SPLK-1003 Practice Test 3 — 30 Questions

Question 1

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. The most likely cause is that another process is already using port 9997. When Splunkd tries to bind to a port that is already in use, it fails to start or fails to listen on that port. This is a common issue when multiple instances or other applications are running on the same host.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 2

Which THREE of the following are valid components of a Splunk license configuration?

Accepted Answer

License Slave. In a Splunk licensing architecture, a License Master (C) is the central node that manages and distributes license entitlements to the rest of the deployment, and a License Slave (A) is any Splunk instance that connects to the License Master to receive its license allocation and report usage back — both are core, valid components of a Splunk license configuration. A License Pool (E) is also a valid component: it is a logical grouping of license capacity within the License Master that lets you allocate specific license volumes to specific groups of indexers or slaves. The other options are not real Splunk licensing components: there is no 'License Forwarder' (B) — forwarders are data-shipping components, not license roles — and no 'License Alert Manager' (D); license usage alerts are configured through the License Master's monitoring console or via saved searches, not a dedicated license component.

Answer

License Forwarder

Answer

License Alert Manager

Question 3

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Accepted Answer

authorize.conf. Role-based index access is controlled in authorize.conf, where each role stanza defines capabilities and, critically, the srchIndexesAllowed and srchIndexesDefault settings that determine which indexes a role can search. Restricting a user role from a specific index means editing the role's srchIndexesAllowed list in authorize.conf (or via the UI, which writes to authorize.conf). This is the authoritative file for role-to-index permissions.

Answer

user-prefs.conf

Answer

indexes.conf

Answer

authentication.conf

Question 4

Which TWO of the following are true regarding the Splunk Free license?

Accepted Answer

Authentication is disabled.. Option C is correct because the Splunk Free license disables user authentication, so anyone who can reach the instance is logged in automatically as the admin user and no login credentials are required. Option D is correct because Splunk Free enforces a daily indexing volume limit of 500 MB per day; once that limit is reached, indexing stops until the next day. Options A, B, and E are not part of the Free license: Splunk Free is a limited license that does not include the full set of Splunk Enterprise features, does not support multiple user roles (since authentication and role-based access control are disabled), and does not support distributed search across multiple indexers.

Answer

It includes Splunk Enterprise features.

Answer

It supports multiple user roles.

Answer

It supports distributed search.

Question 5

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Accepted Answer

It prevents the input from running. The 'disabled=1' attribute in an inputs.conf stanza tells splunkd to skip loading and running that input. The stanza remains in the configuration file (so it can be re-enabled later by setting disabled=0 or removing the attribute), but the input does not execute — no data is collected or forwarded from that source.

Answer

It errors out if the input is not found

Answer

It deletes the input

Answer

It hides the input from the UI

Question 6

An administrator has a Splunk Enterprise indexer with a single index named 'web_logs'. The index is configured with maxTotalDataSizeMB = 500000 and frozenTimePeriodInSecs = 7776000. The indexer's disk volume is 1TB and currently 80% full. The administrator wants to ensure that the oldest data is frozen when the disk reaches 90% capacity, even if the time or size limits have not been reached. Which configuration change should be made?

Accepted Answer

Configure the 'volume' stanza in indexes.conf with the 'maxVolumeDataSizeMB' setting and assign the index to that volume.. The volume stanza in indexes.conf defines a storage volume and its maximum size. When the volume's data exceeds maxVolumeDataSizeMB, Splunk freezes the oldest buckets in indexes assigned to that volume. This enforces freezing based on disk capacity, independent of time or size limits. The other options either relocate data, change time-based retention, or specify an archive location, none of which trigger freezing at a specific disk threshold.

Answer

Enable 'coldToFrozenDir' to archive data to a frozen directory.

Answer

Set the 'coldPath' to a different volume with more space.

Answer

Set 'frozenTimePeriodInSecs' to a lower value to force earlier freezing.

Question 7

A Splunk administrator needs to add a new index called 'security_events' that will store data on a dedicated storage volume. The volume is already defined in indexes.conf as 'volume_security'. Which stanza and setting must be added to indexes.conf to create the index and assign it to the volume?

Accepted Answer

[security_events] with 'volume' set to 'volume_security'.. To create an index and assign it to an existing volume, you define an index stanza with the 'volume' setting pointing to the volume name. This automatically configures the index's paths based on the volume's definitions. The volume stanza itself does not list indexes; instead, indexes reference volumes. This approach centralizes path management and simplifies configuration.

Answer

[security_events] with 'path' set to the volume's path.

Answer

[security_events] with 'homePath' and 'coldPath' set to the volume's paths.

Answer

[volume_security] with 'indexes' set to 'security_events'.

Question 8

What is the effect of setting 'maxHotSpanSecs' to a very low value?

Accepted Answer

More frequent bucket rolling.. Setting maxHotSpanSecs to a very low value causes Splunk to roll hot buckets into warm buckets more frequently, because the hot bucket's maximum time span is shortened. This results in more frequent bucket rolling, which can increase the number of buckets and impact search performance due to more bucket metadata to manage.

Answer

Increased search performance.

Answer

Decreased disk usage.

Answer

Faster ingestion.

Question 9

Which TWO locations are common places to check for configuration files on a Linux Splunk instance?

Accepted Answer

$SPLUNK_HOME/etc/system/local. Option A, $SPLUNK_HOME/etc/system/local, is correct because it is the standard directory for system-level configuration overrides that apply globally to the Splunk instance, and it takes precedence over the default settings in etc/system/default. Option B, $SPLUNK_HOME/etc/apps/[app_name]/local, is correct because app-specific local directories hold custom configuration changes for a particular app, overriding that app's default settings without affecting other apps. The remaining options are not configuration locations: $SPLUNK_HOME/bin holds Splunk's executable binaries and CLI scripts such as splunk and splunkd, $SPLUNK_HOME/var/run stores runtime state files like process IDs and the splunkd port file, and $SPLUNK_HOME/var/log contains Splunk's internal log files such as splunkd.log and metrics.log.

Answer

$SPLUNK_HOME/bin

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/var/log

Question 10

How do you restart the Splunk service on a Linux-based Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/bin/splunk restart. The Splunk CLI provides a built-in 'restart' command invoked via the splunk binary located in $SPLUNK_HOME/bin. Running '$SPLUNK_HOME/bin/splunk restart' cleanly stops and starts the splunkd process on a Linux Universal Forwarder, preserving configuration and state. This is the officially supported method for restarting the service on any Splunk component, including UFs.

Answer

service splunk stop

Answer

kill -9 $(pgrep splunk)

Answer

reboot

Question 11

You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?

Accepted Answer

props.conf and transforms.conf. To filter sensitive data on a Heavy Forwarder before it reaches the indexer, you modify props.conf and transforms.conf. props.conf defines the stanza and references a transform, while transforms.conf contains the regex-based rules (e.g., REGEX and DEST_KEY or FORMAT) that drop or mask events/fields. This combination enables data filtering at the parsing stage on the heavy forwarder.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 12

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 13

Which file in the index directory contains the bucket's metadata?

Accepted Answer

bucket.meta. The bucket.meta file in a Splunk index bucket directory contains metadata about the bucket, including its state (hot, warm, cold, frozen), time range, and other properties. It is essential for the indexer to manage bucket lifecycle and searchability.

Answer

rawdata

Answer

journal.gz

Answer

index.conf

Question 14

You have configured a serverclass in serverclass.conf on the Deployment Server. Which action is required to ensure that the forwarders receive the new configuration?

Accepted Answer

Run the reload deploy-server command. After updating configuration files on the Deployment Server, you must either wait for the poll interval or trigger a reload of the deployment server configuration.

Answer

...

Answer

Update outputs.conf on the client

Answer

Restart the forwarder service

Answer

Modify the indexer's inputs.conf

Question 15

When configuring an index, which setting determines the directory where 'cold' buckets are stored?

Accepted Answer

coldPath. The coldPath setting in indexes.conf specifies the directory where cold buckets are stored. As buckets age out of the hot/warm phase, they are rolled to cold storage, and coldPath defines that location. This allows administrators to place cold data on cheaper, slower disks.

Answer

thawedPath

Answer

homePath

Answer

frozenPath

Question 16

Which THREE of the following items are considered Knowledge Objects in Splunk?

Accepted Answer

Saved searches.. In Splunk, Knowledge Objects are user-created configurations that enrich, normalize, and present machine data, and Saved searches (C) qualify because they are reusable search definitions stored in Splunk that can be shared, scheduled, and used to drive other knowledge objects. Dashboards (D) are also Knowledge Objects since they are XML/JSON-defined panels and visualizations built from searches and stored in Splunk for reuse and sharing. Alerts (E) are Knowledge Objects as well, because they are saved search definitions with trigger conditions and actions that fire when results meet specified thresholds. Network cables (A) and hard drives (B) are physical hardware components, not Splunk-created knowledge artifacts, so they are not Knowledge Objects.

Answer

Network cables.

Answer

Hard drives.

Question 17

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf is correct because it defines the data inputs (monitor, TCP/UDP, scripted, etc.) that determine what data gets ingested into the indexer, including stanzas like [monitor:///var/log] with settings such as disabled, sourcetype, and index. props.conf is correct because it controls how the indexer parses and processes incoming events, setting sourcetype, line-breaking (LINE_BREAKER, SHOULD_LINEMERGE), timestamp recognition (TIME_PREFIX, TIME_FORMAT), and field extractions at index time. transforms.conf is correct because it defines the regex-based transformations and field extractions (REGEX, FORMAT, DEST_KEY) referenced by props.conf and inputs.conf, enabling routing, masking, and parsing of ingested data. server.conf is not among the three because it governs server-level settings like clustering, licensing, and general Splunk instance behavior rather than ingestion or parsing. indexes.conf is not among the three because it defines index storage properties such as path, maxDataSize, and retention, not how data is ingested or parsed.

Answer

server.conf

Answer

indexes.conf

Question 18

Which THREE factors can impact the performance of a Universal Forwarder?

Accepted Answer

Network bandwidth limits. Network bandwidth limits (B) directly affect a Universal Forwarder because it must transmit event data to the indexer over TCP port 9997, and constrained throughput causes queuing and delayed delivery. The number of active file monitors (D) impacts performance since each monitored file consumes resources for file tracking, checksumming, and reading, and many monitors increase CPU and memory usage. Disk I/O contention (E) matters because the forwarder continuously reads from monitored files and writes to its fishbucket and persistent queues, so slow or contended disks throttle ingestion. Browser type (A) is irrelevant because the Universal Forwarder has no web UI and is configured via CLI or deployment apps, and the number of logged-in users (C) does not affect the forwarder, which runs as a background service independent of interactive user sessions.

Answer

Browser type used for access

Answer

The number of users logged in

Question 19

Which of the following is a primary reason to choose a Heavy Forwarder over a Universal Forwarder?

Accepted Answer

Ability to perform index-time parsing. A primary reason to choose a Heavy Forwarder over a Universal Forwarder is the ability to perform index-time parsing. Heavy Forwarders can parse, filter, and transform data (using props.conf/transforms.conf) before forwarding, whereas Universal Forwarders primarily forward raw data with minimal processing. This makes Heavy Forwarders suitable for data reduction and routing.

Answer

Easier installation

Answer

Native indexing capability

Answer

Lower CPU utilization

Question 20

An administrator needs to move the License Master from one server to another. What is the most critical step?

Accepted Answer

Updating the Master URI on all license slaves.. When moving the License Master to a new server, every license slave (indexer, search head, forwarder in some topologies) must be pointed at the new License Master URI via the [license] stanza's master_uri setting in server.conf. Without this update, slaves continue trying to reach the old master, causing license warnings, search failures, or a complete loss of licensing enforcement. The new master must also be configured with the same license keys and pool assignments.

Answer

Reinstalling Splunk on all indexers.

Answer

Changing the license key files on the indexers.

Answer

Deleting the indexer clusters.