SPLK-1003 Practice Test 2 — 10 Questions

Question 1

You want to prevent an index from growing beyond 10,000,000 events. Which setting is appropriate?

Accepted Answer

It is not possible to limit by event count via indexes.conf.. maxTotalDataSizeMB is for size, but maxHotSpanSecs or other settings do not limit by event count. However, maxWarmDBCount and maxHotBuckets can influence retention, but there is no direct 'maxEventCount' setting in indexes.conf. Therefore, you must use a scripted approach or external monitoring. Wait—actually, checking the docs, there is no event count limit. The best answer is that it cannot be done via indexes.conf.

Answer

maxTotalDataSizeMB

Answer

maxEventCount

Answer

maxBuckets

Question 2

An administrator needs to move an existing index's raw data to a new storage location without losing searchability. What is the recommended approach?

Accepted Answer

Update homePath and coldPath in indexes.conf to the new volume paths.. The volume-based storage approach allows moving indexes by updating homePath and coldPath to point to new volumes defined in volumes.conf.

Answer

Rename the index directory in the OS.

Answer

Delete and recreate the index with the new path.

Answer

Use the 'splunk revert' command.

Question 3

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. The forwarder handshakes, downloads app bundles, and restarts/reloads as configured.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 4

What is the effect of setting 'maxHotSpanSecs' to a very low value?

Accepted Answer

More frequent bucket rolling.. A low maxHotSpanSecs value causes buckets to roll more frequently, which increases the number of buckets and overhead.

Answer

Increased search performance.

Answer

Decreased disk usage.

Answer

Faster ingestion.

Question 5

Which Splunk GUI page provides a summary of all configured indexes and their current disk usage?

Accepted Answer

Settings > Data > Indexes. The 'Indexes' page under Settings > Data > Indexes provides a dashboard-style view of index status and usage.

Answer

Settings > Server Settings

Answer

Settings > Data > Inputs

Answer

Settings > Licensing

Question 6

When using a Heavy Forwarder to perform data masking, which stanza in transforms.conf is used to define the replacement regex?

Accepted Answer

[my_masking_rule]. The REGEX and FORMAT attributes within a transforms.conf stanza are used for data masking.

Answer

[index_rule]

Answer

[forward_rule]

Answer

[input_rule]

Question 7

An administrator needs to monitor a script output every 60 seconds. Which configuration in inputs.conf is correct for a scripted input?

Accepted Answer

[script://./bin/myscript.sh] interval = 60. The interval attribute in seconds determines how often a script is executed.

Answer

[script] path = ./bin/myscript.sh, time = 60

Answer

[script://./bin/myscript.sh] frequency = 60

Answer

[script://./bin/myscript.sh] exec_time = 60

Question 8

A Splunk administrator has configured a Deployment Server to manage forwarders. Which file on the forwarder must be configured to establish communication with the Deployment Server?

Accepted Answer

deploymentclient.conf. The deploymentclient.conf file is used on the client-side to specify the Deployment Server's URI and poll interval.

Answer

inputs.conf

Answer

outputs.conf

Answer

serverclass.conf

Question 9

What is the impact of placing a forwarder in a license pool?

Accepted Answer

Forwarders cannot be part of a license pool.. Forwarders do not consume license quota; only indexers consume license. Therefore, assigning a forwarder to a pool has no effect.

Answer

It reduces the forwarder's data throughput.

Answer

The forwarder will consume the pool's quota.

Answer

It limits the amount of data the forwarder can send.

Question 10

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

Accepted Answer

transforms.conf: [setnull]. You must use transforms.conf with a regex rule and link it to props.conf to discard data at index time.

Answer

inputs.conf: [monitor://...]

Answer

outputs.conf: [tcpout]

Answer

props.conf: [default]