SPLK-1003 Practice Questions 1 — 50 Questions

Question 1

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When a user inherits multiple roles, the permissions are additive — the user receives the union of all granted permissions. RoleA allows index1 and RoleB allows index2, so the user can search both index1 and index2. Splunk does not require a single role to grant all access; it merges srchIndexesAllowed across all effective roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 2

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Accepted Answer

transforms.conf. In Splunk, regex-based routing to different indexes is achieved by defining a transform with a REGEX and a DEST_KEY that points to the index metadata field (_MetaData:Index). This transform is defined in transforms.conf. The transform is then referenced from props.conf using a rule class (e.g., TRANSFORMS- = ). Therefore, transforms.conf is the file that must be configured to define the routing regex.

Answer

indexes.conf

Answer

props.conf

Answer

inputs.conf

Question 3

An administrator is configuring a new indexer to join an existing Splunk Enterprise deployment. The license master is at splunk-license.example.com:8089. The administrator runs the CLI command 'splunk edit licenser-localslave -master_uri https://splunk-license.example.com:8089'. What is the effect of this command?

Accepted Answer

It designates the indexer as a license slave and points it to the specified license master.. The command 'splunk edit licenser-localslave' with the -master_uri parameter configures the local instance as a license slave and points it to the license master. This is the correct way to add an indexer to a license master's management. It ensures the indexer reports its indexing volume and adheres to the license terms.

Answer

It configures the indexer to act as a license master for the deployment.

Answer

It enables the indexer to use the free license by contacting the license master.

Answer

It adds the specified license master to the indexer's search head pool.

Question 4

A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)

Accepted Answer

Providing the interface for knowledge object management such as saved searches and dashboards. Search heads orchestrate distributed searches by dispatching map phases to indexers and merging the reduce results, and they also host the user interface plus the knowledge object store. Raw data storage belongs to indexers, data collection to forwarders, and license administration to the license manager, so those functions are excluded from the search head role.

Answer

Collecting data from endpoints and forwarding it into the pipeline

Answer

Managing the license pool and issuing license warnings to peers

Answer

Storing raw event data in buckets on disk

Question 5

What is the primary function of the 'thawed' bucket state?

Accepted Answer

It is used to store restored frozen data.. The 'thawed' bucket state in Splunk is used to hold data that has been restored from a frozen archive. When an admin rebuilds a frozen bucket (e.g., from cold storage or backup), the restored bucket is placed in the thawed state so it can be re-indexed and made searchable again. It is not a normal lifecycle state for live data.

Answer

It is the default state for new data.

Answer

It is for data that is being deleted.

Answer

It is a cache for warm buckets.

Question 6

A company has a 1 TB per day Enterprise license shared across two pools: one for a security team indexing 600 GB per day and one for an IT operations team indexing 300 GB per day. The security team's pool is configured with a 500 GB per day quota. What happens when the security team's indexers exceed 500 GB in a single day while the IT operations pool remains under its quota?

Accepted Answer

The security pool records a violation against its pool, while the IT operations pool continues indexing under its own quota.. License pools partition the total license so each group's usage is measured against its own quota. When the security pool exceeds 500 GB in a day, the violation is attributed to that pool, while the IT operations pool stays within its allocation and continues indexing normally. This isolation is the primary reason to configure pools for separate teams.

Answer

The entire deployment immediately stops indexing until the next license window begins.

Answer

The security team's indexers are disabled and must be manually re-enabled by an administrator after the quota resets.

Answer

The overflow is automatically reallocated to the IT operations pool's unused quota to avoid a violation.

Question 7

An administrator receives reports that searches are returning warnings about license violations and that search has been partially restricted. The administrator wants to identify which indexers contributed the most indexing volume in the last 24 hours to determine the source of the overage. Which approach provides this information?

Accepted Answer

Run a search over the _internal index for license_usage.log events and use the splunk_server field to break down volume by indexer.. license_usage.log is written to the _internal index and records usage per reporting indexer, with splunk_server identifying the host. Searching that source and aggregating by splunk_server yields a ranked list of indexers by volume for the last 24 hours, which is the most direct way to find the hosts responsible for a license overage.

Answer

Query the license manager's REST endpoint /services/licenser/usage and aggregate results by pool name.

Answer

Inspect the indexer's metrics.log for per-sourcetype throughput and rank sourcetypes by volume.

Answer

Open the Monitoring Console License Usage view and read the Indexing Volume by Indexer panel for the last 24 hours.

Question 8

A Splunk administrator is configuring a Deployment Server to manage a large number of Universal Forwarders. The administrator notices that some forwarders are not receiving updated configurations. Upon investigation, the administrator finds that the forwarders have different 'serverName' values in server.conf than their actual hostnames. What is the most likely cause of the forwarders not receiving the updated configurations?

Accepted Answer

The Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass.. The most likely cause is that the Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass and thus will not receive the updated configurations. The serverName is the client name that the forwarder reports to the Deployment Server. If it differs from the actual hostname, any serverclass filters based on hostname will fail to match.

Answer

The Deployment Server will ignore forwarders with duplicate serverName values, causing them not to receive configurations.

Answer

The forwarders will not be able to download apps because the serverName is used to determine the app directory path.

Answer

The forwarders cannot connect to the Deployment Server because the serverName is used for authentication.

Question 9

An administrator wants a set of index-time field extractions and custom source types to be available only to a specific department's users while remaining hidden from all other users on the same search head. Which configuration approach accomplishes this?

Accepted Answer

Place the props.conf and transforms.conf stanzas in the department's app and grant that app read access only to the department's role.. App-level permissions are the correct mechanism for scoping configurations to a subset of users. A dedicated app containing the props.conf and transforms.conf stanzas, with read access granted only to the department role, ensures the knowledge objects are applied for that role and hidden from everyone else. Global locations such as system/local or the search app apply to all users and cannot provide this isolation.

Answer

Define the extractions in the search-time props.conf of the search head and rely on field-level permissions.

Answer

Add the stanzas to the etc/apps/search app and use a search filter to remove the fields for unauthorized users.

Answer

Create the stanzas in etc/system/local on the search head so they override every other app.

Question 10

If a search head cluster member cannot access an indexer's bucket, what should you verify first?

Accepted Answer

The replication status and indexer clustering state.. When a search head cluster member cannot access an indexer's bucket, the most likely cause is a problem with the indexer clustering or replication state, such as a bucket not being properly replicated or a peer being down. Verifying replication status and indexer clustering state ensures that buckets are searchable and available. This is the first step because it directly addresses data availability across the cluster.

Answer

The indexer's license status.

Answer

The OS version of the search head.

Answer

The search head's RAM.

Question 11

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

Accepted Answer

groupBaseDN. To authenticate users via LDAP and map their group memberships to Splunk roles, you must specify the userBaseDN to locate user accounts and the groupBaseDN to locate groups. These settings enable Splunk to search the directory for users and groups, and then use the roleMap to assign roles based on group membership.

Answer

bindDN

Answer

srvBaseDN

Answer

roleBaseDN

Question 12

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 13

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The homePath setting in indexes.conf specifies the directory where the index's data is stored. To move the index data directory to a new partition, you must update homePath to point to the new location. This setting is critical for relocating index data.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 14

An administrator wants to view the current license usage and see which indexers are reporting to the license master. Which Splunk Web page should the administrator navigate to?

Accepted Answer

Settings > Licensing. In Splunk Web, license usage and the list of indexers reporting to the license master are found under Settings > Licensing. This page provides a comprehensive view of license consumption, including daily volume, quota, and violations. Other pages under Settings, such as Indexers, Server Settings, and Distributed Search, serve different purposes and do not display license information.

Answer

Settings > Server Settings

Answer

Settings > Distributed Search

Answer

Settings > Indexers

Question 15

A Splunk administrator is configuring SAML authentication for the company's Splunk Enterprise deployment. The Identity Provider (IdP) sends a group attribute named 'memberOf' containing the value 'CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. The administrator needs this group to automatically map to the 'power' role in Splunk. Which configuration file and stanza should the administrator edit to accomplish this?

Accepted Answer

authentication.conf, under the [roleMap_SAML] stanza with the attribute 'power = CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. SAML group-to-role mapping in Splunk Enterprise is configured in authentication.conf within a [roleMap_SAML] stanza, where each entry pairs a Splunk role with one or more IdP group values. This allows automatic role assignment at login based on the IdP's group assertion. The [saml] stanza handles identity provider connection details, while authorize.conf defines role capabilities, not SAML mappings.

Answer

authentication.conf, under the [saml] stanza with the attribute 'roleMap'

Answer

web.conf, under the [settings] stanza with the attribute 'samlRoleMapping'

Answer

authorize.conf, under the [role_power] stanza with the attribute 'samlGroup'

Question 16

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Option D is correct because the 'splunk status' CLI command queries the local splunkd process and reports whether Splunk is running, along with PID and component status, making it a standard supported method to monitor instance health. Option E is correct because the Monitoring Console app in Splunk Web provides a centralized, supported dashboard for monitoring the health, performance, and status of Splunk instances, including indexers, search heads, and forwarders. Option A is incorrect because /tmp lock files are not a documented or reliable status indicator and their presence does not reflect Splunk's operational state. Option B is incorrect because indexer cluster raw binary data (bucket files) is internal storage, not a monitoring interface, and reading it does not report instance status. Option C is incorrect because pinging a forwarder's local web port does not validate Splunk's status and forwarders typically do not run Splunk Web by default.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 17

Which TWO components must be configured on a Universal Forwarder to ensure data reaches the Indexer?

Accepted Answer

outputs.conf. On a Universal Forwarder, inputs.conf (option E) is required to define what data to collect — for example, a [monitor://] stanza specifying the file or directory to watch — so without it the forwarder has nothing to send. outputs.conf (option A) is equally required because it defines the destination indexer(s), typically via [tcpout] with server=<host>:9997 and defaultGroup settings, so the collected data knows where to go. Together these two files satisfy the forwarder's core job of reading data and forwarding it to the indexer. props.conf (option B) is optional on a forwarder and only used for parsing/sourcetype handling, not for routing data. indexes.conf (option C) is an indexer-side configuration defining index storage paths and retention, not needed on a forwarder. web.conf (option D) configures Splunk Web settings and is irrelevant to forwarding data.

Answer

props.conf

Answer

indexes.conf

Answer

web.conf

Question 18

A security team requires that all Splunk users authenticate through your corporate LDAP directory, but they also need a local break-glass account in case LDAP becomes unreachable. You configure LDAP authentication in Splunk Web. Which action ensures the local administrator account can still log in when the LDAP servers are down?

Accepted Answer

Configure LDAP as the authentication scheme and ensure the local administrator account has a password set and is not disabled.. Selecting LDAP as the authentication scheme routes normal logins to the directory, but Splunk retains local accounts that have a password and are enabled. The built-in admin account is local by default, so setting its password and leaving it enabled provides emergency access if LDAP is unreachable. This is the documented method for maintaining a local fallback while using an external authentication scheme.

Answer

Enable the 'Allow local users' option under LDAP settings and map the local administrator to an LDAP group.

Answer

Create a second authentication scheme entry for 'Splunk' and set it as the default, then add LDAP as a secondary scheme.

Answer

Add the local administrator to the 'admin' role and leave the default authentication scheme as 'Splunk'.

Question 19

If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?

Accepted Answer

log-local.cfg. log-local.cfg is the per-instance logging configuration file used to override logging levels for specific components without affecting the global log.cfg. On a Universal Forwarder, editing $SPLUNK_HOME/etc/system/local/log-local.cfg (or the app-specific copy) lets you raise or lower verbosity for a named component such as the tailing processor or the deployment client. Changes take effect after a forwarder restart or a debug refresh.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 20

Which TWO of the following are valid ways to configure inputs on a Universal Forwarder?

Accepted Answer

Editing inputs.conf manually. Option A is correct because inputs.conf is the primary configuration file on a Universal Forwarder, and manually editing it (typically under $SPLUNK_HOME/etc/system/local/ or an app's local directory) is a fully supported way to define inputs such as [monitor://], [tcp://], or [udp://] stanzas. Option B is correct because the 'splunk add monitor' CLI command (e.g., 'splunk add monitor /var/log') is a valid, supported method that writes the corresponding stanza into inputs.conf on the Universal Forwarder. Option C is incorrect because outputs.conf defines where the forwarder sends data (indexers, via [tcpout] settings), not what data it collects. Option D is incorrect because the Indexer UI is used for searching and managing the indexer, not for configuring inputs on a separate Universal Forwarder, which has no full web UI for input management. Option E is incorrect because the License Master API concerns license management and has nothing to do with defining data inputs on a forwarder.

Answer

Editing outputs.conf

Answer

Using the Indexer UI web interface

Answer

Using the License Master API