SPLK-1003 Practice Test 18 — 15 Questions

Question 1

A Splunk administrator is configuring a search head cluster and needs to ensure that scheduled searches and alerts are distributed across all members. The administrator also wants to avoid a single point of failure for the scheduler. Which configuration should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the search head cluster's built-in scheduling and artifact replication.. Search head clustering includes native support for distributing scheduled searches and replicating artifacts. Each member can run searches, and the cluster handles failover if a member goes down. This built-in mechanism ensures both load balancing and high availability, which is exactly what the administrator needs.

Answer

Configure a separate search head as the dedicated scheduler.

Answer

Set up a Deployment Server to run scheduled searches.

Answer

Enable the captain to run all scheduled searches.

Question 2

Which TWO of the following are true about 'local' versus 'default' directories?

Accepted Answer

'local' files are preserved during Splunk upgrades. Option A is correct because files placed in a 'local' directory are user- or admin-created customizations that are preserved during a Splunk upgrade, whereas 'default' files are overwritten by the upgrade process. Option D is correct because Splunk's configuration precedence hierarchy gives 'local' higher precedence than 'default', so settings in 'local' override conflicting settings in 'default'. Option B is incorrect because 'default' files ship with Splunk and should not be edited; custom changes belong in 'local' (or an app's local directory) to survive upgrades. Option C is incorrect because 'local' directories can exist in app directories (e.g., $SPLUNK_HOME/etc/apps/<app>/local) as well as in the system folder. Option E is incorrect because it reverses the actual precedence: 'local' takes precedence over 'default', not the other way around.

Answer

Files in 'default' should be edited to update Splunk settings

Answer

'local' directories only exist in the system folder

Answer

'default' files take precedence over 'local'

Question 3

A Splunk administrator is planning a deployment where indexers must continue accepting data even if the license master becomes temporarily unreachable. The administrator wants to understand how license enforcement behaves in a distributed environment. Which statement best describes the behavior?

Accepted Answer

Indexers can continue indexing during a grace period, and warnings are issued before any enforcement action is taken.. In a distributed deployment, the license master governs license usage, but indexers tolerate temporary loss of contact by continuing to index during a grace period. Warnings precede enforcement, which may include blocking searches or indexing if the situation persists. This balanced approach avoids unnecessary outages while still enforcing license limits. Understanding the grace period helps administrators plan for resilience and respond appropriately to alerts.

Answer

If a license master is unreachable, indexers stop ingesting data immediately until connectivity is restored.

Answer

License enforcement is handled locally on each indexer, so the license master is only used for reporting.

Answer

Indexers automatically switch to a built-in unlimited license when the license master is unreachable.

Question 4

An administrator is planning to implement license pooling in a Splunk Enterprise deployment. Which two statements are true regarding the configuration of multiple license pools? (Choose two.)

Accepted Answer

The sum of all license pool quotas cannot exceed the total license volume.. License pools allow partitioning of the total license volume into separate quotas for groups of indexers. Two true statements are that pools allocate a specific volume to a group of indexers, and that the sum of all pool quotas cannot exceed the total license volume. An indexer can belong to only one pool, and pools do not require separate license files.

Answer

License pools require a separate license file for each pool.

Answer

A single indexer can belong to multiple license pools simultaneously.

Answer

License pools can only be created for Enterprise licenses, not for Free licenses.

Question 5

A Splunk administrator needs to verify which TCP port the Splunk Web interface listens on by default in a standard single-instance deployment. Which port is used?

Accepted Answer

8000. Splunk Web listens on TCP port 8000 by default, serving the browser-based interface used for search, dashboards, and administration. The management port 8089 handles REST and CLI traffic, while 9997 receives forwarded data. Recognizing these default ports is fundamental for firewall rules, troubleshooting connectivity, and confirming that users can reach the correct service.

Answer

514

Answer

9997

Answer

8089

Question 6

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Accepted Answer

Settings -> Access Controls -> Users. In Splunk Web, user accounts are managed under Settings > Access Controls > Users. This interface allows an administrator to create a new user, set authentication credentials, and assign one or more roles, including the 'power' role. It is the most direct and standard way to create and assign roles to a user.

Answer

Settings -> Roles

Answer

Settings -> Server Settings

Answer

Settings -> Authentication Method

Question 7

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

Accepted Answer

Deployment Server. The Deployment Server is the Splunk component specifically designed to push configuration files (such as inputs.conf, outputs.conf, and apps) to large fleets of Universal Forwarders. Forwarders are configured with a deploymentclient.conf pointing to the Deployment Server, and they poll it for updated apps and configuration. This centralized management is essential at scale, avoiding manual configuration on each forwarder.

Answer

Heavy Forwarder

Answer

Indexer Cluster Master

Answer

Search Head Cluster Deployer

Question 8

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

Accepted Answer

The user can perform real-time searches.. In Splunk's role-based access control, capabilities are additive across all roles assigned to a user. If any one role grants a capability, the user effectively has that capability, even if another role does not grant it. Since RoleA has rtsearch enabled, the user can perform real-time searches regardless of RoleB's setting.

Answer

The user can only perform real-time searches on index 'main'.

Answer

The user cannot perform real-time searches.

Answer

The user is prompted to choose which role to act as.

Question 9

An administrator needs to ensure that a specific indexer does not exceed 100 GB of indexing per day, while the rest of the deployment has a total license of 500 GB per day. The administrator creates a license pool with a 100 GB quota and assigns the indexer to it. What is the effect of this configuration?

Accepted Answer

The indexer is limited to 100 GB per day, and the remaining 400 GB is available to other indexers in the default pool.. Creating a license pool with a quota and assigning an indexer to it enforces a daily indexing limit for that indexer. The quota is carved out of the total license volume, and the remaining volume is available to other indexers in the default pool. This allows granular control over indexing consumption.

Answer

The license pool configuration has no effect unless the indexer is also configured as a license master.

Answer

The indexer is limited to 100 GB per day, but the remaining 400 GB cannot be used by other indexers.

Answer

The indexer can exceed 100 GB per day as long as the total deployment does not exceed 500 GB.

Question 10

Which THREE of the following represent true statements about the 'transforms.conf' file?

Accepted Answer

It is used to perform data masking or anonymization. Option A is correct because transforms.conf defines transform stanzas that can apply regex-based field manipulation, including masking or anonymizing sensitive data via settings like REGEX and FORMAT or DEST_KEY. Option B is correct because transforms.conf supports routing events to different indexes using a transform with DEST_KEY = _MetaData:Index and a FORMAT that sets the target index, typically invoked from props.conf. Option C is correct because props.conf references transforms.conf stanzas through attributes such as TRANSFORMS- and REPORT- to perform field extractions and other transformations at search time or index time. Option D is not correct because TCP inputs are configured in inputs.conf with stanzas like [tcp://], not transforms.conf. Option E is not correct because sourcetype assignment is defined in inputs.conf (e.g., sourcetype=) or via props.conf, not in transforms.conf.

Answer

It is the primary file for setting up TCP inputs

Answer

It is used to define the sourcetype of data

Question 11

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/local/. Option B ($SPLUNK_HOME/etc/apps/my_app/local/) is correct because the local directory inside an app's configuration folder is a valid, supported location for custom configuration files such as inputs.conf, and it takes precedence over the app's default directory. Option D ($SPLUNK_HOME/etc/system/local/) is correct because the system/local directory is the standard location for custom, system-wide configuration overrides, including inputs.conf, and it is honored by Splunk at the system level. Option A ($SPLUNK_HOME/etc/system/default/) is not valid for custom files, as the default directory holds Splunk's built-in, shipped configurations and should not be modified by administrators. Option C ($SPLUNK_HOME/var/lib/) is incorrect because that path is used for Splunk's runtime and index data, not for configuration files. Option E ($SPLUNK_HOME/etc/apps/my_app/default/) is not appropriate for custom inputs.conf because the default directory is reserved for an app's shipped default settings, and user customizations belong in the app's local directory instead.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/my_app/default/

Question 12

Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?

Accepted Answer

Manage user roles.. Option B is correct because Splunk Web's Settings menu includes the Users and Authentication section, where administrators can create and manage user roles and their associated capabilities. Option D is correct because the Settings menu contains the Data Inputs page, which lets users configure inputs such as files, directories, TCP/UDP ports, and scripts to bring data into Splunk. Option E is correct because the Settings menu provides an Indexes page for creating, editing, and managing indexes, including their retention and size settings. Option A is not correct because writing raw C++ code for the Splunk engine is not a Splunk Web Settings function; the engine is not modified through the UI. Option C is not correct because restarting the physical operating system is an OS-level action, not a Splunk Web Settings menu action.

Answer

Write raw C++ code for the Splunk engine.

Answer

Restart the physical OS.

Question 13

An administrator is reviewing how Splunk Enterprise licensing behaves in a distributed deployment and wants to confirm which statements about the license manager and indexer relationship are accurate. (Choose two.)

Accepted Answer

Each indexer must be assigned to a license pool, and the pool's quota is enforced against the combined usage of its member indexers.. In a distributed deployment, indexers report usage to the license manager, which aggregates it and enforces the rolling license window. Indexers belong to license pools, and a pool's quota applies to the combined usage of its members, enabling independent accounting for different teams. These two behaviors define how licensing is tracked and constrained across the deployment.

Answer

Indexers immediately stop indexing whenever the license manager becomes unreachable for any duration.

Answer

The license manager performs the indexing and forwards events to indexers for storage.

Answer

The license manager must run on a dedicated search head to function correctly.

Question 14

A Splunk Enterprise deployment indexes 480 GB per day against a 500 GB per day Enterprise license. The administrator wants to be alerted by email the moment daily indexing exceeds 90 percent of the license quota, well before any violation occurs. Which configuration should the administrator use to accomplish this?

Accepted Answer

Configure an alert on the License Usage report in the Monitoring Console with a threshold of 90 percent of the daily license quota.. The Monitoring Console License Usage view is the supported way to observe daily indexing volume relative to the license quota, and alerts built on it can trigger at a chosen percentage. Setting a 90 percent threshold gives the administrator advance warning, allowing corrective action such as input throttling before the daily cap is exceeded and a violation is recorded.

Answer

Create a scheduled search that counts license_usage.log events and sends email whenever any event is found.

Answer

Enable the license violation alert in server.conf so the license manager sends an email when a violation is recorded.

Answer

Set the license window to 30 days and configure the indexer to email the administrator at the end of each window.

Question 15

A Splunk administrator needs to assign three indexers to a dedicated license pool so their combined daily indexing volume is capped separately from the rest of the deployment. The deployment uses a single enterprise license on one license manager. Which statement describes the correct approach?

Accepted Answer

Create a license pool on the license manager, allocate a portion of the license stack to it, and add the three indexers as pool members.. License pools exist to partition a license stack so specific indexers draw from a defined quota. The administrator creates a pool on the license manager, allocates stack members to it, and adds the target indexers as members. That configuration isolates the three indexers' consumption and enforces the separate cap while the rest of the deployment continues using the remaining license capacity.

Answer

Configure a distributed search group on the search head that includes only the three indexers and apply a quota.

Answer

Install a separate license file on each of the three indexers and configure them as standalone license managers.

Answer

Edit indexes.conf on the three indexers to set a maxDataSize limit that matches the desired daily volume.