SPLK-1003 Practice Exam 1 — 20 Questions

Question 1

How can you increase the amount of raw data stored in a single bucket before it rolls?

Accepted Answer

Modify 'maxDataSize'.. The 'maxDataSize' setting dictates the size threshold for rolling a bucket from hot to warm.

Answer

Modify 'maxTotalDataSizeMB'.

Answer

Modify 'frozenTimePeriodInSecs'.

Answer

Modify 'homePath'.

Question 2

What happens to data when a bucket rolls to 'frozen'?

Accepted Answer

It is deleted by default.. By default, when a bucket rolls to frozen, it is deleted unless a coldToFrozenScript is configured.

Answer

It is archived to the coldPath.

Answer

It is moved to a read-only state.

Answer

It is moved to the warmPath.

Question 3

You are configuring a new index for high-volume data. To optimize ingestion performance, where should you place the hot buckets?

Accepted Answer

On high-performance local storage (SSD).. Hot buckets should be placed on high-performance storage, such as SSDs, because they are constantly being written to.

Answer

On a network-attached storage (NAS) with high latency.

Answer

In the coldPath directory.

Answer

On the same partition as the OS.

Question 4

A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?

Accepted Answer

The index reached the maxTotalDataSizeMB limit.. The frozenTimePeriodInSecs is the primary retention limit; if it is set correctly, check the maxTotalDataSizeMB, which might trigger rolling to frozen earlier if the disk fills up.

Answer

The buckets are in the warm state.

Answer

The index is corrupted.

Answer

The user does not have read access to the cold bucket.

Question 5

Which TWO actions should be taken before manually moving an index to a new storage volume?

Accepted Answer

Verify the file system permissions of the new path.. You must stop the Splunk service and ensure the filesystem permissions are correct for the new directory.

Answer

Modify the indexes.conf file.

Answer

Clear the license master cache.

Answer

Delete the existing index.

Question 6

A bucket in the 'warm' state is currently locked. What process is likely happening?

Accepted Answer

The bucket is being rolled.. During bucket rolling (from hot to warm or warm to cold), the bucket is temporarily locked to ensure data integrity during the file system move.

Answer

The bucket is being searched.

Answer

The bucket is being indexed.

Answer

The bucket is undergoing a summary rebuild.

Question 7

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When precedence is tied, Splunk uses a deterministic method based on the filename, sorting alphabetically.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 8

Which TWO of the following are valid ways to define field extractions?

Accepted Answer

Using the EXTRACT- prefix in props.conf. Field extractions can be defined using inline regex in props.conf or via transforms.conf.

Answer

Directly in inputs.conf

Answer

Using the INDEXED-EXTRACTION attribute in transforms.conf

Answer

Using a CSV file in etc/system/local

Question 9

You need to ensure that Data Models are accelerated. Where are the acceleration summaries stored?

Accepted Answer

Within the index itself in a sub-directory.. Data model acceleration summaries are stored in the indexer where the data resides, specifically within the index's bucket structure.

Answer

In the system/bin directory.

Answer

On the Search Head in a separate index.

Answer

In the Splunk KV Store.

Question 10

An administrator needs to manually move a bucket to frozen state immediately for compliance reasons. What is the best method?

Accepted Answer

Update the retention policy to 0 seconds and restart.. The 'splunk enable/disable/remove' commands don't support manual freezing; the 'splunk revert' or manual bucket removal is not supported, but modifying the frozenTimePeriodInSecs is the formal way to trigger a policy change.

Answer

Delete the bucket folder from the OS.

Answer

Rename the bucket folder to start with 'frozen'.

Answer

Use the 'splunk edit index' command.

Question 11

You want to prevent an index from growing beyond 10,000,000 events. Which setting is appropriate?

Accepted Answer

It is not possible to limit by event count via indexes.conf.. maxTotalDataSizeMB is for size, but maxHotSpanSecs or other settings do not limit by event count. However, maxWarmDBCount and maxHotBuckets can influence retention, but there is no direct 'maxEventCount' setting in indexes.conf. Therefore, you must use a scripted approach or external monitoring. Wait—actually, checking the docs, there is no event count limit. The best answer is that it cannot be done via indexes.conf.

Answer

maxTotalDataSizeMB

Answer

maxEventCount

Answer

maxBuckets

Question 12

An administrator needs to move an existing index's raw data to a new storage location without losing searchability. What is the recommended approach?

Accepted Answer

Update homePath and coldPath in indexes.conf to the new volume paths.. The volume-based storage approach allows moving indexes by updating homePath and coldPath to point to new volumes defined in volumes.conf.

Answer

Rename the index directory in the OS.

Answer

Delete and recreate the index with the new path.

Answer

Use the 'splunk revert' command.

Question 13

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. The forwarder handshakes, downloads app bundles, and restarts/reloads as configured.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 14

What is the effect of setting 'maxHotSpanSecs' to a very low value?

Accepted Answer

More frequent bucket rolling.. A low maxHotSpanSecs value causes buckets to roll more frequently, which increases the number of buckets and overhead.

Answer

Increased search performance.

Answer

Decreased disk usage.

Answer

Faster ingestion.

Question 15

Which Splunk GUI page provides a summary of all configured indexes and their current disk usage?

Accepted Answer

Settings > Data > Indexes. The 'Indexes' page under Settings > Data > Indexes provides a dashboard-style view of index status and usage.

Answer

Settings > Server Settings

Answer

Settings > Data > Inputs

Answer

Settings > Licensing

Question 16

When using a Heavy Forwarder to perform data masking, which stanza in transforms.conf is used to define the replacement regex?

Accepted Answer

[my_masking_rule]. The REGEX and FORMAT attributes within a transforms.conf stanza are used for data masking.

Answer

[index_rule]

Answer

[forward_rule]

Answer

[input_rule]

Question 17

An administrator needs to monitor a script output every 60 seconds. Which configuration in inputs.conf is correct for a scripted input?

Accepted Answer

[script://./bin/myscript.sh] interval = 60. The interval attribute in seconds determines how often a script is executed.

Answer

[script] path = ./bin/myscript.sh, time = 60

Answer

[script://./bin/myscript.sh] frequency = 60

Answer

[script://./bin/myscript.sh] exec_time = 60

Question 18

A Splunk administrator has configured a Deployment Server to manage forwarders. Which file on the forwarder must be configured to establish communication with the Deployment Server?

Accepted Answer

deploymentclient.conf. The deploymentclient.conf file is used on the client-side to specify the Deployment Server's URI and poll interval.

Answer

inputs.conf

Answer

outputs.conf

Answer

serverclass.conf

Question 19

What is the impact of placing a forwarder in a license pool?

Accepted Answer

Forwarders cannot be part of a license pool.. Forwarders do not consume license quota; only indexers consume license. Therefore, assigning a forwarder to a pool has no effect.

Answer

It reduces the forwarder's data throughput.

Answer

The forwarder will consume the pool's quota.

Answer

It limits the amount of data the forwarder can send.

Question 20

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

Accepted Answer

transforms.conf: [setnull]. You must use transforms.conf with a regex rule and link it to props.conf to discard data at index time.

Answer

inputs.conf: [monitor://...]

Answer

outputs.conf: [tcpout]

Answer

props.conf: [default]