SPLK-1003 Practice Exam 3 — 20 Questions

Question 1

An administrator has configured a License Pool and assigned specific indexers to it. However, the indexers are still consuming from the 'default' pool. What is the most likely cause?

Accepted Answer

The license_pool attribute in server.conf was not mapped correctly to the License Master.. The license pool configuration requires the indexers to be explicitly configured to point to the License Master, and the License Master must be aware of the specific pool assignment for those slaves.

Answer

License pools only apply to search heads.

Answer

The indexers have not been restarted.

Answer

The indexers are using a trial license.

Question 2

An administrator needs to monitor a local text file on a Windows server and send the data to a Splunk indexer. Which component is the most efficient choice for this task?

Accepted Answer

Universal Forwarder. The Universal Forwarder is designed for minimal resource consumption when collecting data and forwarding it to an indexer.

Answer

Deployment Server

Answer

Heavy Forwarder

Answer

Splunk Light

Question 3

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Accepted Answer

inputs.conf. inputs.conf is the standard file for configuring data inputs like TCP ports.

Answer

outputs.conf

Answer

props.conf

Answer

server.conf

Question 4

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Accepted Answer

splunk cmd btool props list --debug. splunk btool is the standard CLI utility to show the merged configuration files for a specific context.

Answer

splunk show-config

Answer

splunk edit props

Answer

splunk list configs

Question 5

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Accepted Answer

To specify which field the regex is applied to. SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Answer

To specify the index

Answer

To define the sourcetype

Answer

To set the time format

Question 6

When configuring a Deployment Client, what must be defined in deploymentclient.conf?

Accepted Answer

deploymentServer URI. The client must specify the URI and port of the Deployment Server.

Answer

The index location.

Answer

The list of indexers.

Answer

The password for the admin user.

Question 7

You have configured a serverclass in serverclass.conf on the Deployment Server. Which action is required to ensure that the forwarders receive the new configuration?

Accepted Answer

Run the reload deploy-server command. After updating configuration files on the Deployment Server, you must either wait for the poll interval or trigger a reload of the deployment server configuration.

Answer

...

Answer

Update outputs.conf on the client

Answer

Restart the forwarder service

Answer

Modify the indexer's inputs.conf

Question 8

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/local/. Best practices dictate that configurations should be overridden in the 'local' directory to prevent loss during updates.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/users/admin/

Answer

$SPLUNK_HOME/etc/apps/app_name/default/

Question 9

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

Accepted Answer

To specify the start of the timestamp. It specifies the regex pattern to locate the start of the timestamp in an event.

Answer

To set the time format

Answer

To define the timezone

Answer

To truncate the timestamp

Question 10

You are deploying a Universal Forwarder to a Windows server that must monitor local Event Logs and send them to an Indexer. Which component is required to handle the parsing of these logs before they are forwarded?

Accepted Answer

The Indexer. Universal Forwarders do not perform heavy parsing. They forward data as-is, and the Indexer handles the parsing.

Answer

The Deployment Server

Answer

An intermediate UF

Answer

A Heavy Forwarder

Question 11

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 12

Which TWO of the following are valid stanza types found in indexes.conf?

Accepted Answer

[default]. indexes.conf uses index names as stanzas, and [default] for global settings.

Answer

[tcpout]

Answer

[input]

Answer

[source::...]

Question 13

Which TWO settings are required to enable cold-to-frozen archiving?

Accepted Answer

coldToFrozenDir. To enable archiving, you must define the coldToFrozenScript and ensure the path for frozen data exists.

Answer

frozenPath

Answer

maxFrozenSize

Answer

enableArchive = true

Question 14

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 15

Which user interface feature allows you to view the connectivity status of all forwarders reporting to an Indexer?

Accepted Answer

Forwarder Management. The Forwarder Management dashboard provides a high-level view of connected forwarders.

Answer

License Manager

Answer

Data Inputs

Answer

Indexes

Question 16

Which license type does not support license clustering?

Accepted Answer

Free License. The Free license is a standalone, single-instance license and does not support clustering or license pools.

Answer

Enterprise License

Answer

Trial License

Answer

Developer License

Question 17

When setting up a License Master in a distributed environment, what is the recommended practice for the License Master role?

Accepted Answer

Dedicate an instance to act as the License Master.. The License Master should be a dedicated instance (or a primary instance) to ensure license availability and accurate reporting.

Answer

Co-locate it with a Search Head.

Answer

Co-locate it with a heavy forwarder.

Answer

Assign it to a standalone Indexer.

Question 18

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 19

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 20

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local