SPLK-1003 Practice Test 3 — 10 Questions

Question 1

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

Accepted Answer

props.conf. The TIME_PREFIX and TIME_FORMAT settings in props.conf determine how Splunk parses timestamps from raw logs.

Answer

indexes.conf

Answer

inputs.conf

Answer

transforms.conf

Question 2

Which THREE of the following are true regarding license usage monitoring?

Accepted Answer

Usage can be viewed via the Splunk Web UI.. Monitoring can be done via the UI, the REST API, or by querying internal logs.

Answer

Usage must be calculated manually from event count.

Answer

License usage is only available to the splunk-system-user.

Question 3

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Accepted Answer

Use a Search Head Cluster and push the bundle via the deployer.. Splunk configurations should be managed via the Deployment Server or a Configuration Management tool like Git/Ansible to ensure consistency across search heads.

Answer

Manually copy the local/savedsearches.conf file to every server.

Answer

Enable indexer discovery on all search heads.

Answer

Restart the Splunk services on all search heads.

Question 4

Which TWO of the following are true about the 72-hour grace period?

Accepted Answer

It disables indexing after 72 hours.. The 72-hour grace period applies when a slave cannot reach the master; it is not a violation in the 30-day window sense.

Answer

It allows the admin to search during the period.

Answer

It only applies to trial licenses.

Answer

It counts as a license violation.

Question 5

Which THREE of the following items are considered 'license slaves'?

Accepted Answer

Standalone instances. Only indexers and search heads (that perform indexing) are typically categorized as slaves in this context; heavy forwarders are not.

Answer

Universal Forwarders

Answer

Deployment Servers

Question 6

Which of the following describes the purpose of a License Pool?

Accepted Answer

To distribute license quota among indexer groups.. License pools allow an administrator to allocate specific license quotas to different indexer groups.

Answer

To enable data replication across indexers.

Answer

To speed up data ingestion.

Answer

To increase the total license volume.

Question 7

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Accepted Answer

Settings -> Access Controls -> Users. Settings -> Users provides the UI to create and modify user attributes and roles.

Answer

Settings -> Roles

Answer

Settings -> Server Settings

Answer

Settings -> Authentication Method

Question 8

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Universal forwarders perform no parsing and have a minimal footprint.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 9

A Splunk administrator observes that the license master is reporting an 'indexer-slave' mismatch. Which configuration file should the admin check on the license slave?

Accepted Answer

server.conf. The slave's connection to the master is defined in the [license] stanza of server.conf.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 10

What happens if the License Master becomes unreachable?

Accepted Answer

Indexing continues for 72 hours.. The indexers (slaves) will continue to index data for a grace period (typically 72 hours) before stopping.

Answer

Indexing continues indefinitely.

Answer

Indexing stops immediately.

Answer

Search heads stop working.