SPLK-1003 Practice Test 20 — 15 Questions

Question 1

You are configuring SAML authentication for Splunk Enterprise. You need to ensure that when a user authenticates via SAML, their Splunk roles are assigned based on an attribute sent by the Identity Provider (IdP). Which configuration setting in authentication.conf allows you to map an IdP attribute to Splunk roles?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roleMap. The roleMap setting in authentication.conf maps values from a specified SAML attribute to Splunk roles. You must also define which SAML attribute contains the role information (using the 'attribute' setting under the SAML stanza). The roleMap then translates those attribute values into Splunk roles, enabling dynamic role assignment.

Answer

roleAttribute

Answer

groupAttribute

Answer

attributeQuery

Question 2

A Splunk administrator is preparing to install a new app across a search head cluster and wants to avoid configuration conflicts with existing apps. Before installation, the administrator reviews the app's default configuration files. Where should the administrator expect to find the app's default settings after installation?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/default/. Packaged app settings live in the app's default directory under $SPLUNK_HOME/etc/apps, where they serve as the baseline configuration. Local directories are reserved for overrides, so reviewing defaults is the correct way to see what the app will do before any administrator customization is applied.

Answer

$SPLUNK_HOME/etc/apps/<app_name>/local/

Answer

$SPLUNK_HOME/etc/users///local/

Answer

$SPLUNK_HOME/etc/system/local/

Question 3

An administrator needs to allow a group of users to access Splunk Web using their existing Active Directory credentials but wants to avoid storing user passwords in Splunk. Which authentication method should be configured?

Accepted Answer

LDAP authentication. LDAP authentication is the appropriate choice because it integrates directly with Active Directory, allowing users to log in with their AD credentials without Splunk storing passwords. Splunk validates credentials by binding to the LDAP server. While SAML and ProxySSO also avoid storing passwords, they require additional infrastructure (IdP or proxy) and are not as directly aligned with using Active Directory credentials in this scenario.

Answer

Splunk native authentication

Answer

SAML authentication

Answer

ProxySSO authentication

Question 4

A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?

Accepted Answer

The index reached the maxTotalDataSizeMB limit.. The most likely cause is that the index reached the maxTotalDataSizeMB limit, which triggers the deletion of the oldest buckets regardless of the retention policy. In Splunk, the maxTotalDataSizeMB setting defines the maximum size of the index, and when this limit is reached, Splunk freezes and deletes the oldest data to make room for new data. This overrides the retention period set by frozenTimePeriodInSecs, causing data older than expected to be unavailable.

Answer

The buckets are in the warm state.

Answer

The index is corrupted.

Answer

The user does not have read access to the cold bucket.

Question 5

A Splunk admin is troubleshooting why a search returns no results for a specific index. The admin suspects a configuration precedence issue involving index definitions in multiple apps. Which TWO actions would help identify which configuration file is actually being used for the index definition? (Choose two.)

Accepted Answer

Run 'splunk btool indexes list --debug' to see all merged index configurations and their source files.. btool is the primary tool for inspecting effective configuration and tracing settings back to their source files. Running it against the indexes configuration with debug output shows the merged result and the file path for each setting. Scoping with the app flag isolates a single app's contribution. Together, these commands let the admin pinpoint which file is winning precedence for the index definition.

Answer

Check the Splunk web interface under Settings > Indexes to see the active index configuration.

Answer

Delete all but one index definition file and re-run the search to see if results appear.

Answer

Restart Splunk and watch the splunkd.log for index-related warnings.

Question 6

A Splunk administrator is preparing a single indexer to receive forwarded data from many universal forwarders. The administrator wants the forwarders to send data to the indexer's receiving port. Which action enables the indexer to accept this forwarded data?

Accepted Answer

Enable the receiving port on the indexer using the CLI command splunk enable listen 9997. To receive forwarded data, an indexer must have the receiving port enabled, typically port 9997, which is done with splunk enable listen 9997. This opens the TCP listener that universal forwarders connect to. Forwarders themselves are configured with outputs.conf to target the indexer, not with inputs. License roles and local file monitoring do not enable network reception of forwarded events.

Answer

Add a TCP input stanza for port 9997 in inputs.conf on each universal forwarder

Answer

Set the indexer to use the license master role so it can accept forwarded data

Answer

Configure a monitor stanza in inputs.conf on the indexer for the forwarders' log directories

Question 7

A Splunk administrator needs to install a new app on a single search head in a non-clustered environment. The administrator wants to use the CLI because the server has no browser access. Which command should be used to install the app from a local package file?

Accepted Answer

splunk install app /tmp/myapp.tgz -auth admin:password. The CLI command splunk install app installs an app from a local archive or URL and authenticates with -auth. It is the correct method for headless servers where Splunk Web is unavailable. The other commands either do not exist, apply configuration rather than install, or enable an already-present app, so none of them installs a new app package.

Answer

splunk add app /tmp/myapp.tgz -auth admin:password

Answer

splunk enable app /tmp/myapp.tgz -auth admin:password

Answer

splunk apply app /tmp/myapp.tgz -auth admin:password

Question 8

A Splunk administrator has just completed a fresh installation of Splunk Enterprise on a Linux server and needs to set the admin account password before the instance is connected to the network. Which CLI command should the administrator run?

Accepted Answer

splunk edit user admin -password <newpassword> -auth admin:changeme. On a new Splunk Enterprise installation the admin account exists with the default password changeme. The supported CLI method to change that password is splunk edit user admin -password, authenticated with the current credentials. This must be done before the instance is reachable on the network. Commands that start the service or configure boot-start do not modify credentials, and add user cannot recreate an existing account.

Answer

splunk enable boot-start --accept-license

Answer

splunk start --accept-license

Answer

splunk add user admin -password <newpassword> -role admin

Question 9

A Splunk administrator manages a large deployment of Universal Forwarders using the Deployment Server. They need to push a new version of a custom app to a subset of forwarders. Which configuration on the Deployment Server is used to define which forwarders receive the app?

Accepted Answer

serverclass.conf. The Deployment Server uses serverclass.conf to define server classes that map deployment clients to apps. Filters such as whitelist and blacklist allow targeting a subset of forwarders. This is the standard mechanism for selective app deployment. Other files like deploymentclient.conf, outputs.conf, and inputs.conf serve different purposes and do not control app assignment.

Answer

outputs.conf

Answer

inputs.conf

Answer

deploymentclient.conf

Question 10

A Splunk administrator is reviewing role-based access control for a team that should be able to create and share searches and dashboards but must not be able to manage users, indexes, or other administrative settings. Which built-in role best fits this requirement with least privilege?

Accepted Answer

power. The power role is the built-in role intended for users who create and share searches, reports, and dashboards without administrative privileges. It excludes user, index, and system management, satisfying least privilege. The admin role is too broad, the user role is too limited for sharing, and can_delete only governs data deletion, making power the correct fit.

Answer

user

Answer

admin

Answer

can_delete

Question 11

An administrator manages a Splunk Enterprise deployment with a 500 GB/day Enterprise license. The company's legal team requires that all indexing activity be attributed to specific business units for chargeback. The administrator needs to configure the license so that each business unit's indexing volume is tracked separately, but the total daily indexing volume across all units must not exceed 500 GB. What should the administrator do?

Accepted Answer

Create a separate license pool for each business unit and assign the appropriate indexers to each pool.. License pools let you subdivide the total license volume and assign indexers to pools, enabling per-group tracking and enforcement. Each pool has a quota, and the sum of quotas cannot exceed the total license. This satisfies the chargeback requirement while ensuring the overall 500 GB/day cap is respected.

Answer

Configure each indexer with its own standalone license and manually sum the daily volumes from each license master.

Answer

Create a new index for each business unit and use the License Usage report to filter by index name.

Answer

Enable indexer clustering and use the cluster master to distribute license usage evenly across all peer nodes.

Question 12

An administrator is configuring a new Splunk Enterprise deployment and needs to ensure that the license master can be reached by all indexers. The license master is hosted on a server with IP address 192.168.1.100 and listens on the default management port. Which command should the administrator run on each indexer to point it to the license master?

Accepted Answer

splunk edit licenser-localslave -master_uri https://192.168.1.100:8089. The correct command uses HTTPS and the default management port 8089 to point the indexer to the license master. This ensures secure communication and proper license reporting. The other options use incorrect ports or protocols, which would prevent the indexer from connecting to the license master.

Answer

splunk edit licenser-localslave -master_uri https://192.168.1.100:8000

Answer

splunk edit licenser-localslave -master_uri https://192.168.1.100:9997

Answer

splunk edit licenser-localslave -master_uri http://192.168.1.100:8089

Question 13

A Splunk Enterprise deployment has a license master and several indexers. The administrator notices that the license master's daily indexing volume is approaching the licensed limit. To avoid a violation, the administrator wants to temporarily reduce indexing on a specific indexer without disrupting other indexers. Which action should the administrator take?

Accepted Answer

On the indexer, modify the inputs.conf file to disable specific data inputs, then restart Splunk.. Disabling specific data inputs on the indexer reduces indexing volume while keeping other inputs active. This is a targeted approach that avoids disrupting other indexers or stopping the entire service. It requires editing inputs.conf and reloading or restarting Splunk, but it effectively lowers license consumption without affecting the broader deployment.

Answer

On the license master, run 'splunk edit licenser-localslave -maxvolume 0' to set the indexer's license quota to zero.

Answer

On the indexer, use the CLI command 'splunk stop' to stop the Splunk service entirely.

Answer

On the indexer, run 'splunk disable boot-start' to prevent Splunk from starting automatically.

Question 14

A Splunk administrator needs to configure a new index called `metrics_store` on a heavy forwarder. The requirement is that the index data must be stored on a dedicated storage volume named `volume:metrics` and the volume should be limited to 200 GB. Which configuration correctly sets the volume for this index?

Accepted Answer

In indexes.conf, define `[volume:metrics]` with `path = /data/metrics` and `maxVolumeDataSizeMB = 200000`, then in the `[metrics_store]` stanza set `homePath = volume:metrics/metrics_store/db` and `coldPath = volume:metrics/metrics_store/colddb`.. To store an index on a dedicated volume, you must define a volume stanza in indexes.conf with a path and a size limit in megabytes, then reference that volume in the index's homePath and coldPath using the `volume:` prefix. The correct configuration uses `volume:metrics` and sets maxVolumeDataSizeMB to 200000 for 200 GB.

Answer

In indexes.conf, set `homePath = /data/metrics/metrics_store/db` and `coldPath = /data/metrics/metrics_store/colddb` directly in the `[metrics_store]` stanza, and add `maxVolumeDataSizeMB = 200000` to the same stanza.

Answer

In indexes.conf, define `[volume:metrics]` with `path = /data/metrics` and `maxVolumeDataSizeMB = 200`, then in the `[metrics_store]` stanza set `homePath = volume:metrics/metrics_store/db` and `coldPath = volume:metrics/metrics_store/colddb`.

Answer

In server.conf, define `[volume:metrics]` with `path = /data/metrics` and `maxVolumeDataSizeMB = 200000`, then in indexes.conf set `homePath = volume:metrics/metrics_store/db` and `coldPath = volume:metrics/metrics_store/colddb`.

Question 15

A Splunk administrator is reviewing license usage and notices that the daily indexing volume has been consistently below the licensed limit, but the license master shows a warning about a license violation. The administrator checks the license usage report and sees that no pool has exceeded its quota. What is the most likely cause of the warning?

Accepted Answer

The license master is not receiving license usage data from one or more indexers.. License violations can occur if the license master does not receive usage data from all indexers. The master may interpret missing data as a violation or generate a warning about incomplete reporting. The administrator should verify that all indexers are properly configured to report to the license master and that there are no connectivity issues.

Answer

A search head is indexing data locally, consuming license volume not attributed to any indexer.

Answer

The license file has expired, and the license master is enforcing a grace period.

Answer

The license master's clock is out of sync with the indexers, causing incorrect daily volume calculations.