the scheduler's max concurrent searches.

Question 9

A Splunk administrator needs to ensure that events from a high-volume web server index are stored in a way that allows for efficient searching and compliance with a 90-day retention policy. The index currently uses the default settings. The administrator wants to configure the index so that buckets are rolled more frequently to improve search performance and reduce the impact of a single large bucket. Which setting in indexes.conf should be adjusted to control the maximum size of a hot bucket before it rolls to warm?

Accepted Answer

maxDataSize. The setting maxDataSize in indexes.conf controls the maximum size of a hot bucket before it rolls to warm. By reducing this value, the administrator can force more frequent rolling, which can improve search performance by keeping bucket sizes smaller and more manageable. This directly addresses the need to control bucket size for a high-volume index.

Answer

frozenTimePeriodInSecs

Answer

maxHotSpanSecs

Answer

maxTotalDataSizeMB

Question 10

An administrator has configured two license pools: one for a group of indexers that handle sensitive data and another for general data. The administrator wants to ensure that the sensitive data pool does not consume more than its allocated license quota. Which statement accurately describes the behavior of license pools in Splunk Enterprise?

Accepted Answer

License pools enable you to assign indexers to a pool, and the pool's license usage is tracked separately; if a pool exceeds its quota, it can trigger a license violation for that pool.. License pools partition the total license volume among groups of indexers. Each pool has a quota, and usage is tracked independently. If a pool exceeds its quota, a violation is recorded for that pool, potentially leading to search blocking if violations accumulate. This allows granular control over license consumption without separate license files.

Answer

License pools allow you to allocate a specific amount of license volume to a set of indexers, and if a pool exceeds its quota, it consumes from the global pool.

Answer

License pools are only used for reporting purposes and do not enforce any limits on indexing volume.

Answer

License pools require a separate license file for each pool, and the total volume is the sum of all pool quotas.

Question 11

An administrator needs to monitor a script output every 60 seconds. Which configuration in inputs.conf is correct for a scripted input?

Accepted Answer

[script://./bin/myscript.sh] interval = 60. In Splunk's inputs.conf, a scripted input stanza is defined using the [script://<path>] syntax, and the polling frequency is controlled by the 'interval' attribute, specified in seconds. Setting interval = 60 causes Splunk to execute the script every 60 seconds and index its stdout. This is the canonical, documented configuration for scheduled scripted inputs on both forwarders and indexers.

Answer

[script] path = ./bin/myscript.sh, time = 60

Answer

[script://./bin/myscript.sh] frequency = 60

Answer

[script://./bin/myscript.sh] exec_time = 60

Question 12

A junior administrator wants to change the default maximum size of the internal index (_internal) to prevent it from consuming too much disk space. Which configuration file and stanza should they edit?

Accepted Answer

$SPLUNK_HOME/etc/system/local/indexes.conf, [_internal] stanza. The size of an index, including the internal index, is controlled by the 'maxTotalDataSizeMB' setting in the index's stanza within indexes.conf. The _internal index is defined in indexes.conf, and to override its default size, the administrator should create or edit the [_internal] stanza in $SPLUNK_HOME/etc/system/local/indexes.conf. This ensures the change takes effect with the highest precedence.

Answer

$SPLUNK_HOME/etc/system/local/server.conf, [diskUsage] stanza

Answer

$SPLUNK_HOME/etc/system/local/limits.conf, [indexer] stanza

Answer

$SPLUNK_HOME/etc/system/local/indexes.conf, [default] stanza

Question 13

Which THREE of these represent common issues when troubleshooting LDAP authentication?

Accepted Answer

Incorrect User Search Filter. Option A (Incorrect User Search Filter) is correct because LDAP authentication typically requires a search filter (e.g., (uid=%s) or (sAMAccountName=%s)) to locate the user's DN before binding; a malformed or wrong filter causes the search to return zero entries and authentication to fail. Option B (Invalid Bind DN credentials) is correct because the service account or bind DN used to connect to the directory must supply valid credentials; an incorrect password or DN results in an LDAP error 49 (Invalid Credentials) and prevents any lookup or bind. Option C (Wrong LDAP server port) is correct because LDAP uses TCP 389 (or 636 for LDAPS), and pointing the client at the wrong port causes connection refused or timeout errors that block authentication entirely. Option D (local disk full) is unrelated to LDAP protocol authentication and would only affect local system operations, not directory binds. Option E (browser cookie expiration) concerns HTTP session state, not LDAP bind/search operations, so it is not an LDAP authentication troubleshooting issue.

Answer

The user's local disk is full.

Answer

Browser cookie expiration

Question 14

A Splunk administrator is troubleshooting why a Universal Forwarder is not sending data to the indexers. The administrator runs 'splunk list forward-server' on the forwarder and sees no active forwarders. Which of the following is the most likely cause?

Accepted Answer

The outputs.conf file is missing or misconfigured.. The command 'splunk list forward-server' queries the forwarder's configuration for indexer targets, which are defined in outputs.conf. If no forward servers are listed, it means outputs.conf is either absent or lacks valid indexer entries. Therefore, checking and correcting outputs.conf is the appropriate troubleshooting step.

Answer

The deploymentclient.conf file is missing or misconfigured.

Answer

The server.conf file is missing or misconfigured.

Answer

The inputs.conf file is missing or misconfigured.

Question 15

A Splunk administrator notices that the license master is reporting a license violation for the past three days. The administrator wants to avoid search being blocked. What is the maximum number of consecutive violation days allowed before search is blocked?

Accepted Answer

7 days. Splunk Enterprise blocks search after seven consecutive days of license violations. This is a fixed threshold designed to give administrators a grace period to resolve issues. The correct answer is seven days. Other values such as three, fourteen, or thirty days do not trigger search blocking.

Answer

3 days

Answer

30 days

Answer

14 days