SPLK-1003 Practice Exam 4 — 20 Questions

Question 1

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 2

Which capability is exclusive to a Heavy Forwarder compared to a Universal Forwarder?

Accepted Answer

Parsing data. Heavy Forwarders can perform full parsing, indexing, and routing of data.

Answer

Collecting local files

Answer

Connecting to a Deployment Server

Answer

Forwarding data

Question 3

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. Splunk generally uses default values if an attribute is omitted, provided the stanza itself is valid.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 4

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf, props.conf, and transforms.conf form the core of data processing.

Answer

server.conf

Answer

indexes.conf

Question 5

Why might an administrator need to use the 'splunk edit licenser-localslave' command?

Accepted Answer

To configure the local instance to be a license slave.. This command allows the local instance to be configured as a license slave if it wasn't during installation.

Answer

To reset the license violation counter.

Answer

To create a new license pool.

Answer

To delete an expired license.

Question 6

What is the maximum number of license violations allowed in a 30-day period before search is blocked?

Accepted Answer

5. Splunk allows 5 violations in a 30-day rolling window before blocking search.

Answer

3

Answer

10

Answer

1

Question 7

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. 8000 is the standard default port for Splunk Web.

Answer

9997

Answer

8089

Answer

443

Question 8

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. Changes to a user's role permissions take effect only upon the next login (or session refresh).

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.

Question 9

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. The Splunk instance itself acts as the Service Provider (SP) in the SAML handshake.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 10

When using the 'splunk cmd splunkd bucket-info' tool, what are you primarily investigating?

Accepted Answer

Bucket state and event boundaries.. This tool allows administrators to inspect the properties of individual buckets, such as size, state, and event counts.

Answer

Search performance metrics.

Answer

User authentication logs.

Answer

Indexer license usage.

Question 11

If a search head cluster member cannot access an indexer's bucket, what should you verify first?

Accepted Answer

The replication status and indexer clustering state.. Bucket access in a cluster is often related to the replication factor and the status of the bucket on the indexer peers.

Answer

The indexer's license status.

Answer

The OS version of the search head.

Answer

The search head's RAM.

Question 12

Which configuration file is used to define index-time field extractions and line-breaking rules?

Accepted Answer

props.conf. props.conf is the primary file for configuring how data is parsed, including line breaking and field extractions.

Answer

indexes.conf

Answer

transforms.conf

Answer

inputs.conf

Question 13

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Accepted Answer

--show-files. The --show-files flag lists the file path for each setting returned by btool.

Answer

--list-files

Answer

--debug

Answer

--source

Question 14

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

Accepted Answer

splunk btool props list --debug. Using 'btool props list --debug' allows you to see exactly where the configuration is being pulled from.

Answer

splunk list sourcetypes

Answer

splunk show props

Answer

splunk inspect props

Question 15

Which TWO locations are common places to check for configuration files on a Linux Splunk instance?

Accepted Answer

$SPLUNK_HOME/etc/system/local. Configurations reside in system/local or app/local directories.

Answer

$SPLUNK_HOME/bin

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/var/log

Question 16

A Splunk administrator needs to identify how much data is being indexed across multiple indexers to ensure they do not exceed their daily license quota. Where should the admin look first?

Accepted Answer

Settings > Licensing. The License Master view provides the centralized dashboard for daily license usage reporting.

Answer

Settings > Distributed Search

Answer

Settings > Indexer Clustering

Answer

Settings > Forwarder Management

Question 17

An administrator wants to see a daily breakdown of license usage for the last 30 days. Which view is most appropriate?

Accepted Answer

Settings > Licensing > Usage Report. The 'Usage Report' within the Licensing section of Splunk Web provides this historical visualization.

Answer

Settings > Indexer Clustering

Answer

Settings > Licensing > Master

Answer

Settings > Forwarder Management

Question 18

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

Accepted Answer

delete. The 'delete' capability is required to run the 'delete' search command.

Answer

edit_search

Answer

can_delete_data

Answer

admin_all_objects

Question 19

Which TWO settings in indexes.conf are used to control the rotation of hot buckets?

Accepted Answer

maxHotSpanSecs. maxDataSize and maxHotSpanSecs are the two primary parameters that determine when a bucket should roll from hot to warm.

Answer

frozenTimePeriodInSecs

Answer

maxTotalDataSizeMB

Answer

coldPath

Question 20

Which TWO methods can be used to monitor the disk usage of an index?

Accepted Answer

Settings > Data > Indexes page.. The Splunk GUI provides a dashboard and the CLI provides 'splunk list indexes' to view status.

Answer

Running a search on _audit.

Answer

Viewing the license_usage.log.

Answer

Checking the web.conf file.