SPLK-1003 Practice Exam 2 — 20 Questions

Question 1

A Splunk administrator is managing an indexer cluster with a replication factor of 3 and a search factor of 2. A peer node fails and is expected to be offline for an extended period. The administrator needs to ensure that the cluster remains searchable and that data is not lost. Which action should be taken to maintain the search factor while the peer is down?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cluster manager will automatically fix the search factor by promoting other copies.. The cluster manager is responsible for maintaining the replication and search factors. When a peer becomes unavailable, it automatically promotes other copies to searchable status to meet the search factor, ensuring continuous searchability. This is a core feature of Splunk indexer clustering, designed to handle peer failures gracefully.

Answer

Use the CLI command 'splunk apply cluster-bundle' to redistribute buckets.

Answer

Increase the replication factor to 4 to compensate for the lost peer.

Answer

Manually copy bucket copies from the failed peer to other peers.

Question 2

Where does an administrator configure the License Master URL for an indexer?

Accepted Answer

In the server.conf file.. The License Master URL for an indexer is configured in the server.conf file, specifically under the [license] stanza with the 'master_uri' setting. This file is located in $SPLUNK_HOME/etc/system/local/ or an app directory.

Answer

In the license.conf file.

Answer

In the web.conf file.

Answer

In the Splunk Web UI under Licensing.

Question 3

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Accepted Answer

props.conf. BREAK_ONLY_BEFORE is a line-breaking/event-merging setting that belongs in props.conf under the [] or [host::] stanza. It tells the parser to start a new event only when the specified regex matches, which is essential for correctly grouping multiline events like Java stack traces or log4j entries. Because props.conf governs parsing-time behavior on the indexer (or heavy forwarder), that is the correct file.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 4

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local

Question 5

Which TWO factors contribute to the 'frozen' state of a bucket?

Accepted Answer

The bucket age exceeds frozenTimePeriodInSecs.. In Splunk, a bucket becomes 'frozen' when it has aged past the frozenTimePeriodInSecs setting (Option A), meaning its data has exceeded the configured retention period and is ready to be frozen (archived or deleted). A bucket also becomes frozen when the index's total size reaches maxTotalDataSizeMB (Option C), which forces the oldest buckets to roll to frozen to keep the index within its size limit. Option B is incorrect because search head locking does not freeze buckets; search heads coordinate searches but do not control bucket lifecycle. Option D is incorrect because maxHotBuckets limits how many hot buckets can exist in an index, causing hot buckets to roll to warm, not to frozen. Option E is incorrect because license master availability affects indexing and license enforcement, not the freezing of buckets.

Answer

The bucket is locked by a search head.

Answer

The index reaches maxHotBuckets.

Answer

The license master is unreachable.

Question 6

An administrator wants to see a daily breakdown of license usage for the last 30 days. Which view is most appropriate?

Accepted Answer

Settings > Licensing > Usage Report. The Usage Report under Settings > Licensing provides a detailed breakdown of license usage, including daily consumption over a specified time range. It allows administrators to view historical data for up to 30 days (or more, depending on retention) and is the designated tool for monitoring license usage trends. This view directly addresses the requirement to see a daily breakdown for the last 30 days.

Answer

Settings > Indexer Clustering

Answer

Settings > Licensing > Master

Answer

Settings > Forwarder Management

Question 7

An administrator is troubleshooting an indexer cluster where searches are returning incomplete results. The cluster has three indexers with replication factor 2 and search factor 2. The administrator notices that one indexer is down. What is the most likely reason for incomplete search results?

Accepted Answer

The search factor is not met for some buckets.. In an indexer cluster, search factor determines how many searchable copies of each bucket exist. If an indexer goes down, buckets that had their only searchable copy on that indexer become unsearchable, leading to incomplete results. This can happen even if replication factor is met, because replication factor ensures data copies but not searchable copies. The cluster attempts to maintain search factor by making other copies searchable, but this process may take time. The most likely reason is that search factor is not met for some buckets.

Answer

The search head is not configured to search all indexers.

Answer

The indexer that is down was the master node.

Answer

The replication factor is set too low.

Question 8

An administrator is setting up a new Splunk index for a critical application. The index will receive a high volume of data, and the administrator wants to ensure that the indexer's disk usage is optimized. The administrator decides to use a storage volume to manage multiple indexes and wants to set a maximum size for the volume. Which configuration file and stanza should be used to define the volume and its size limit?

Accepted Answer

indexes.conf, [volume:volume_name] stanza with maxVolumeDataSizeMB. The correct configuration is in indexes.conf using a volume stanza. The [volume:volume_name] stanza defines a volume, and maxVolumeDataSizeMB sets its maximum size in megabytes. This allows the administrator to manage disk usage across multiple indexes by grouping them into volumes and enforcing size limits.

Answer

server.conf, [diskUsage] stanza with maxVolumeDataSizeMB

Answer

limits.conf, [volume] stanza with maxVolumeDataSizeMB

Answer

indexes.conf, [index_name] stanza with maxVolumeDataSizeMB

Question 9

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. In SAML authentication, the Splunk instance acts as the Service Provider (SP) — it receives SAML assertions from the Identity Provider (IdP) and grants access based on those assertions. Splunk's SAML configuration (via authentication.conf and the SAML settings in Splunk Web) defines the SP entity ID, ACS URL, and IdP metadata. The IdP is the external identity system (such as Okta, Microsoft Entra ID, or ADFS) that authenticates users and issues assertions.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 10

A Splunk administrator needs to onboard a new log source on a heavy forwarder and wants the parsed events sent to an indexer while ensuring the forwarder itself parses the data before transmission. Which configuration file on the heavy forwarder controls where the parsed events are sent?

Accepted Answer

outputs.conf. Because a heavy forwarder performs parsing locally, the parsed event stream is sent to downstream indexers according to the [tcpout] stanzas in outputs.conf. Editing that file to list the target indexer or indexer group ensures the data is delivered to the correct destination after local processing.

Answer

transforms.conf

Answer

inputs.conf

Answer

props.conf

Question 11

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

Accepted Answer

delete. In Splunk, the 'delete' command is controlled by the 'delete' capability. This capability allows a user to use the delete command to remove events from indexes. To prevent a user from using the delete command, you must remove the 'delete' capability from their role. Other capabilities like edit_search, can_delete_data, and admin_all_objects do not directly govern the delete command.

Answer

edit_search

Answer

can_delete_data

Answer

admin_all_objects

Question 12

A Splunk administrator needs to add a new index named `audit_logs` that will store data on a specific storage volume defined as `volume:audit_vol`. The volume has a maximum size of 500 GB. Which configuration in `indexes.conf` is required to associate the index with this volume?

Accepted Answer

Set `homePath = volume:audit_vol/audit_logs/db` and `coldPath = volume:audit_vol/audit_logs/colddb`.. To associate an index with a storage volume, the `homePath` and `coldPath` must use the `volume:<name>` syntax. This ensures all buckets for the index are stored within the volume, and the volume's `maxVolumeDataSizeMB` setting applies. The volume itself must be defined in a separate `volume` stanza with its path and size limit.

Answer

Set `volume = audit_vol` in the index stanza.

Answer

Set `homePath = /opt/splunk/var/lib/splunk/audit_logs/db` and `coldPath = volume:audit_vol/audit_logs/colddb`.

Answer

Set `homePath = volume:audit_vol/audit_logs/db` and `coldPath = volume:audit_vol/audit_logs/colddb`, and also set `maxVolumeDataSizeMB = 500000` in the index stanza.

Question 13

A Splunk administrator is configuring a Universal Forwarder to monitor a network share on a Windows file server. The forwarder is installed on a separate Windows server and runs under the Local System account. The network share requires domain authentication. The administrator wants to ensure that the forwarder can read the files on the share. What should the administrator do?

Accepted Answer

Configure the Universal Forwarder service to log on as a domain user with read access to the share.. The Universal Forwarder service runs as Local System by default, which lacks domain credentials to access remote network shares. To read files from a network share that requires domain authentication, the service must run under a domain user account that has read permissions on the share. This is done by changing the service logon account in Windows Services. Other methods like adding Local System to share permissions or using proxy settings in inputs.conf are not valid.

Answer

Configure the forwarder to use a proxy account by setting 'proxyUser' and 'proxyPassword' in inputs.conf.

Answer

Enable 'useSSL = true' in outputs.conf to allow secure authentication to the share.

Answer

Add the Local System account to the share's permissions with read access.

Question 14

An administrator manages a Splunk Enterprise deployment where a critical index named 'audit_logs' must retain searchable data for 90 days. Compliance requires that after 90 days, the data must be moved to a remote NFS share for archival, but it must not be searchable in Splunk. The administrator has set frozenTimePeriodInSecs = 7776000 in indexes.conf for this index. Which additional configuration is required to ensure that buckets are archived to the remote NFS share instead of being deleted?

Accepted Answer

Set coldToFrozenDir to the NFS mount path in the index stanza.. To archive frozen buckets to a remote location, Splunk provides the coldToFrozenDir setting in indexes.conf. When a bucket reaches the frozen state, Splunk moves it to the specified directory instead of deleting it. This makes the data non-searchable but preserves it for compliance. The other options either reference invalid settings or misunderstand the bucket lifecycle.

Answer

Set coldPath to the NFS mount path and increase maxHotSpanSecs.

Answer

Set frozenTimePeriodInSecs to a higher value and configure a scripted input to copy buckets.

Answer

Set archiveOnDelete to true in the index stanza and specify a remote path.

Question 15

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Option A is correct because the Universal Forwarder is a lightweight agent purpose-built to consume minimal CPU, memory, and disk resources on the source host, using a small binary with no bundled search or indexing components. Option D is correct because the Universal Forwarder does not parse or index data; it only collects, optionally compresses/encrypts, and forwards raw data (typically via TCP 9997) to a receiving indexer or heavy forwarder, where parsing and indexing occur. Option B is wrong because a Universal Forwarder can be configured with multiple outputs to send data to several indexers simultaneously, including via load balancing or an indexer cluster. Option C is wrong because the Universal Forwarder is free to download and use and does not require a Splunk Enterprise license; only the indexing/receiving side needs licensing. Option E is wrong because full parsing and indexing are performed by indexers (or heavy forwarders), not by the Universal Forwarder, which by design leaves data unparsed.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 16

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. For a Universal Forwarder, outputs.conf should be placed in $SPLUNK_HOME/etc/system/local/ because that directory holds machine-specific, administrator-created configurations that override defaults and are not tied to a particular app. This ensures the forwarder's output routing (including indexer discovery/load balancing) is applied globally.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/manager/local/

Answer

$SPLUNK_HOME/etc/apps/search/local/

Question 17

What is the purpose of the 'srchFilter' attribute in a role definition?

Accepted Answer

To automatically prepend a filter to all searches performed by the user.. The 'srchFilter' attribute in a role definition automatically prepends a filter to all searches performed by users with that role. This is used to enforce row-level security, such as restricting results to a specific index, sourcetype, or field value. For example, setting srchFilter = host=web* ensures users only see events from web hosts. It does not restrict index visibility (that's done via index permissions) or limit result counts.

Answer

To restrict which indexes a user can see.

Answer

To block specific users from the system.

Answer

To limit the number of results returned.

Question 18

Why might an administrator need to use the 'splunk edit licenser-localslave' command?

Accepted Answer

To configure the local instance to be a license slave.. The 'splunk edit licenser-localslave' command is used to configure a Splunk instance to act as a license slave (now called a license peer) that reports to a license master (license manager). It sets the license master URI on the local instance so it participates in the centralized licensing pool. This is the standard CLI method for pointing an instance at a license manager.

Answer

To reset the license violation counter.

Answer

To create a new license pool.

Answer

To delete an expired license.

Question 19

In props.conf, what does the 'REPORT-' prefix signify?

Accepted Answer

It defines a search-time extraction. In props.conf, the `REPORT-` prefix defines a search-time field extraction that references a transform stanza (typically in transforms.conf) using a regex. It is applied when a search runs against the data, not when the data is indexed. This is why REPORT- extractions can be added or modified without re-indexing existing events.

Answer

It triggers an alert

Answer

It defines an index-time extraction

Answer

It defines a line-breaking rule

Question 20

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. Splunk does not natively implement MFA; instead, it delegates authentication to an external Identity Provider (IdP) via SAML. When SAML is configured, Splunk acts as a Service Provider (SP), and the IdP handles the actual authentication, including MFA enforcement. This is the standard and recommended approach for enabling MFA in Splunk.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.