SPLK-1003 Practice Questions 2 — 50 Questions

Question 1

A Splunk administrator needs to reduce the storage footprint of an index named 'app_logs' on a standalone indexer. The index currently retains data indefinitely because no retention settings are configured. The administrator wants to (1) delete data older than 90 days and (2) cap the index at 500 GB, whichever limit is reached first. Which TWO settings should the administrator configure in indexes.conf to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

maxTotalDataSizeMB = 512000. Meeting both a 90-day age limit and a 500 GB size cap requires two settings: frozenTimePeriodInSecs for age-based freezing and maxTotalDataSizeMB for size-based freezing. Splunk freezes buckets when either limit is reached, so the oldest data is removed first. Path-specific size limits and bucket roll size settings do not enforce total index size or age-based deletion.

Answer

coldPath.maxDataSizeMB = 512000

Answer

homePath.maxDataSizeMB = 512000

Answer

maxDataSize = 512000

Question 2

An administrator needs to monitor a local text file on a Windows server and send the data to a Splunk indexer. Which component is the most efficient choice for this task?

Accepted Answer

Universal Forwarder. The Universal Forwarder is designed for minimal resource consumption when collecting data and forwarding it to an indexer.

Answer

Deployment Server

Answer

Heavy Forwarder

Answer

Splunk Light

Question 3

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Accepted Answer

splunkd.log. splunkd.log on the indexer records connection attempts, handshakes, and errors from forwarders. It is the primary log for troubleshooting forwarder-to-indexer connectivity, including TCP connection issues, SSL negotiation, and authentication failures.

Answer

audit.log

Answer

web_service.log

Answer

metrics.log

Question 4

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Accepted Answer

To specify which field the regex is applied to. SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Answer

To specify the index

Answer

To define the sourcetype

Answer

To set the time format

Question 5

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 6

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 7

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. When a Splunk configuration file is missing a required attribute, the engine does not fail or discard the file — it falls back to the default value defined in the underlying spec file (e.g., $SPLUNK_HOME/etc/system/README/*.conf.spec). This allows Splunk to remain resilient to incomplete configurations. The attribute is effectively ignored and the default is applied.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 8

What command is used to check the health and integrity of an index bucket?

Accepted Answer

splunk fsck. The 'splunk fsck' command is used to check the health and integrity of index buckets. It can detect and repair inconsistencies in bucket metadata and index files, ensuring that the index is not corrupted.

Answer

splunk status

Answer

splunk check

Answer

splunk validate

Question 9

What is the primary function of the 'Indexer Cluster' feature?

Accepted Answer

To provide data replication and high availability.. Indexer clustering provides data replication and high availability by grouping indexers into a cluster with a replication factor and search factor. If a peer node fails, replicated buckets on other peers keep the data searchable, and the cluster master coordinates bucket fixup to restore the target replication/search factors. This is the primary purpose of the feature — resilience, not performance.

Answer

To increase the web interface speed.

Answer

To speed up search queries across multiple head nodes.

Answer

To manage user permissions for index access.

Question 10

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. In Splunk, role and permission changes are not dynamically applied to an already-authenticated session. The user's session retains the permissions and role assignments that were in effect at the time of login, so the user must log out and log back in for the modified role to take effect. This is because Splunk caches role information in the session token at authentication time.

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.

Question 11

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. The most likely cause is that another process is already using port 9997. When Splunkd tries to bind to a port that is already in use, it fails to start or fails to listen on that port. This is a common issue when multiple instances or other applications are running on the same host.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 12

Which THREE of the following are valid components of a Splunk license configuration?

Accepted Answer

License Slave. In a Splunk licensing architecture, a License Master (C) is the central node that manages and distributes license entitlements to the rest of the deployment, and a License Slave (A) is any Splunk instance that connects to the License Master to receive its license allocation and report usage back — both are core, valid components of a Splunk license configuration. A License Pool (E) is also a valid component: it is a logical grouping of license capacity within the License Master that lets you allocate specific license volumes to specific groups of indexers or slaves. The other options are not real Splunk licensing components: there is no 'License Forwarder' (B) — forwarders are data-shipping components, not license roles — and no 'License Alert Manager' (D); license usage alerts are configured through the License Master's monitoring console or via saved searches, not a dedicated license component.

Answer

License Forwarder

Answer

License Alert Manager

Question 13

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Accepted Answer

authorize.conf. Role-based index access is controlled in authorize.conf, where each role stanza defines capabilities and, critically, the srchIndexesAllowed and srchIndexesDefault settings that determine which indexes a role can search. Restricting a user role from a specific index means editing the role's srchIndexesAllowed list in authorize.conf (or via the UI, which writes to authorize.conf). This is the authoritative file for role-to-index permissions.

Answer

user-prefs.conf

Answer

indexes.conf

Answer

authentication.conf

Question 14

Which TWO of the following are true regarding the Splunk Free license?

Accepted Answer

Authentication is disabled.. Option C is correct because the Splunk Free license disables user authentication, so anyone who can reach the instance is logged in automatically as the admin user and no login credentials are required. Option D is correct because Splunk Free enforces a daily indexing volume limit of 500 MB per day; once that limit is reached, indexing stops until the next day. Options A, B, and E are not part of the Free license: Splunk Free is a limited license that does not include the full set of Splunk Enterprise features, does not support multiple user roles (since authentication and role-based access control are disabled), and does not support distributed search across multiple indexers.

Answer

It includes Splunk Enterprise features.

Answer

It supports multiple user roles.

Answer

It supports distributed search.

Question 15

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Accepted Answer

It prevents the input from running. The 'disabled=1' attribute in an inputs.conf stanza tells splunkd to skip loading and running that input. The stanza remains in the configuration file (so it can be re-enabled later by setting disabled=0 or removing the attribute), but the input does not execute — no data is collected or forwarded from that source.

Answer

It errors out if the input is not found

Answer

It deletes the input

Answer

It hides the input from the UI

Question 16

An administrator has a Splunk Enterprise indexer with a single index named 'web_logs'. The index is configured with maxTotalDataSizeMB = 500000 and frozenTimePeriodInSecs = 7776000. The indexer's disk volume is 1TB and currently 80% full. The administrator wants to ensure that the oldest data is frozen when the disk reaches 90% capacity, even if the time or size limits have not been reached. Which configuration change should be made?

Accepted Answer

Configure the 'volume' stanza in indexes.conf with the 'maxVolumeDataSizeMB' setting and assign the index to that volume.. The volume stanza in indexes.conf defines a storage volume and its maximum size. When the volume's data exceeds maxVolumeDataSizeMB, Splunk freezes the oldest buckets in indexes assigned to that volume. This enforces freezing based on disk capacity, independent of time or size limits. The other options either relocate data, change time-based retention, or specify an archive location, none of which trigger freezing at a specific disk threshold.

Answer

Enable 'coldToFrozenDir' to archive data to a frozen directory.

Answer

Set the 'coldPath' to a different volume with more space.

Answer

Set 'frozenTimePeriodInSecs' to a lower value to force earlier freezing.

Question 17

A Splunk administrator needs to add a new index called 'security_events' that will store data on a dedicated storage volume. The volume is already defined in indexes.conf as 'volume_security'. Which stanza and setting must be added to indexes.conf to create the index and assign it to the volume?

Accepted Answer

[security_events] with 'volume' set to 'volume_security'.. To create an index and assign it to an existing volume, you define an index stanza with the 'volume' setting pointing to the volume name. This automatically configures the index's paths based on the volume's definitions. The volume stanza itself does not list indexes; instead, indexes reference volumes. This approach centralizes path management and simplifies configuration.

Answer

[security_events] with 'path' set to the volume's path.

Answer

[security_events] with 'homePath' and 'coldPath' set to the volume's paths.

Answer

[volume_security] with 'indexes' set to 'security_events'.

Question 18

What is the effect of setting 'maxHotSpanSecs' to a very low value?

Accepted Answer

More frequent bucket rolling.. Setting maxHotSpanSecs to a very low value causes Splunk to roll hot buckets into warm buckets more frequently, because the hot bucket's maximum time span is shortened. This results in more frequent bucket rolling, which can increase the number of buckets and impact search performance due to more bucket metadata to manage.

Answer

Increased search performance.

Answer

Decreased disk usage.

Answer

Faster ingestion.

Question 19

Which TWO locations are common places to check for configuration files on a Linux Splunk instance?

Accepted Answer

$SPLUNK_HOME/etc/system/local. Option A, $SPLUNK_HOME/etc/system/local, is correct because it is the standard directory for system-level configuration overrides that apply globally to the Splunk instance, and it takes precedence over the default settings in etc/system/default. Option B, $SPLUNK_HOME/etc/apps/[app_name]/local, is correct because app-specific local directories hold custom configuration changes for a particular app, overriding that app's default settings without affecting other apps. The remaining options are not configuration locations: $SPLUNK_HOME/bin holds Splunk's executable binaries and CLI scripts such as splunk and splunkd, $SPLUNK_HOME/var/run stores runtime state files like process IDs and the splunkd port file, and $SPLUNK_HOME/var/log contains Splunk's internal log files such as splunkd.log and metrics.log.

Answer

$SPLUNK_HOME/bin

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/var/log

Question 20

How do you restart the Splunk service on a Linux-based Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/bin/splunk restart. The Splunk CLI provides a built-in 'restart' command invoked via the splunk binary located in $SPLUNK_HOME/bin. Running '$SPLUNK_HOME/bin/splunk restart' cleanly stops and starts the splunkd process on a Linux Universal Forwarder, preserving configuration and state. This is the officially supported method for restarting the service on any Splunk component, including UFs.

Answer

service splunk stop

Answer

kill -9 $(pgrep splunk)

Answer

reboot